add data/countries.json — canonical country registry #231
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: pr-gate | |
| # Server-side mirror of the local pre-commit hook's enforcement. | |
| # Closes Web UI bypass paths for branch-scope and base-branch rules. | |
| # | |
| # Triggers on every pull_request event (no branch filter) so a PR with | |
| # the wrong base — e.g. culture/germany -> main bypassing culture/release — | |
| # is also caught here. The base-branch-check job decides if the head/base | |
| # pair is even allowed. | |
| # | |
| # Adding a check: define a new job below and run a tests/validate_pr_*.py | |
| # helper. Keep CI logic in Python (testable) and yaml as orchestration only. | |
| # | |
| # Note on the validation stamp: this workflow used to include a third job | |
| # (stamp-tree-hash-check) that verified .validation-stamp equalled the | |
| # tree hash of HEAD. That gate was dropped because API-driven PR pushes | |
| # (via the GitHub MCP / web UI) cannot run the local pre-commit hook to | |
| # refresh the stamp, which created persistent friction. The remaining | |
| # protection is the cultures - Validation stamp gate in validate.yml | |
| # (file existence check, regions-only) plus every actual validator job in | |
| # validate.yml. Branch protection still requires those checks before merge. | |
| on: | |
| pull_request: | |
| jobs: | |
| base-branch-check: | |
| name: pr-gate - Allowed base for head | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Verify PR base matches head's allowed target | |
| run: | | |
| python3 tests/validate_pr_base.py \ | |
| "${{ github.head_ref }}" \ | |
| "${{ github.base_ref }}" | |
| branch-scope-check: | |
| name: pr-gate - Diff within branch scope | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| # Need history back to the merge base so `base...HEAD` works. | |
| fetch-depth: 0 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Verify diff stays inside head branch's allowed paths | |
| run: | | |
| python3 tests/validate_pr_scope.py \ | |
| "${{ github.head_ref }}" \ | |
| "origin/${{ github.base_ref }}" |