From 66ea61dd9d6f62995451ad92a3f499839ab7db7a Mon Sep 17 00:00:00 2001
From: Mitchell Hashimoto <m@mitchellh.com>
Date: Thu, 30 Jul 2026 21:10:14 -0700
Subject: [PATCH] ci: verify snapshot kaitai

Run the snapshot Kaitai verifier in its own required xsm job. This gives schema, fixture, checksum, and cross-record validation a distinct CI result without coupling it to the libghostty-vt test suite.
---
 .github/workflows/test.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index bc0de2691..ff60754c3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -111,6 +111,7 @@ jobs:
       - test-sentry-linux
       - test-i18n
       - test-fuzz-libghostty
+      - test-kaitai
       - test-lib-vt
       - test-lib-vt-pkgconfig
       - test-macos
@@ -1319,6 +1320,31 @@ jobs:
       - name: Test
         run: nix develop -c zig build test-lib-vt
 
+  test-kaitai:
+    if: github.repository == 'ghostty-org/ghostty' && needs.skip.outputs.skip != 'true'
+    needs: skip
+    runs-on: namespace-profile-ghostty-xsm
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Cache
+        uses: namespacelabs/nscloud-cache-action@c5f8dab7560444c4bf8dbc64f1b203431873c547 # v1.6.1
+        with:
+          path: /nix
+
+      # Install Nix so the verifier uses the pinned compiler and runtimes.
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
+        with:
+          name: ghostty
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+
+      - name: Verify Snapshot Kaitai Schema
+        run: nix develop -c src/terminal/snapshot/verify-kaitai.py
+
   test-gtk:
     strategy:
       fail-fast: false