name: Lint Doc
on:
  pull_request:

permissions:
  contents: read
  pull-requests: read

jobs:
  doc-lint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6

      - name: Bullfrog Secure Runner
        continue-on-error: true
        uses: bullfrogsec/bullfrog@1831f79cce8ad602eef14d2163873f27081ebfb3  # v0.8.4
        with:
          egress-policy: audit

      - name: Get File Changes
        id: file_changes
        uses: trilom/file-changes-action@a6ca26c14274c33b15e6499323aac178af06ad4b  # v1.2.4

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
        with:
          python-version: '3.x'

      - name: run doc linter
        env:
          # Pass modified + added + renamed file lists. `files_modified`
          # alone misses newly-added pages — a PR adding a new doc with
          # long lines or real public IPs would otherwise slip through.
          FILES_MODIFIED: ${{ steps.file_changes.outputs.files_modified }}
          FILES_ADDED: ${{ steps.file_changes.outputs.files_added }}
          FILES_RENAMED: ${{ steps.file_changes.outputs.files_renamed }}
        run: |
          python scripts/doc-linter.py \
            "$FILES_MODIFIED" \
            "$FILES_ADDED" \
            "$FILES_RENAMED"