# Woodpecker CI — catalog/ (own repo: prvng_extensions.git)
#
# Self-contained: scripts/witness.nu and .governance/laws.ncl (+laws-schema.ncl,
# laws.ncl.minisig, witness.pub) are NATIVE to catalog/ — its own governance,
# never vendored from code/ or anywhere else (plural independent consumers of
# catalog/ exist beyond this checkout; no consumer needs its own copy of
# catalog's own rules). Hidden under .governance/ per code/.claude/
# layout_conventions.md's own precedent (tracked, team/agent-facing, not
# product docs — same profile as .claude/), not a bespoke visible root
# directory. schemas/ IS vendored from code/ (a real cross-repo Nickel-import
# dependency) via code/scripts/sync-catalog-schemas.nu — a stopgap
# pending the OCI/zot content-addressed distribution this project's own ADR-046
# already specifies. See
# provisioning/.coder/2026-07-03_laws-catalogo-provisioning.plan.md §8 T4, §11-13.
# This job only VERIFIES (public key + check commands); it never signs anything,
# so no private key or passphrase is ever needed in CI.
#
# Tool install mirrors the established pattern in code/.woodpecker/Dockerfile
# (rust:latest base + cargo install --locked), not a fresh curl-to-binary approach.
# skopeo added for L3 (versions-from-lock) — untested against a live Woodpecker
# runner, same honest caveat as the rest of this file (§8 T4).

when:
  event: [push, pull_request, manual]

steps:
  standing-laws:
    image: rust:latest
    commands:
      - apt-get update -qq && apt-get install -y -qq ripgrep minisign skopeo
      - cargo install nu nickel-lang-cli --locked
      - export NICKEL_IMPORT_PATH="$(pwd)"
      - nu scripts/witness.nu .governance/laws.ncl .governance/receipts/ci.jsonl --pubkey .governance/witness.pub --wo ci