name: Lint PowerShell

on:
  pull_request:
  push:
    branches:
      - main
      - master

jobs:
  powershell-lint:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    defaults:
      run:
        working-directory: ods
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

      - name: Install PSScriptAnalyzer
        shell: pwsh
        run: |
          $ErrorActionPreference = 'Stop'
          [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

          if (-not (Get-PackageProvider -Name NuGet -ListAvailable -ErrorAction SilentlyContinue)) {
            Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Scope CurrentUser -Force -ForceBootstrap
          }

          if (-not (Get-PSRepository -Name PSGallery -ErrorAction SilentlyContinue)) {
            Register-PSRepository -Default
          }
          Set-PSRepository -Name PSGallery -InstallationPolicy Trusted

          Install-Module -Name PSScriptAnalyzer -Repository PSGallery -Scope CurrentUser -Force -AllowClobber
          Import-Module PSScriptAnalyzer -ErrorAction Stop
          Get-Module PSScriptAnalyzer | Format-Table Name, Version, Path -AutoSize

      - name: Run PowerShell Script Analyzer
        shell: pwsh
        run: |
          $scripts = @()
          $scripts += Get-ChildItem -Path installers -Filter *.ps1 -Recurse

          # Also lint repo-root Windows entrypoint (outside ods/).
          $rootInstaller = Join-Path ".." "install.ps1"
          if (Test-Path $rootInstaller) {
            $scripts += Get-Item $rootInstaller
          }

          $scripts = $scripts | Sort-Object -Property FullName -Unique
          if (-not $scripts) {
            Write-Host "No PowerShell scripts found."
            exit 0
          }
          $failed = $false
          foreach ($script in $scripts) {
            Write-Host "Analyzing $($script.FullName)"
            $results = Invoke-ScriptAnalyzer -Path $script.FullName -Settings ./PSScriptAnalyzerSettings.psd1 -Severity Error,Warning
            if ($results) {
              $results | Format-Table RuleName, Severity, Message, ScriptName, Line -AutoSize
              $failed = $true
            }
          }
          if ($failed) { exit 1 }