#!/usr/bin/env bash
set -euo pipefail

# If any GitHub Actions workflow is staged, lint it before it can land. Mirrors
# the actionlint flake check, run eagerly here so a broken workflow is
# caught at commit time rather than only by `nix flake check` / CI. Runs only
# when a workflow file is actually touched, so non-CI commits pay nothing.
if git diff --cached --name-only --diff-filter=ACMR \
  | grep -qE '^\.github/workflows/.*\.ya?ml$'; then
  echo "pre-commit: GitHub Actions workflow changed — running actionlint..."
  nix run nixpkgs#actionlint -- .github/workflows/*.yml
  echo "pre-commit: actionlint passed."
fi

# Once the Nix harness lands (#60), enforce the full gate here too:
# echo "Running nix flake check..."
# nix flake check 2>&1
# echo "Flake check passed."
