Repository navigation
90 lines (83 loc) · 4.05 KB
/
Copy pathci.yml
File metadata and controls
90 lines (83 loc) · 4.05 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
name: CI
# The check list is dev.json, run by scripts/dev/check.sh (the kit's own vendored runner). The two
# jobs keep their names, which branch protection requires: `lint` runs the cheap steps, `tests` the
# kit's test run. A pull request runs, of each job's steps, those `check.sh --changed` selects
# against the base branch (all of them when a path is unmapped or a selection input changed); a push
# to main and a dispatch run every step, and only they record the evidence a release takes
# (scripts/dev/release_evidence.py capture; docs/ci-evidence.md).
on:
push:
branches: [main]
pull_request:
# A dispatch on main is the release's fresh route, which an operator chooses after a refusal
# (docs/ci-evidence.md); nothing dispatches it automatically.
workflow_dispatch:
workflow_call:
permissions:
contents: read
jobs:
lint:
name: lint
runs-on: ubuntu-latest
steps:
# The whole history, so that --changed finds the merge base with the base branch.
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
persist-credentials: false
# Whitespace; no machine-local path in tracked text; CLAUDE.md is AGENTS.md and the root
# copy starts with the template; every script parses; no block of code is duplicated over the
# thresholds of jpdev.json; the JSON documents parse; shellcheck (the program the runner image
# carries).
- name: The lint steps of dev.json
env:
EVENT: ${{ github.event_name }}
BASE_REF: ${{ github.base_ref }}
run: |
set -o pipefail
if [ "$EVENT" = pull_request ]; then
scripts/dev/check.sh --all --changed "origin/$BASE_REF" --skip tests | tee "${{ runner.temp }}/checks.log"
else
scripts/dev/check.sh --all --skip tests | tee "${{ runner.temp }}/checks.log"
fi
- name: Record exact CI inputs and coverage
if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
run: python3 scripts/dev/release_evidence.py capture --workflow ci --job lint --check-log "${{ runner.temp }}/checks.log" --output "${{ runner.temp }}/evidence.json"
- name: Upload immutable CI evidence
if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: ci-evidence-ci-lint-${{ github.run_attempt }}
path: ${{ runner.temp }}/evidence.json
if-no-files-found: error
retention-days: 7
tests:
name: tests
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0
persist-credentials: false
- name: The kit's tests (jpdev check and check.sh on the fixture, the caps, the record gate)
env:
EVENT: ${{ github.event_name }}
BASE_REF: ${{ github.base_ref }}
run: |
set -o pipefail
if [ "$EVENT" = pull_request ]; then
scripts/dev/check.sh --changed "origin/$BASE_REF" --skip diff-check,local-paths,agent-docs,bash-n,duplication,json,shellcheck | tee "${{ runner.temp }}/checks.log"
else
scripts/dev/check.sh --only tests | tee "${{ runner.temp }}/checks.log"
fi
- name: Record exact CI inputs and coverage
if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
run: python3 scripts/dev/release_evidence.py capture --workflow ci --job tests --check-log "${{ runner.temp }}/checks.log" --output "${{ runner.temp }}/evidence.json"
- name: Upload immutable CI evidence
if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
with:
name: ci-evidence-ci-tests-${{ github.run_attempt }}
path: ${{ runner.temp }}/evidence.json
if-no-files-found: error
retention-days: 7