name: evidence-validation

on:
  pull_request_target:
    paths:
      - "evidence/outcomes/**"
      - "evidence/attestations/**"
      - "scripts/validate-evidence-registry.mjs"
      - ".github/workflows/evidence-validation.yml"
  push:
    branches: [main]
    paths:
      - "evidence/outcomes/**"
      - "evidence/attestations/**"
      - "scripts/validate-evidence-registry.mjs"
      - ".github/workflows/evidence-validation.yml"

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Checkout trusted base validator
        if: github.event_name == 'pull_request_target'
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ github.event.pull_request.base.sha }}
          path: trusted
          persist-credentials: false
      - name: Checkout untrusted candidate as data only
        if: github.event_name == 'pull_request_target'
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: ${{ github.event.pull_request.head.repo.full_name }}
          ref: ${{ github.event.pull_request.head.sha }}
          path: candidate
          persist-credentials: false
      - name: Checkout protected main
        if: github.event_name == 'push'
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          path: candidate
          persist-credentials: false
      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: "20"
      - name: Validate pull request with trusted base code
        if: github.event_name == 'pull_request_target'
        env:
          HUMBLE_EVIDENCE_REGISTRY_ATTESTATION_KEY: ${{ secrets.HUMBLE_EVIDENCE_REGISTRY_ATTESTATION_KEY }}
          HUMBLE_EVIDENCE_REGISTRY_ATTESTATION_KEY_ID: ${{ vars.HUMBLE_EVIDENCE_REGISTRY_ATTESTATION_KEY_ID }}
        run: node "$GITHUB_WORKSPACE/trusted/scripts/validate-evidence-registry.mjs" --root "$GITHUB_WORKSPACE/candidate"
      - name: Validate protected main
        if: github.event_name == 'push'
        env:
          HUMBLE_EVIDENCE_REGISTRY_ATTESTATION_KEY: ${{ secrets.HUMBLE_EVIDENCE_REGISTRY_ATTESTATION_KEY }}
          HUMBLE_EVIDENCE_REGISTRY_ATTESTATION_KEY_ID: ${{ vars.HUMBLE_EVIDENCE_REGISTRY_ATTESTATION_KEY_ID }}
        run: node "$GITHUB_WORKSPACE/candidate/scripts/validate-evidence-registry.mjs" --root "$GITHUB_WORKSPACE/candidate"