name: Validate catalog pull request

# The validator reads candidate files through the API and never executes PR code.
on:
  pull_request_target:
    branches: [main]

permissions:
  contents: read
  pull-requests: write

jobs:
  catalog-validate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout trusted catalog automation
        uses: https://github.com/actions/checkout@11d5960a326750d5838078e36cf38b85af677262
        with:
          ref: ${{ gitea.event.pull_request.base.sha }}
          persist-credentials: false
      - name: Validate catalog provenance
        uses: ./.gitea/actions/curio-source
        with:
          mode: validate
          catalog: trove/curios
          trusted_owner: trove-curios