validate.yml

name: Validate

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  syntax:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Check JavaScript syntax
        shell: bash
        run: |
          set -euo pipefail
          while IFS= read -r -d '' file; do
            node --check "$file"
          done < <(find cloudfunctions miniprogram -type f -name '*.js' -print0)

      - name: Validate JSON
        shell: bash
        run: |
          node <<'NODE'
          const fs = require("fs");
          const path = require("path");

          function walk(directory) {
            for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
              if ([".git", "node_modules", "miniprogram_npm"].includes(entry.name)) continue;
              const target = path.join(directory, entry.name);
              if (entry.isDirectory()) walk(target);
              if (entry.isFile() && entry.name.endsWith(".json")) {
                JSON.parse(fs.readFileSync(target, "utf8"));
              }
            }
          }

          walk(".");
          NODE

      - name: Check tracked sensitive configuration
        shell: bash
        run: |
          set -euo pipefail
          forbidden='^(project\.config\.json|project\.private\.config\.json|miniprogram/config\.js|cloudfunctions/(sendNoticeMessage|saveNoticeSubscriber)/config\.js)$'
          if git ls-files | grep -E "$forbidden"; then
            echo "Tracked sensitive configuration found."
            exit 1
          fi

      - name: Scan Git history for high-confidence secrets
        shell: bash
        run: |
          set -euo pipefail
          patterns='wx[0-9a-fA-F]{16}|cloud://[A-Za-z0-9]|cloud[0-9]+-[a-z0-9-]{8,}|-----BEGIN ([A-Z ]+)?PRIVATE KEY-----'
          found=0

          while IFS= read -r commit; do
            if git grep -I -n -E "$patterns" "$commit" --; then
              found=1
            fi
          done < <(git rev-list --all)

          if [ "$found" -ne 0 ]; then
            echo "Potential secret found in Git history."
            exit 1
          fi