Carlos Florêncio
98 lines
3.9 KiB
YAML
98 lines
3.9 KiB
YAML
name: Lint Action Pinning
|
|
|
|
# No trigger-level `paths:` filter, deliberately. A workflow skipped by one
|
|
# reports no conclusion at all, and a required check that never reports leaves
|
|
# a pull request unable to enter a merge queue and a merge group unable to
|
|
# leave it. `merge_group` cannot carry a `paths:` filter in the first place.
|
|
#
|
|
# The heavier gates push their filtering down into a `changes` job (see
|
|
# `.github/scripts/changed-paths.py`). This one is deliberately unfiltered
|
|
# instead: the list it replaced had grown to thirty-odd entries that each had
|
|
# to be added by hand whenever a contract test gained a new subject, and every
|
|
# omission was a silently unguarded file. Always running is both cheaper to
|
|
# reason about and strictly safer. See docs/ci-merge-queue.md.
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
merge_group:
|
|
types: [checks_requested]
|
|
workflow_dispatch:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
# Never cancel a merge-queue run. Its ref is unique per queue entry, so a
|
|
# cancellation here could only come from a mis-keyed group, and the queue
|
|
# would read the cancelled check as a failure and eject the pull request.
|
|
cancel-in-progress: ${{ github.event_name != 'merge_group' }}
|
|
|
|
# Least-privilege: only reads source.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
lint:
|
|
name: All action refs are SHA-pinned
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Test action-pinning lint
|
|
run: python3 .github/scripts/lint-action-pinning_test.py
|
|
|
|
- name: Test in-job path filter
|
|
run: python3 .github/scripts/changed-paths_test.py
|
|
|
|
- name: Test Claude Code review workflow contract
|
|
run: python3 .github/scripts/claude-code-review-workflow-contract_test.py
|
|
|
|
- name: Test PR walkthrough workflow contract
|
|
run: |
|
|
python3 .github/scripts/pr-walkthrough-workflow-contract_test.py
|
|
python3 scripts/pr-walkthrough-pr-body.test.py
|
|
python3 .agents/skills/pr-walkthrough/scripts/pr-walkthrough-context.test.py
|
|
python3 .agents/skills/pr-walkthrough/scripts/pr-walkthrough-render.test.py
|
|
|
|
- name: Test preview environment workflow contract
|
|
run: python3 .github/scripts/preview-env-workflow-contract_test.py
|
|
|
|
- name: Test OpenCode code review workflow contract
|
|
run: python3 .github/scripts/opencode-code-review-workflow-contract_test.py
|
|
|
|
- name: Test frontend tests workflow contract
|
|
run: python3 .github/scripts/frontend-tests-workflow-contract_test.py
|
|
|
|
- name: Test release workflow contract
|
|
run: python3 .github/scripts/release-workflow-contract_test.py
|
|
|
|
- name: Test E2E workflow contract
|
|
run: python3 .github/scripts/e2e-tests-workflow-contract_test.py
|
|
|
|
- name: Test stale merge approval revocation workflow contract
|
|
run: python3 .github/scripts/revoke-ready-to-merge-workflow-contract_test.py
|
|
|
|
- name: Test managed runtime pin update workflow contract
|
|
run: python3 .github/scripts/update-agent-runtime-pins-workflow-contract_test.py
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
|
|
with:
|
|
node-version: "24"
|
|
|
|
- name: Test runtime bundle contract
|
|
run: bash scripts/release/runtime-bundle.test.sh
|
|
|
|
- name: Test GHCR retry helper
|
|
run: bash scripts/release/retry-ghcr-command.test.sh
|
|
|
|
- name: Test npm release helpers
|
|
run: node --test scripts/release/nightly-version.test.mjs scripts/release/nightly-release.test.mjs scripts/release/npm-view-version.test.mjs scripts/release/publish-npm.test.mjs scripts/release/update-scoop-bucket.test.mjs
|
|
|
|
- name: Verify action refs
|
|
run: python3 .github/scripts/lint-action-pinning.py
|