validate-contributor.yml

name: Validate & Process Submission

on:
  pull_request_target:
    types: [opened, synchronize]

permissions:
  contents: write
  pull-requests: write
  issues: write

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}
          fetch-depth: 0

      - name: Detect submission level
        id: level
        run: |
          git fetch origin master
          FILES=$(git diff --name-only origin/master...${{ github.event.pull_request.head.sha }} 2>/dev/null || echo "")

          LEVEL=""
          TITLE="${{ github.event.pull_request.title }}"

          # Detect from file paths first
          if echo "$FILES" | grep -q "^contributors/"; then
            LEVEL="1"
          fi
          if echo "$FILES" | grep -qi "submissions.*level.2\|submissions.*level-2\|submissions.*/level2"; then
            LEVEL="2"
          fi
          if echo "$FILES" | grep -qi "submissions.*level.3\|submissions.*level-3\|submissions.*/level3"; then
            LEVEL="3"
          fi

          # PR title overrides — most reliable signal
          if echo "$TITLE" | grep -qi "level.3\|level-3"; then
            LEVEL="3"
          elif echo "$TITLE" | grep -qi "level.2\|level-2"; then
            LEVEL="2"
          elif echo "$TITLE" | grep -qi "level.1\|level-1"; then
            # Only set to 1 if not already higher
            if [ -z "$LEVEL" ]; then LEVEL="1"; fi
          fi

          # Check if PR includes a contributors/ JSON file
          HAS_CONTRIBUTOR="false"
          if echo "$FILES" | grep -q "^contributors/.*\.json"; then
            HAS_CONTRIBUTOR="true"
          fi

          # Safety: check if PR deletes existing files (block destructive PRs)
          DELETIONS=$(git diff --diff-filter=D --name-only origin/master...${{ github.event.pull_request.head.sha }} 2>/dev/null || echo "")
          HAS_DELETIONS="false"
          if [ -n "$DELETIONS" ]; then
            HAS_DELETIONS="true"
            echo "::warning::PR deletes files: $DELETIONS"
          fi

          echo "level=$LEVEL" >> $GITHUB_OUTPUT
          echo "has_contributor=$HAS_CONTRIBUTOR" >> $GITHUB_OUTPUT
          echo "has_deletions=$HAS_DELETIONS" >> $GITHUB_OUTPUT

      - name: Block PRs that delete existing files
        if: steps.level.outputs.has_deletions == 'true'
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `⛔ **This PR deletes existing files from the repo.** That's not allowed — your PR should only ADD your own files.\n\nPlease:\n1. Re-fork the repo (or sync your fork with upstream)\n2. Only add your contributor JSON to \`contributors/\`\n3. Don't delete or modify other people's files\n\nThis PR will NOT be auto-merged. Fix it and push again.`
            });
            core.setFailed('PR deletes existing files — blocked for safety');

      - name: Validate Level 1 — Contributor JSON
        id: validate_l1
        if: steps.level.outputs.level == '1'
        run: |
          VALID=true
          for f in $(git diff --name-only origin/master...${{ github.event.pull_request.head.sha }} | grep "^contributors/" | grep ".json$" | grep -v TEMPLATE); do
            echo "Validating $f..."

            if ! python3 -c "import json; json.load(open('$f'))"; then
              echo "::error::$f is not valid JSON"
              VALID=false
              continue
            fi

            python3 -c "
          import json, sys
          data = json.load(open('$f'))
          required = ['name', 'github', 'program', 'campus', 'skills', 'interests', 'my_twin']
          missing = [k for k in required if k not in data]
          if missing:
              print(f'::error::$f missing fields: {missing}')
              sys.exit(1)
          if not isinstance(data['skills'], list):
              print('::error::skills must be a list')
              sys.exit(1)
          if not isinstance(data['interests'], list):
              print('::error::interests must be a list')
              sys.exit(1)
          if len(data['my_twin'].strip()) < 20:
              print('::error::my_twin must be at least 20 characters — tell us something real')
              sys.exit(1)
          if data['name'] == 'Your Full Name' or data['github'] == 'your-github-username':
              print('::error::Please fill in your actual details, not the template placeholders')
              sys.exit(1)
          print(f'VALID: {data[\"name\"]} ({data[\"github\"]})')
          " || VALID=false
          done
          echo "valid=$VALID" >> $GITHUB_OUTPUT

      - name: Label PR
        if: always()
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }} 
          script: |
            const level = '${{ steps.level.outputs.level }}';
            const labels = [];

            if (level === '1') labels.push('level-1');
            if (level === '2') labels.push('level-2');
            if (level === '3') labels.push('level-3');

            if (labels.length > 0) {
              await github.rest.issues.addLabels({
                owner: context.repo.owner,
                repo: context.repo.repo,
                issue_number: context.issue.number,
                labels: labels,
              });
            }

