name: PSScriptAnalyzer

on:
  workflow_call:
    inputs:
      soft-fail:
        description: 'Whether to continue on PSScriptAnalyzer violations'
        required: false
        type: boolean
        default: false
      changed-files-only:
        description: 'Only analyze changed PowerShell files'
        required: false
        type: boolean
        default: true

permissions:
  contents: read

jobs:
  psscriptanalyzer:
    name: PowerShell Lint
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Checkout code
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Run PSScriptAnalyzer
        id: analyze
        shell: pwsh
        run: |
          New-Item -ItemType Directory -Force -Path logs | Out-Null
          $params = @{}
          if ('${{ inputs.changed-files-only }}' -eq 'true') {
            $params['ChangedFilesOnly'] = $true
          }
          
          & scripts/linting/Invoke-PSScriptAnalyzer.ps1 @params
          if ($LASTEXITCODE -ne 0) {
            "PSSCRIPTANALYZER_FAILED=true" | Out-File -FilePath $env:GITHUB_ENV -Append
          }
        continue-on-error: ${{ inputs.soft-fail }}

      - name: Upload results
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: psscriptanalyzer-results
          path: |
            logs/psscriptanalyzer-results.json
            logs/psscriptanalyzer-summary.json
          retention-days: 30
          if-no-files-found: ignore

      - name: Check results
        if: "!inputs.soft-fail"
        shell: pwsh
        run: |
          if ($env:PSSCRIPTANALYZER_FAILED -eq 'true') {
            Write-Error "PSScriptAnalyzer found violations"
            exit 1
          }