Evan Hu
8fa00f5576
release.yml 是从 main 运行的，branch-guard 也按 PR 的 base 分支加载工作流定义。两者只合进 develop 时都不生效：main 上的 release-please 仍会把版本 PR 开到默认分支 develop，而提到 main 的 PR 根本不会触发拦截。
51 lines
2.8 KiB
YAML
51 lines
2.8 KiB
YAML
name: Repository quality
|
|
# Called by CI so release-please's workflow_dispatch receives these checks too.
|
|
on:
|
|
workflow_call:
|
|
permissions:
|
|
contents: read
|
|
jobs:
|
|
workflows:
|
|
name: Workflow validation
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
|
|
with:
|
|
go-version: '1.26'
|
|
cache: false
|
|
- name: Install actionlint
|
|
run: go install github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
|
|
- name: Validate workflows and embedded shell scripts
|
|
env:
|
|
# Ignore style suggestions, but fail on shell correctness warnings and errors.
|
|
SHELLCHECK_OPTS: --severity=warning
|
|
run: actionlint -color
|
|
# Part of "Workflow validation" rather than a job of its own: it is a two-second grep, and this
|
|
# job is already a required check, so the guard starts protecting both branches immediately.
|
|
- name: Reject developer-specific paths in build inputs
|
|
run: bash scripts/ci/check-developer-paths.sh
|
|
# Formatting is platform independent, so it runs here on Ubuntu rather than costing a Windows
|
|
# runner. Cheap and early: a formatting slip fails in seconds instead of after the full compile.
|
|
- name: Check formatting
|
|
run: scripts/format.sh --check
|
|
dependencies:
|
|
name: Dependency review
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
# This job must not skip. It is one of the required status checks on main and develop, and a required check that reports "skipped" blocks a merge instead of passing it. Guarding it on the pull_request event left the release pull request unmergeable by its own automation: ci.yml ignores that pull request by path and the release workflow dispatches ci.yml on the release branch instead, so this job saw workflow_dispatch and skipped, and land-release-pr.sh got "the base branch policy prohibits the merge" after everything else came back green.
|
|
#
|
|
# A pull_request event supplies both refs on its own. Every other trigger has to be told what to compare, and comparing the default branch against the checked-out commit is the same question the pull request asks.
|
|
- uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4
|
|
with:
|
|
fail-on-severity: high
|
|
base-ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.sha || github.event.repository.default_branch }}
|
|
head-ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
|