validate.yml

name: Evaluate profiles

on:
  pull_request:
    branches:
      - main
    paths:
      - 'profiles/**'
      - 'markdown/profiles/**'

concurrency:
  group: ${{ github.ref }}-${{ github.workflow }}
  cancel-in-progress: true

jobs:
  test:
    name: Evaluate profiles
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Clone
        uses: actions/checkout@v4
      - name: Check profile
        id: check-profile
        uses: RedHatProductSecurity/trestle-bot/actions/autosync@v0.7.0
        with:
          markdown_path: "markdown/profiles"
          oscal_model: "profile"
          check_only: true
          skip_items: "fedramp_rev5_high"
    
  call-autofix:
    needs: [test]
    if: |
      always() && contains(needs.*.result, 'failure')
      && github.event.pull_request.base.repo.url == github.event.pull_request.head.repo.url
    uses: ./.github/workflows/autofix-profile.yml
    with:
      branch: ${{ github.head_ref }}
    secrets: inherit