verify.yml

name: Verify

on:
  push:
    branches-ignore: [main, ci-status]
    paths-ignore:
      - 'web/recording-time/**'
  workflow_dispatch:

permissions:
  contents: read
  statuses: write

concurrency:
  group: verify-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    runs-on: macos-latest
    timeout-minutes: 30

    steps:
      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5

      - name: Check repository privacy
        run: bash scripts/privacy-audit.sh

      - name: Build
        run: swift build

      - name: Run verification
        run: swift run DashcamOffloader --verify

      - name: Build app bundle
        run: bash scripts/build-macos-app.sh

      - name: Verify built app
        run: |
          "build/Dashcam Offloader.app/Contents/MacOS/DashcamOffloader" --verify

      - name: Check feedback worker syntax
        run: node --check workers/feedback/worker.js

      - name: Test feedback worker sanitizer
        run: node --test workers/feedback/worker.test.mjs

      - name: Test scan storage evidence extraction
        run: python3 -m unittest discover -s scripts -p 'test_ingest_submitted_scans.py' && python3 -m unittest discover -s scripts -p 'test_scan_storage_rates.py'

      - name: Check review script syntax
        run: python3 -m py_compile scripts/review-feedback-submissions.py

      - name: Report verify status
        if: always()
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          STATE=failure
          if [ "${{ job.status }}" = "success" ]; then STATE=success; fi
          gh api "repos/${{ github.repository }}/statuses/${{ github.sha }}" \
            -f state="$STATE" \
            -f context="verify" \
            -f description="Verify ${{ job.status }}"