validate.yml

name: Evaluate component definitions
on:
  pull_request:
    types: [ opened, ready_for_review, reopened, synchronize ]
    branches:
      - main
    paths:
      - 'component-definitions/**'
      - 'markdown/components/**'

jobs:
  test:
    name: Evaluate components
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Clone
        uses: actions/checkout@v3
      - name: Check components
        id: check-components
        uses: RedHatProductSecurity/trestle-bot@v0.1.1
        with:
          markdown_path: "markdown/components"
          oscal_model: "compdef"
          check_only: true
  
  # Only autofix if the test job fails and the PR is from the same repo
  call-autofix:
    needs: [test]
    if: |
      always() && contains(needs.*.result, 'failure')
      && github.event.pull_request.base.repo.url == github.event.pull_request.head.repo.url
    uses: ./.github/workflows/autofix-cd.yml
    with:
      branch: ${{ github.head_ref }}
    secrets: inherit