148 lines
6.4 KiB
YAML
148 lines
6.4 KiB
YAML
name: Managed validation
|
|
|
|
on:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
profile:
|
|
description: Allowlisted validation profile
|
|
required: true
|
|
default: full
|
|
type: choice
|
|
options: [test, lint, typecheck, build, security, full]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
full:
|
|
name: full
|
|
# Public fork code must never execute automatically on the private runner.
|
|
if: ${{ gitea.event_name != 'pull_request' || gitea.event.pull_request.head.repo.full_name == gitea.repository }}
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
- name: Validate repository with a bounded profile
|
|
shell: bash
|
|
env:
|
|
REQUESTED_PROFILE: ${{ inputs.profile }}
|
|
run: |
|
|
set -euo pipefail
|
|
profile="${REQUESTED_PROFILE:-full}"
|
|
case "${profile}" in
|
|
test|lint|typecheck|build|security|full) ;;
|
|
*) echo "Profile is not allowlisted" >&2; exit 2 ;;
|
|
esac
|
|
|
|
git diff --check
|
|
if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
|
|
echo "Unresolved merge markers detected" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# MANAGED_FAST_PATH: documentation and this baseline workflow cannot
|
|
# affect the shipped runtime. Keep the required status check, but do
|
|
# not install toolchains or execute the full product suite.
|
|
if [[ -n "${GITHUB_BASE_REF:-}" ]]; then
|
|
git fetch --no-tags --depth=1 origin "${GITHUB_BASE_REF}"
|
|
managed_base="origin/${GITHUB_BASE_REF}"
|
|
git diff --check "${managed_base}..HEAD"
|
|
mapfile -t managed_changed_files < <(
|
|
git diff --name-only --diff-filter=ACMR "${managed_base}..HEAD"
|
|
)
|
|
managed_runtime_change=0
|
|
for managed_path in "${managed_changed_files[@]}"; do
|
|
case "${managed_path}" in
|
|
*.md|*.mdx|docs/*|.github/ISSUE_TEMPLATE/*|.gitea/ISSUE_TEMPLATE/*|.gitea/runner-scope.sh|.gitea/workflows/managed-validation.yml)
|
|
;;
|
|
*)
|
|
managed_runtime_change=1
|
|
break
|
|
;;
|
|
esac
|
|
done
|
|
if [[ "${#managed_changed_files[@]}" -gt 0 && "${managed_runtime_change}" -eq 0 ]]; then
|
|
printf 'Managed validation fast path: %s non-runtime file(s); full product suite skipped.\n' \
|
|
"${#managed_changed_files[@]}"
|
|
exit 0
|
|
fi
|
|
fi
|
|
if [[ -f pyproject.toml || -f requirements.txt ]]; then
|
|
# Compile only tracked Python sources. Running compileall after a
|
|
# Node install would otherwise traverse node_modules and turn a
|
|
# lightweight baseline into a large runner workload.
|
|
git ls-files -z '*.py' | xargs -0 -r python -m py_compile
|
|
if [[ -f uv.lock ]]; then
|
|
python -m venv "${RUNNER_TEMP}/managed-uv"
|
|
uv_python="${RUNNER_TEMP}/managed-uv/bin/python"
|
|
"${uv_python}" -m pip install --disable-pip-version-check uv==0.10.0
|
|
managed_uv="${RUNNER_TEMP}/managed-uv/bin/uv"
|
|
export UV_PROJECT_ENVIRONMENT="${RUNNER_TEMP}/managed-project-venv"
|
|
"${managed_uv}" sync --locked
|
|
export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}"
|
|
if [[ "${profile}" == test || "${profile}" == full ]]; then
|
|
if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then
|
|
"${managed_uv}" run python -m pytest
|
|
fi
|
|
fi
|
|
if [[ "${profile}" == lint || "${profile}" == full ]]; then
|
|
if "${managed_uv}" run python -c 'import ruff' 2>/dev/null; then
|
|
"${managed_uv}" run python -m ruff check .
|
|
fi
|
|
fi
|
|
elif [[ -f requirements.txt ]]; then
|
|
python -m venv "${RUNNER_TEMP}/managed-python"
|
|
managed_python="${RUNNER_TEMP}/managed-python/bin/python"
|
|
"${managed_python}" -m pip install --disable-pip-version-check -r requirements.txt
|
|
export PATH="${RUNNER_TEMP}/managed-python/bin:${PATH}"
|
|
if [[ "${profile}" == test || "${profile}" == full ]]; then
|
|
if "${managed_python}" -c 'import pytest' 2>/dev/null; then
|
|
"${managed_python}" -m pytest
|
|
fi
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
# Prepare Python before invoking Node scripts. Polyglot repositories
|
|
# commonly delegate their test script to Python and need the managed
|
|
# virtual environment to be active first.
|
|
if [[ -f package.json ]]; then
|
|
corepack enable
|
|
if [[ -f pnpm-lock.yaml ]]; then
|
|
pnpm install --frozen-lockfile
|
|
[[ "${profile}" == test || "${profile}" == full ]] && pnpm --if-present test
|
|
[[ "${profile}" == lint || "${profile}" == full ]] && pnpm --if-present lint
|
|
[[ "${profile}" == typecheck || "${profile}" == full ]] && pnpm --if-present typecheck
|
|
[[ "${profile}" == build || "${profile}" == full ]] && pnpm --if-present build
|
|
elif [[ -f package-lock.json ]]; then
|
|
npm ci
|
|
[[ "${profile}" == test || "${profile}" == full ]] && npm run --if-present test
|
|
[[ "${profile}" == lint || "${profile}" == full ]] && npm run --if-present lint
|
|
if [[ "${profile}" == typecheck || "${profile}" == full ]]; then
|
|
npm run --if-present typecheck
|
|
fi
|
|
[[ "${profile}" == build || "${profile}" == full ]] && npm run --if-present build
|
|
fi
|
|
fi
|
|
|
|
if [[ -f go.mod ]]; then
|
|
if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
|
|
go test ./...
|
|
fi
|
|
fi
|
|
if [[ -f Cargo.toml ]]; then
|
|
if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
|
|
cargo test --locked
|
|
fi
|
|
fi
|
|
if compgen -G '*.sln' >/dev/null; then
|
|
if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
|
|
dotnet test --configuration Release
|
|
fi
|
|
fi
|