name: Verify compiled workflows

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    paths:
      - ".github/workflows/*.md"
      - ".github/workflows/*.lock.yml"

permissions:
  contents: read

jobs:
  verify:
    if: github.event.repository.fork == false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
      - name: Install gh-aw CLI
        uses: github/gh-aw-actions/setup-cli@9271a1804551c0dc4fb0085a97979950aa2f8489 # v0.88.2
        with:
          version: v0.88.2
      - name: Recompile workflows
        # Full-repository compile so the diff check below covers all workflows.
        run: gh aw compile
      - name: Check for uncommitted changes
        run: |
          if [ -n "$(git diff)" ]; then
            echo "::error::Lock files are out of date. Run 'gh aw compile' and commit the results."
            echo ""
            git diff --stat
            echo ""
            git diff -- '*.lock.yml'
            exit 1
          fi
          echo "All lock files are up to date."