name: PR Validation

on:
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# Read-only by default: without this the workflow inherits the repository
# default, which is write on nearly everything. Nothing here writes.
permissions:
  contents: read

jobs:
  detect-changes:
    runs-on: ubuntu-latest
    outputs:
      core: ${{ steps.filter.outputs.core }}
      docs: ${{ steps.filter.outputs.docs }}

    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
        id: filter
        with:
          filters: |
            core:
              - 'src/**'
            docs:
              - 'docs/**'

  summary:
    runs-on: ubuntu-latest
    needs: [detect-changes]
    steps:
      - name: Summary
        run: |
          echo "## Changed Packages" >> $GITHUB_STEP_SUMMARY
          echo "" >> $GITHUB_STEP_SUMMARY
          echo "| Package | Changed |" >> $GITHUB_STEP_SUMMARY
          echo "|---------|---------|" >> $GITHUB_STEP_SUMMARY
          echo "| Core | ${{ needs.detect-changes.outputs.core }} |" >> $GITHUB_STEP_SUMMARY
          echo "| Docs | ${{ needs.detect-changes.outputs.docs }} |" >> $GITHUB_STEP_SUMMARY

  # This job ensures at least one check runs for branch protection
  required-check:
    runs-on: ubuntu-latest
    needs: [detect-changes]
    steps:
      - run: echo "PR validation complete"