      - name: Validate contributor JSON (for bundled PRs)
        id: validate_contributor
        if: steps.level.outputs.level != '1' && steps.level.outputs.has_contributor == 'true'
        run: |
          VALID=true
          for f in $(git diff --name-only origin/master...${{ github.event.pull_request.head.sha }} | grep "^contributors/" | grep ".json$" | grep -v TEMPLATE); do
            echo "Validating $f..."
            if ! python3 -c "import json; json.load(open('$f'))"; then
              VALID=false
              continue
            fi
            python3 -c "
          import json, sys
          data = json.load(open('$f'))
          required = ['name', 'github', 'program', 'campus', 'skills', 'interests', 'my_twin']
          missing = [k for k in required if k not in data]
          if missing:
              print(f'::error::$f missing fields: {missing}')
              sys.exit(1)
          if not isinstance(data['skills'], list) or not isinstance(data['interests'], list):
              sys.exit(1)
          if len(data['my_twin'].strip()) < 20:
              sys.exit(1)
          if data['name'] == 'Your Full Name' or data['github'] == 'your-github-username':
              sys.exit(1)
          print(f'VALID: {data[\"name\"]}')
          " || VALID=false
          done
          echo "valid=$VALID" >> $GITHUB_OUTPUT

      - name: Auto-merge bundled PRs with valid contributor JSON
        if: steps.level.outputs.level != '1' && steps.level.outputs.has_contributor == 'true' && steps.validate_contributor.outputs.valid == 'true'
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            const level = '${{ steps.level.outputs.level }}';
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `✅ **Registration + Level ${level} received!** You're now on the board.\n\n⚠️ **Tip for next time:** Submit each level as a separate PR — it makes tracking easier and ensures you get credit immediately.\n\nThe leaderboard is live: https://life-atlas.github.io/lpi-developer-kit/\n\nLevel 3 is what guarantees your place on the team.`
            });
            await github.rest.pulls.merge({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.issue.number,
              merge_method: 'squash',
              commit_title: `contributor: ${context.payload.pull_request.title}`,
            });

      - name: Auto-merge valid Level 1 PRs
        if: steps.level.outputs.level == '1' && steps.validate_l1.outputs.valid == 'true'
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            // Welcome comment
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: '✅ **Registration received!** You are now on the board.\n\nThis is Level 1 — you\'ve signed up. To secure your place on the team:\n\n**Level 2** → Run the LPI sandbox and prove your dev environment works (`npm install && npm run build && npm run test-client`)\n\n**Level 3** → Build something real. **Completing Level 3 guarantees you a place on the WINNIIO / LifeAtlas contributor team.**\n\nCheck the README for your track-specific challenge. The leaderboard is live: https://life-atlas.github.io/lpi-developer-kit/\n\nGood luck — Level 3 is where it counts.'
            });

            // Merge the PR directly (no approval needed — validation passed)
            await github.rest.pulls.merge({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.issue.number,
              merge_method: 'squash',
              commit_title: `contributor: ${context.payload.pull_request.title}`,
            });

      - name: Comment on invalid Level 1 PRs
        if: steps.level.outputs.level == '1' && steps.validate_l1.outputs.valid == 'false'
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `Your submission has a validation error. Please check:\n\n- Is your JSON file valid? (no trailing commas, proper quotes)\n- Did you fill in ALL required fields? (name, github, program, campus, skills, interests, my_twin)\n- Is your \`my_twin\` answer at least 20 characters?\n- Did you replace the template placeholders with your actual details?\n\nFix the issues and push again — the check will re-run automatically.`
            });

      - name: Comment on Level 2 submissions
        if: steps.level.outputs.level == '2'
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `📡 **Level 2 received.** Your dev environment is running — nice.\n\nAn agent will score your submission shortly.\n\nBut Level 2 is not the finish line. **Level 3 is what guarantees your place on the team.** Build something real — an agent, a case study, a design, a security audit. Check the README for your track.\n\nThe leaderboard is watching: https://life-atlas.github.io/lpi-developer-kit/`
            });

      - name: Comment on Level 3 submissions
        if: steps.level.outputs.level == '3'
        uses: actions/github-script@v7
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          script: |
            await github.rest.issues.createComment({
              owner: context.repo.owner,
              repo: context.repo.repo,
              issue_number: context.issue.number,
              body: `🏆 **Level 3 submission received.** This is the one that counts.\n\nAn agent will clone your repo, attempt to run it, and evaluate your work. You'll receive a detailed score and feedback as a comment on this PR.\n\n**Completing Level 3 guarantees your place on the WINNIIO / LifeAtlas contributor team.** Welcome to the real work.`
            });