# R14: Config and validation in pipeline. Run when config/ or scripts/validation/ or scripts/verify/ change.
name: Validate Config

on:
  pull_request:
    paths:
      - 'config/**'
      - 'scripts/validation/**'
      - 'scripts/jvmtm/**'
      - 'scripts/omnl/build-omnl-e2e-settlement-audit-archive.sh'
      - 'scripts/verify/sync-blockscout-address-labels-from-registry.sh'
      - 'scripts/verify/run-all-validation.sh'
      - 'scripts/run-completable-tasks-from-anywhere.sh'
      - '.github/workflows/validate-config.yml'
      - 'token-lists/**'
      - 'explorer-monorepo/backend/api/rest/config/metamask/**'
      - 'docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md'
      - 'docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md'
      - 'config/jvmtm-regulatory-closure/INAAUDJVMTM_2025_AUDIT_CLOSURE_MATRIX.md'
      - 'docs/04-configuration/SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md'
      - 'docs/dbis-rail/ISO_GATEWAY_AND_RELAYER_SPEC.md'
  push:
    branches: [master, main]
    paths:
      - 'config/**'
      - 'scripts/validation/**'
      - 'scripts/jvmtm/**'
      - 'scripts/omnl/build-omnl-e2e-settlement-audit-archive.sh'
      - 'scripts/verify/sync-blockscout-address-labels-from-registry.sh'
      - 'scripts/verify/run-all-validation.sh'
      - 'scripts/run-completable-tasks-from-anywhere.sh'
      - '.github/workflows/validate-config.yml'
      - 'token-lists/**'
      - 'explorer-monorepo/backend/api/rest/config/metamask/**'
      - 'docs/03-deployment/OMNL_DBIS_CORE_CHAIN138_SMART_VAULT_RTGS_RUNBOOK.md'
      - 'docs/03-deployment/OJK_BI_AUDIT_JVMTM_REMEDIATION_AND_UETR_POLICY.md'
      - 'config/jvmtm-regulatory-closure/INAAUDJVMTM_2025_AUDIT_CLOSURE_MATRIX.md'
      - 'docs/04-configuration/SMART_CONTRACTS_ISO20022_FIN_METHODOLOGY.md'
      - 'docs/dbis-rail/ISO_GATEWAY_AND_RELAYER_SPEC.md'

jobs:
  validate:
    name: Config & validation
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Config validation
        run: bash scripts/validation/validate-config-files.sh

      - name: DBIS institutional JSON Schemas
        run: |
          python3 -m pip install check-jsonschema
          SCHEMA_STRICT=1 bash scripts/validation/validate-dbis-institutional-schemas.sh

      - name: JVMTM regulatory closure JSON Schemas
        run: |
          python3 -m pip install check-jsonschema
          SCHEMA_STRICT=1 bash scripts/validation/validate-jvmtm-regulatory-closure-schemas.sh

      - name: Reserve provenance package (3FR attestation JSON)
        run: |
          python3 -m pip install check-jsonschema
          SCHEMA_STRICT=1 bash scripts/validation/validate-reserve-provenance-package.sh

      - name: Completable tasks (dry-run)
        run: bash scripts/run-completable-tasks-from-anywhere.sh --dry-run

      - name: Shellcheck (optional)
        run: bash scripts/verify/run-shellcheck.sh --optional