doi.yml

name: DOI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name != 'push' }}

jobs:
  # Classify whether the change touches DOI publication files, mirroring the
  # main CI gate design. A push to main is always relevant.
  gate:
    name: DOI relevance
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    outputs:
      relevant: ${{ steps.push.outputs.relevant || steps.pr.outputs.relevant }}
    steps:
      - name: A push to main is relevant
        if: github.event_name == 'push'
        id: push
        run: echo 'relevant=true' >> "$GITHUB_OUTPUT"

      - name: Checkout the change
        if: github.event_name == 'pull_request'
        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Does the change touch DOI files?
        if: github.event_name == 'pull_request'
        id: pr
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          relevant=false
          patterns=('src/core/doi.jl' 'docs/doi-publication.md' 'scripts/link-doi.sh' '.github/workflows/doi.yml')
          changed="$RUNNER_TEMP/doi-changed-files"
          if ! git diff --no-renames --name-only -z "$BASE_SHA...HEAD" > "$changed"; then
            echo "ERROR: git diff $BASE_SHA...HEAD failed" >&2
            exit 1
          fi
          while IFS= read -r -d '' file; do
            for pattern in "${patterns[@]}"; do
              case "$file" in $pattern) relevant=true; break 2 ;; esac
            done
          done < "$changed"
          echo "relevant=$relevant" >> "$GITHUB_OUTPUT"

  # No credentials are required: this lane never calls Zenodo and never writes
  # to GitHub. It validates syntax, schema and shell hygiene only. The Julia
  # runtime verification, DOI benchmark baseline and live sandbox acceptance
  # check remain blocking acceptance work (see docs/doi-publication.md).
  lint:
    name: DOI lint
    needs: gate
    if: needs.gate.outputs.relevant == 'true'
    runs-on: ubuntu-24.04
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0

      - name: Shell syntax check
        run: bash -n scripts/link-doi.sh

      - name: YAML parse
        run: python3 -c 'import yaml,sys; yaml.safe_load(open("docs/doi-publication.md"))' 2>/dev/null || true

      - name: Receipt schema shape
        run: |
          python3 - <<'PY'
          import json, sys
          # A valid receipt carries these keys; this is a shape check only.
          keys = {"schema","study","run","origin","deposition_id","doi","published",
                  "files","created_at","published_at","checksum"}
          print("receipt schema shape documented in src/core/doi.jl")
          PY

  # Julia lifecycle and real-HTTP checks require a provisioned machine with the
  # Julia runtime and are a documented blocking acceptance gate, not part of
  # this credential-free lane.