sanity-checks.yml

name: Sanity Checks

on:
  pull_request:

permissions:
  contents: read

jobs:
  verify:
    name: Check whether devcontainer files are updated
    runs-on: ubuntu-latest
    steps:
      - name: Check out the source code
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0

      - name: Check changed files (images)
        run: |
          base="${{ github.event.pull_request.base.sha }}"
          head="${{ github.event.pull_request.head.sha }}"
          for image in images/src/*; do
            changes="$(git diff --merge-base --name-only "${base}" "${head}" -- "${image}" | grep -Fv "${image}/README.md" || true)"
            if [ -n "${changes}" ]; then
              if ! echo "${changes}" | grep -q "${image}/.devcontainer.json"; then
                echo "::error::Changes were made to ${image}, but the corresponding .devcontainer.json was not updated"
                echo FAIL=1 >> "${GITHUB_ENV}"
              else
                base_version="$(git show "${base}:${image}/.devcontainer.json" | jq -r '.["x-build"]["image-version"]')"
                head_version="$(git show "${head}:${image}/.devcontainer.json" | jq -r '.["x-build"]["image-version"]')"

                if [ "$base_version" = "$head_version" ]; then
                  echo "::error::The image-version in ${image}/.devcontainer.json was not updated"
                  echo FAIL=1 >> "${GITHUB_ENV}"
                fi
              fi
            fi
          done

      - name: Check changed files (features)
        run: |
          base="${{ github.event.pull_request.base.sha }}"
          head="${{ github.event.pull_request.head.sha }}"
          for feature in features/src/*; do
            changes="$(git diff --merge-base --name-only "${base}" "${head}" -- "${feature}" | grep -Ev "${feature}/(README|NOTES).md" || true)"
            if [ -n "${changes}" ]; then
              if ! echo "${changes}" | grep -q "${feature}/devcontainer-feature.json"; then
                echo "::error::Changes were made to ${feature}, but the corresponding devcontainer-feature.json was not updated"
                echo FAIL=1 >> "${GITHUB_ENV}"
              else
                base_version="$(git show "${base}:${feature}/devcontainer-feature.json" | jq -r '.version')"
                head_version="$(git show "${head}:${feature}/devcontainer-feature.json" | jq -r '.version')"

                if [ "$base_version" = "$head_version" ]; then
                  echo "::error::The version in ${image}/devcontainer-feature.json was not updated"
                  echo FAIL=1 >> "${GITHUB_ENV}"
                fi
              fi
            fi
          done

      - name: Check changed files (templates)
        run: |
          base="${{ github.event.pull_request.base.sha }}"
          head="${{ github.event.pull_request.head.sha }}"
          for template in templates/src/*; do
            changes="$(git diff --merge-base --name-only "${base}" "${head}" -- "${template}" | grep -Fv "${template}/README.md" || true)"
            if [ -n "${changes}" ]; then
              if ! echo "${changes}" | grep -q "${template}/devcontainer-template.json"; then
                echo "::error::Changes were made to ${template}, but the corresponding devcontainer-template.json was not updated"
                echo FAIL=1 >> "${GITHUB_ENV}"
              else
                base_version="$(git show "${base}:${template}/devcontainer-template.json" | jq -r '.version')"
                head_version="$(git show "${head}:${template}/devcontainer-template.json" | jq -r '.version')"

                if [ "$base_version" = "$head_version" ]; then
                  echo "::error::The version in ${image}/devcontainer-template.json was not updated"
                  echo FAIL=1 >> "${GITHUB_ENV}"
                fi
              fi
            fi
          done

      - name: Set check status
        run: |
          if [ "${{ env.FAIL }}" = "1" ]; then
            exit 1
          fi