when:
  - event: [pull_request, push]

steps:
  # Render every kickstart + iPXE script for every catalog distro against a
  # fixture host, failing on any parse/resolve error or unresolved value. Reuses
  # the real bootapi engine via its `validate` subcommand (fetched @main).
  - name: validate
    image: golang:1.25
    environment:
      GOFLAGS: -buildvcs=false
      GOPRIVATE: git.unkin.net
      GONOSUMCHECK: "1"
      GOSUMDB: "off"
      GOPROXY: direct
    commands:
      - go run git.unkin.net/unkin/bootapi/cmd/bootapi@main validate .
    backend_options:
      kubernetes:
        serviceAccountName: default
        resources:
          requests:
            memory: 512Mi
            cpu: 1
          limits:
            memory: 2Gi
            cpu: 2

  # Best-effort shellcheck of the %post blocks (template actions stripped first).
  - name: shellcheck
    image: koalaman/shellcheck-alpine:stable
    commands:
      - apk add --no-cache bash
      - bash ci/shellcheck-post.sh
    backend_options:
      kubernetes:
        serviceAccountName: default
        resources:
          requests:
            memory: 128Mi
            cpu: 100m
          limits:
            memory: 512Mi
            cpu: 500m