wfctl-validate.yml

# .github/workflows/wfctl-validate.yml
name: wfctl strict contracts

on:
  pull_request:
  push:
    branches: [main, master]

jobs:
  wfctl-strict-contracts:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

      - name: Check plugin.json and plugin.contracts.json exist
        run: |
          if [ ! -f plugin.json ]; then
            echo "::error::plugin.json is missing — add a plugin manifest to enable strict contract validation"
            exit 1
          fi
          if [ ! -f plugin.contracts.json ]; then
            echo "::error::plugin.contracts.json is missing — add a contracts file to pass strict contract validation"
            exit 1
          fi

      - name: Install wfctl v0.74.6
        env:
          GH_TOKEN: ${{ secrets.RELEASES_TOKEN || github.token }}
          WFCTL_VERSION: v0.74.6
        run: |
          set -euo pipefail
          runner_arch=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
          asset="wfctl-linux-${runner_arch}"
          download_dir="$(mktemp -d)"
          gh release download "${WFCTL_VERSION}" \
            --repo GoCodeAlone/workflow \
            --pattern "${asset}" \
            --pattern checksums.txt \
            --dir "${download_dir}"
          (cd "${download_dir}" && grep "  ${asset}$" checksums.txt | sha256sum -c -)
          mkdir -p "${RUNNER_TEMP}/wfctl-bin"
          install -m 0755 "${download_dir}/${asset}" "${RUNNER_TEMP}/wfctl-bin/wfctl"
          echo "${RUNNER_TEMP}/wfctl-bin" >> "$GITHUB_PATH"

      - name: Validate strict plugin contracts
        run: wfctl plugin validate --file plugin.json --strict-contracts