validate-stack.yml

name: Repo Validation

on:
  push:
  pull_request:

jobs:
  release_audit:
    name: Repo Validation
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
        with:
          python-version: "3.12"

      - name: Install test dependencies
        run: python -m pip install -r requirements-dev.txt

      - name: Install shellcheck, rsync, podman and podman-compose
        run: |
          sudo apt-get update
          sudo apt-get install -y shellcheck rsync podman podman-compose

      - name: Run release audit
        run: python scripts/release_check.py

      - name: Shellcheck scripts
        run: |
          shellcheck \
            scripts/aoa-lib.sh \
            scripts/aoa-diagnose \
            scripts/aoa-doctor \
            scripts/aoa-install-layout \
            scripts/aoa-sync-federation-surfaces \
            scripts/aoa-sync-configs \
            scripts/aoa-bootstrap-configs \
            scripts/aoa-check-layout \
            scripts/aoa-install-systemd \
            scripts/aoa-first-run \
            scripts/aoa-preset-profiles \
            scripts/aoa-profile-modules \
            scripts/aoa-profile-endpoints \
            scripts/aoa-internal-probes \
            scripts/aoa-render-services \
            scripts/aoa-render-config \
            scripts/aoa-up \
            scripts/aoa-down \
            scripts/aoa-status \
            scripts/aoa-logs \
            scripts/aoa-smoke \
            scripts/aoa-wait

      - name: Rehearse bootstrap flow
        run: |
          export AOA_STACK_ROOT="$RUNNER_TEMP/abyss-stack"
          export AOA_CONFIGS_ROOT="$AOA_STACK_ROOT/Configs"
          export AOA_VAULT_ROOT="$RUNNER_TEMP/abyss-vault"
          mkdir -p "$AOA_VAULT_ROOT"

          scripts/aoa-first-run --strict

          cp env/stack.env.example "$AOA_STACK_ROOT/Secrets/Configs/stack.env"
          ln -sfn "$AOA_STACK_ROOT/Secrets/Configs/stack.env" "$AOA_STACK_ROOT/Configs/stack.env"
          cp env/langchain-api.env.example "$AOA_STACK_ROOT/Secrets/Configs/langchain-api.env"
          cp env/ovms-api.env.example "$AOA_STACK_ROOT/Secrets/Configs/ovms-api.env"
          printf '%s\n' 'TEST_KEY' > "$AOA_STACK_ROOT/Secrets/Configs/ovms_api_key.txt"
          chmod 600 \
            "$AOA_STACK_ROOT/Secrets/Configs/stack.env" \
            "$AOA_STACK_ROOT/Secrets/Configs/langchain-api.env" \
            "$AOA_STACK_ROOT/Secrets/Configs/ovms-api.env" \
            "$AOA_STACK_ROOT/Secrets/Configs/ovms_api_key.txt"

          scripts/aoa-check-layout --strict --profile core
          scripts/aoa-check-layout --strict --profile agentic
          scripts/aoa-check-layout --strict --profile intel
          scripts/aoa-doctor --preset agent-full
          scripts/aoa-doctor --preset intel-full
          scripts/aoa-preset-profiles --preset agent-full --paths
          scripts/aoa-preset-profiles --preset agent-federation --paths
          scripts/aoa-preset-profiles --preset intel-federation --paths
          scripts/aoa-profile-modules --profile core --paths
          scripts/aoa-profile-endpoints --profile core
          scripts/aoa-profile-modules --profile agentic --paths
          scripts/aoa-profile-endpoints --profile agentic
          scripts/aoa-profile-modules --profile intel --paths
          scripts/aoa-profile-endpoints --profile intel
          scripts/aoa-profile-endpoints --profile tools
          scripts/aoa-profile-endpoints --profile observability
          scripts/aoa-profile-modules --profile agentic --profile tools --profile observability --paths
          scripts/aoa-profile-endpoints --profile agentic,tools,observability
          scripts/aoa-profile-modules --preset agent-full --paths
          scripts/aoa-profile-endpoints --preset agent-full
          scripts/aoa-profile-modules --preset agent-federation --paths
          scripts/aoa-profile-endpoints --preset agent-federation
          scripts/aoa-profile-modules --preset intel-full --paths
          scripts/aoa-profile-endpoints --preset intel-full
          scripts/aoa-profile-modules --preset intel-federation --paths
          scripts/aoa-profile-endpoints --preset intel-federation
          scripts/aoa-render-services --profile core
          scripts/aoa-render-services --profile agentic
          scripts/aoa-render-services --profile intel
          scripts/aoa-render-services --profile agentic,tools,observability
          scripts/aoa-render-services --preset agent-full
          scripts/aoa-render-services --preset agent-federation
          scripts/aoa-render-services --preset intel-full
          scripts/aoa-render-services --preset intel-federation
          scripts/aoa-render-config --profile core >/dev/null
          python scripts/aoa-rpg-runtime-projection --stack-root "$AOA_STACK_ROOT" --check
          python scripts/aoa-rpg-runtime-projection --stack-root "$AOA_STACK_ROOT"
          scripts/aoa-render-config --profile agentic --write "$RUNNER_TEMP/abyss-agentic.rendered.yml"
          grep -q "return-policy.yaml" "$RUNNER_TEMP/abyss-agentic.rendered.yml"
          grep -q "/app/logs/returns" "$RUNNER_TEMP/abyss-agentic.rendered.yml"
          test -f "$AOA_STACK_ROOT/Configs/agent-api/governed-execution-policy.yaml"
          python scripts/aoa-governed-run prepare-request --write "$RUNNER_TEMP/governed-request.json"
          test -s "$RUNNER_TEMP/governed-request.json"
          scripts/aoa-render-config --profile intel >/dev/null
          scripts/aoa-render-config --profile agentic,tools,observability >/dev/null
          scripts/aoa-render-config --preset agent-full >/dev/null
          scripts/aoa-render-config --preset agent-federation >/dev/null
          scripts/aoa-render-config --preset intel-full >/dev/null
          scripts/aoa-render-config --preset intel-federation >/dev/null
          scripts/aoa-render-config --profile agentic,tools,observability --write "$RUNNER_TEMP/abyss-combined.rendered.yml"
          test -s "$RUNNER_TEMP/abyss-combined.rendered.yml"

