name: Validate Caddyfile

on:
  pull_request:

jobs:
  caddy-validate:
    name: caddy validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6

      - name: Check for Caddyfile
        id: check
        run: |
          if [ -f ansible/services/caddy/Caddyfile ]; then
            echo "has_file=true" >> "$GITHUB_OUTPUT"
          else
            echo "has_file=false" >> "$GITHUB_OUTPUT"
            echo "No Caddyfile found — skipping."
          fi

      - name: Validate Caddyfile
        if: steps.check.outputs.has_file == 'true'
        run: |
          # Official download API serves the latest binary directly — no
          # unauthenticated api.github.com call (which is rate-limited to
          # 60/hr per IP across shared runners and would 403). -f makes curl
          # fail loudly on an HTTP error instead of saving an error page.
          curl -fsSL "https://caddyserver.com/api/download?os=linux&arch=amd64" -o caddy
          chmod +x caddy
          ./caddy add-package github.com/caddy-dns/hetzner@v2.0.0
          ./caddy validate --config ansible/services/caddy/Caddyfile --adapter caddyfile