Repository navigation
feat(scripts): 3 template-drift recipes (SPDX lint rule, SonarQube token guard, split comment keys) #300
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow is managed by gh actions-lock. | |
| # SPDX-License-Identifier: MPL-2.0 | |
| # Vendored bot drift — bots/<bot>/ copies of standalone repositories are pinned | |
| # syncs, not forks. This fails when a vendored copy differs from the upstream | |
| # commit pinned in bots/<bot>/FLEET-SYNC.json (see scripts/sync-vendored-bot.sh | |
| # and bots/echidnabot/CANONICAL_SOURCE.adoc). | |
| name: Vendored bot drift | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: ['**'] | |
| schedule: | |
| - cron: '17 6 * * 1' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| tool-tests: | |
| name: sync-vendored-bot tests (planted controls) | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - run: bash scripts/tests/sync-vendored-bot.sh | |
| echidnabot-tests: | |
| name: echidnabot vendored build and tests | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 45 | |
| defaults: | |
| run: | |
| working-directory: bots/echidnabot | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Test the vendored crate at the pinned lock | |
| run: | | |
| set -euo pipefail | |
| # Fleet-owned regression tests are kept outside the pinned source. | |
| # Stage them only in this runner and refuse to mask upstream tests. | |
| for source in "$GITHUB_WORKSPACE"/tests/echidnabot/*.rs; do | |
| target="tests/$(basename "$source")" | |
| test ! -e "$target" || { echo "upstream test collision: $target" >&2; exit 1; } | |
| cp "$source" "$target" | |
| done | |
| cargo test --locked --all-targets | |
| drift: | |
| name: echidnabot pinned to hyperpolymath/echidnabot | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Fleet copy equals pinned upstream rev | |
| run: bash scripts/sync-vendored-bot.sh echidnabot --check | |
| - name: Report how far upstream main is ahead of the pin (informational) | |
| run: | | |
| set -euo pipefail | |
| lock=bots/echidnabot/FLEET-SYNC.json | |
| repo="$(jq -r .repo "$lock")" | |
| rev="$(jq -r .rev "$lock")" | |
| branch="$(jq -r .upstream_branch "$lock")" | |
| tmp="$(mktemp -d)" | |
| git init -q --bare "$tmp/up.git" | |
| git -C "$tmp/up.git" fetch -q --no-tags --filter=blob:none "$repo" "+refs/heads/$branch:refs/heads/$branch" | |
| ahead="$(git -C "$tmp/up.git" rev-list --count "$rev..refs/heads/$branch")" | |
| head="$(git -C "$tmp/up.git" rev-parse "refs/heads/$branch")" | |
| if [ "$ahead" -gt 0 ]; then | |
| echo "::notice::echidnabot upstream $branch is $ahead commit(s) ahead of the pin ($rev -> $head). Bump with: scripts/sync-vendored-bot.sh echidnabot --sync --rev $head" | |
| else | |
| echo "Pin is at upstream $branch head ($head)." | |
| fi |