      - name: Rehearse extra compose overlay flow
        run: |
          export AOA_STACK_ROOT="$RUNNER_TEMP/abyss-stack-overlay"
          export AOA_CONFIGS_ROOT="$AOA_STACK_ROOT/Configs"
          export AOA_VAULT_ROOT="$RUNNER_TEMP/abyss-vault-overlay"
          mkdir -p "$AOA_VAULT_ROOT"

          scripts/aoa-first-run --strict
          cp env/stack.env.example "$AOA_STACK_ROOT/Secrets/Configs/stack.env"
          ln -sfn "$AOA_STACK_ROOT/Secrets/Configs/stack.env" "$AOA_STACK_ROOT/Configs/stack.env"
          cp env/langchain-api.env.example "$AOA_STACK_ROOT/Secrets/Configs/langchain-api.env"
          cp env/ovms-api.env.example "$AOA_STACK_ROOT/Secrets/Configs/ovms-api.env"
          printf '%s\n' 'TEST_KEY' > "$AOA_STACK_ROOT/Secrets/Configs/ovms_api_key.txt"
          chmod 600 \
            "$AOA_STACK_ROOT/Secrets/Configs/stack.env" \
            "$AOA_STACK_ROOT/Secrets/Configs/langchain-api.env" \
            "$AOA_STACK_ROOT/Secrets/Configs/ovms-api.env" \
            "$AOA_STACK_ROOT/Secrets/Configs/ovms_api_key.txt"

          export AOA_EXTRA_COMPOSE_FILES="compose/tuning/llamacpp.cpu.yml"
          scripts/aoa-render-config --profile core >/dev/null

          printf 'GGUFTEST' > "$RUNNER_TEMP/qwen3.5-9b.gguf"
          export AOA_LLAMACPP_MODEL_HOST_PATH="$RUNNER_TEMP/qwen3.5-9b.gguf"
          export AOA_EXTRA_COMPOSE_FILES="compose/modules/32-llamacpp-inference.yml,compose/modules/44-llamacpp-agent-sidecar.yml"
          scripts/aoa-render-config --preset intel-full >/dev/null

      - name: Capture host-facts artifacts
        run: |
          mkdir -p "$RUNNER_TEMP/host-facts"

          scripts/aoa-host-facts --mode public --write "$RUNNER_TEMP/host-facts/reference-host.public.json"
          scripts/aoa-host-facts --mode private --write "$RUNNER_TEMP/host-facts/latest.private.json"

          python - \
            "$RUNNER_TEMP/host-facts/reference-host.public.json" \
            "$RUNNER_TEMP/host-facts/latest.private.json" <<'PY'
          import json
          import sys
          from pathlib import Path

          public = json.loads(Path(sys.argv[1]).read_text(encoding="utf-8"))
          private = json.loads(Path(sys.argv[2]).read_text(encoding="utf-8"))

          assert public["artifact_kind"] == "aoa.host-facts"
          assert public["capture_mode"] == "public"
          assert public["captured_by"] == "scripts/aoa-host-facts"
          assert private["artifact_kind"] == "aoa.host-facts"
          assert private["capture_mode"] == "private"
          assert private["captured_by"] == "scripts/aoa-host-facts"
          PY

  validate-windows-host-bridge:
    runs-on: windows-latest

    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
        with:
          python-version: "3.12"

      - name: Install PyYAML
        shell: pwsh
        run: python -m pip install PyYAML

      - name: Validate stack structure
        shell: pwsh
        run: python scripts/validate_stack.py

      - name: Parse PowerShell bridge scripts
        shell: pwsh
        run: |
          $files = @(
            "scripts/aoa.ps1",
            "scripts/aoa-doctor-win.ps1",
            "scripts/aoa-bootstrap-wsl.ps1"
          )

          foreach ($file in $files) {
            $tokens = $null
            $parseErrors = $null
            $resolvedPath = (Resolve-Path $file).Path

            [void][System.Management.Automation.Language.Parser]::ParseFile(
              $resolvedPath,
              [ref]$tokens,
              [ref]$parseErrors
            )

            $errorList = @($parseErrors)
            if ($errorList.Count -gt 0) {
              $errorList | ForEach-Object {
                Write-Error ("{0}: {1}" -f $file, $_.Message)
              }
              exit 1
            }
          }