chore: validate schema generation in CI

.cspell/custom-words.txt

@@ -90,4 +90,5 @@ vulnz
 worktree
 yaml
 yml
+EDITMSG
 keyid

.github/workflows/docs.yml

@@ -27,7 +27,8 @@ on:
       - main
     paths:
       - ".github/workflows/docs.yml"
-      - "requirements-docs.txt"
+      - "pyproject.toml"
+      - "uv.lock"
       - "mkdocs.yml"
       - "main.py"
       - "hooks.py"
@@ -52,18 +53,20 @@ jobs:
       - name: Configure Git Credentials
         run: |
           git config --global user.name github-actions[bot]
-          git config --global user.email 41898282+github-actions[bot]@users.noreply.github.com
+          git config --global user.email \
+            41898282+github-actions[bot]@users.noreply.github.com
 
       - name: Install system dependencies
         run: |
           sudo apt-get update
-          sudo apt-get install -y libcairo2-dev libfreetype6-dev libffi-dev libjpeg-dev libpng-dev libz-dev
+          sudo apt-get install -y libcairo2-dev libfreetype6-dev libffi-dev \
+            libjpeg-dev libpng-dev libz-dev
 
       - name: Install the latest version of uv
         uses: astral-sh/setup-uv@v7
 
       - name: Install documentation dependencies
-        run: uv sync
+        run: uv sync --all-groups
 
       - name: Lint YAML files
         run: uv run yamllint -c .github/linters/.yamllint.yml .
@@ -74,6 +77,14 @@ jobs:
         with:
           files: source/**
 
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Cargo
+        uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+
       - name: Install ucp-schema for runtime resolution
         run: |
           cargo install ucp-schema
@@ -95,11 +106,14 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           # Fetch the Pages URL. Fails safely if not enabled.
-          PAGES_URL=$(gh api "repos/${{ github.repository }}/pages" --jq '.html_url' 2>/dev/null || true)
+          PAGES_URL=$(gh api "repos/${{ github.repository }}/pages" \
+            --jq '.html_url' 2>/dev/null || true)
 
           if [ -z "$PAGES_URL" ]; then
             echo "Pages URL not detected. Falling back to default structure."
-            PAGES_URL="https://${{ github.repository_owner }}.github.io/${{ github.event.repository.name }}"
+            OWNER="${{ github.repository_owner }}"
+            REPO="${{ github.event.repository.name }}"
+            PAGES_URL="https://${OWNER}.github.io/${REPO}"
           fi
 
           # Ensure trailing slash
@@ -146,8 +160,9 @@ jobs:
           # Extract the date (e.g., release/2026-01-11 -> 2026-01-11)
           VERSION_NAME=${GITHUB_REF#refs/heads/release/}
 
-          # Deploy this version, tag it as 'latest', and set it as the default site root
-          uv run mike deploy --push --update-aliases $VERSION_NAME latest
+          # Deploy this version, tag as 'latest', set as default site root
+          uv run mike deploy --push --update-aliases \
+            $VERSION_NAME latest
 
       - name: Create GitHub Release and Tag
         if: startsWith(github.ref, 'refs/heads/release/')

.github/workflows/linter.yaml

@@ -19,6 +19,19 @@ on:
     branches:
       - main
       - 'release/**'
+    paths:
+      - ".github/workflows/linter.yaml"
+      - ".github/workflows/schema-validation.yml"
+      - ".github/linters/**"
+      - ".pre-commit-config.yaml"
+      - "pyproject.toml"
+      - "package.json"
+      - "package-lock.json"
+      - "biome.json"
+      - "scripts/**"
+      - "source/**"
+      - "docs/**"
+      - "*.py"
 
 permissions:
   contents: read      # Required to checkout the code
@@ -49,7 +62,8 @@ jobs:
           LOG_LEVEL: INFO
           SHELLCHECK_OPTS: -e SC1091 -e 2086
           VALIDATE_ALL_CODEBASE: false
-          FILTER_REGEX_EXCLUDE: "^(\\.github/|\\.vscode/).*|CODE_OF_CONDUCT.md|CHANGELOG.md"
+          FILTER_REGEX_EXCLUDE: >-
+            ^(\\.github/|\\.vscode/).*|CODE_OF_CONDUCT.md|CHANGELOG.md
           VALIDATE_BIOME_FORMAT: false
           VALIDATE_PYTHON_BLACK: false
           VALIDATE_PYTHON_FLAKE8: false
@@ -58,6 +72,7 @@ jobs:
           VALIDATE_PYTHON_PYLINT: false
           VALIDATE_CHECKOV: false
           VALIDATE_GITLEAKS: false
+          VALIDATE_TRIVY: false
           VALIDATE_NATURAL_LANGUAGE: false
           VALIDATE_MARKDOWN_PRETTIER: false
           VALIDATE_JAVASCRIPT_PRETTIER: false

.github/workflows/schema-validation.yml

@@ -0,0 +1,75 @@
+---
+#   Copyright 2026 Google LLC
+#
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+#
+#       http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+name: Schema Validation
+
+on:
+  pull_request:
+    branches:
+      - main
+      - 'release/**'
+    paths:
+      - ".github/workflows/schema-validation.yml"
+      - "generate_ts_schema_types.js"
+      - "generated/schema-types.ts"
+      - "package.json"
+      - "package-lock.json"
+      - "source/**"
+  push:
+    branches:
+      - main
+      - 'release/**'
+    paths:
+      - ".github/workflows/schema-validation.yml"
+      - "generate_ts_schema_types.js"
+      - "generated/schema-types.ts"
+      - "package.json"
+      - "package-lock.json"
+      - "source/**"
+
+permissions:
+  contents: read
+
+jobs:
+  validate-schemas:
+    name: Generate and Validate Schemas
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+
+      - name: Install Node dependencies
+        run: npm ci
+
+      - name: Install ucp-schema
+        run: |
+          cargo install ucp-schema
+          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
+
+      - name: Lint source schemas
+        run: ucp-schema lint source/
+
+      - name: Generate TypeScript schema types
+        run: node generate_ts_schema_types.js
+
+      - name: Verify generated files are in sync
+        run: git diff --exit-code -- generated/schema-types.ts

.pre-commit-config.yaml

@@ -1,6 +1,15 @@
 exclude: '^(\.github/|\.vscode/).*|CODE_OF_CONDUCT\.md|CHANGELOG\.md'
 
 repos:
+  - repo: local
+    hooks:
+      - id: validate-generated-schema-types
+        name: validate generated schema types
+        entry: >-
+          bash -c 'node generate_ts_schema_types.js && git diff --exit-code
+          -- generated/schema-types.ts'
+        language: system
+        pass_filenames: false
   - repo: https://github.com/streetsidesoftware/cspell-cli
     rev: v9.3.3
     hooks:
@@ -55,5 +64,6 @@ repos:
     hooks:
       - id: prettier
         name: prettier-css
-        types: [css]  # Only run on CSS files
-        # If you want it to run on EVERYTHING (JS, JSON, MD), remove the 'types' line.
+        # Only run on CSS files
+        types: [css]
+        # To run on everything (JS, JSON, MD), remove the 'types' line.

generate_ts_schema_types.js

@@ -2,7 +2,7 @@ const fs = require('node:fs');
 const path = require('node:path');
 const { compile } = require('json-schema-to-typescript');
 
-const SOURCE_ROOT = path.resolve(__dirname, 'spec');
+const SOURCE_ROOT = path.resolve(__dirname, 'source');
 const OUTPUT_FILE = path.resolve(__dirname, './generated/schema-types.ts');
 const WRAPPER_NAME = 'SCHEMA_WRAPPER';