Audit source health #15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Audit source health | |
| on: | |
| schedule: | |
| # Sunday 06:37 Asia/Shanghai, before the weekly refresh. | |
| - cron: "37 22 * * 6" | |
| workflow_dispatch: | |
| permissions: | |
| actions: write | |
| contents: write | |
| issues: write | |
| concurrency: | |
| group: agent-pulse-repository-data-main | |
| cancel-in-progress: false | |
| jobs: | |
| audit: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| env: | |
| DATABASE_URL: sqlite:./var/source-audit.db | |
| COLLECTOR_CONCURRENCY: 4 | |
| steps: | |
| - name: Check out main | |
| uses: actions/checkout@v7 | |
| with: | |
| ref: main | |
| fetch-depth: 0 | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v6 | |
| with: | |
| node-version: 24 | |
| cache: npm | |
| - name: Install locked dependencies | |
| run: npm ci | |
| - name: Restore auditable repository snapshot | |
| run: npm run db:snapshot -- restore | |
| - name: Capture the current public source fingerprint | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| npm run export -- --skip-seed | |
| npm run --silent public:fingerprint -- --include-sources > "$RUNNER_TEMP/public-before.sha256" | |
| - name: Audit every configured source | |
| run: npm run sources:audit -- --concurrency=4 --report=data/reports/source-health.json | |
| - name: Reconcile unstable sources and radar | |
| run: npm run ops:reconcile | |
| - name: Reconcile eligible shadow observation | |
| run: npm run observe:sources -- --confirm | |
| - name: Activate only qualified observation sources | |
| run: npm run activate:auto | |
| - name: Merge latest remote repository snapshot | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| git fetch origin main | |
| git show origin/main:data/snapshot/v1.json > "$RUNNER_TEMP/remote-snapshot.json" | |
| npm run db:snapshot -- merge --file="$RUNNER_TEMP/remote-snapshot.json" | |
| - name: Export converged source state and detect a material public change | |
| id: public | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| npm run export -- --skip-seed | |
| npm run --silent public:validate -- --output="$RUNNER_TEMP/public-integrity.json" | |
| npm run --silent public:fingerprint -- --include-sources > "$RUNNER_TEMP/public-after.sha256" | |
| if cmp -s "$RUNNER_TEMP/public-before.sha256" "$RUNNER_TEMP/public-after.sha256"; then | |
| echo "No material public source changes." | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "Material public source state changed." | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Upload public integrity evidence | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: source-audit-public-integrity-${{ github.run_id }} | |
| path: ${{ runner.temp }}/public-integrity.json | |
| if-no-files-found: ignore | |
| retention-days: 14 | |
| - name: Write privacy-safe snapshot with accumulated checks | |
| run: npm run db:snapshot -- write | |
| - name: Validate report privacy and shape | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| test -s data/reports/source-health.json | |
| test -s data/snapshot/v1.json | |
| git diff --check -- data/reports/source-health.json data/snapshot/v1.json | |
| if grep -E 'gh[opsu]_[A-Za-z0-9_]{20,}|-----BEGIN .*PRIVATE KEY-----|/Users/[^/]+/|/home/runner/|"(token|secret|password|cookie|authorization|api[_-]?key)"[[:space:]]*:' data/reports/source-health.json data/snapshot/v1.json; then | |
| echo "Private material detected in source health output" >&2 | |
| exit 1 | |
| fi | |
| - name: Render compact source health summary | |
| run: npm run --silent sources:health:issue -- --report data/reports/source-health.json > "$RUNNER_TEMP/source-health-summary.md" | |
| - name: Update the single automated source health issue | |
| id: health_issue | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| gh label create "source:health" --color fbca04 --description "Source health and maintenance" --force | |
| existing="$(gh issue list --state all --label "source:health" --limit 100 --json number,body,state \ | |
| --jq '.[] | select(.body | contains("agent-pulse-source-health-summary:v1")) | [.number, .state] | @tsv' | head -n 1)" | |
| if [[ -n "$existing" ]]; then | |
| issue_number="${existing%%$'\t'*}" | |
| issue_state="${existing##*$'\t'}" | |
| gh issue edit "$issue_number" --body-file "$RUNNER_TEMP/source-health-summary.md" | |
| if [[ "$issue_state" == "CLOSED" ]]; then gh issue reopen "$issue_number"; fi | |
| else | |
| issue_url="$(gh issue create --title "[Source health] Automated source health summary" \ | |
| --label "source:health" --body-file "$RUNNER_TEMP/source-health-summary.md")" | |
| issue_number="${issue_url##*/}" | |
| fi | |
| echo "issue_number=$issue_number" >> "$GITHUB_OUTPUT" | |
| - name: Verify source health issue freshness | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| ISSUE_NUMBER: ${{ steps.health_issue.outputs.issue_number }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| test -n "$ISSUE_NUMBER" | |
| issue_state="$(gh issue view "$ISSUE_NUMBER" --json state --jq '.state')" | |
| test "$issue_state" = "OPEN" | |
| gh issue view "$ISSUE_NUMBER" --json body --jq '.body' > "$RUNNER_TEMP/source-health-issue.md" | |
| grep -F '<!-- agent-pulse-source-health-summary:v1 -->' "$RUNNER_TEMP/source-health-issue.md" >/dev/null | |
| finished_at="$(jq -r '.finishedAt' data/reports/source-health.json)" | |
| test -n "$finished_at" | |
| grep -F "$finished_at" "$RUNNER_TEMP/source-health-issue.md" >/dev/null | |
| - name: Commit report when changed | |
| id: commit | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| git add -- data/reports/source-health.json data/snapshot/v1.json | |
| if git diff --cached --quiet; then | |
| echo "No report changes." | |
| echo "changed=false" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git commit -m "chore(data): refresh source health report" | |
| git rebase origin/main | |
| git push origin HEAD:main | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| - name: Dispatch Pages deployment for material public source changes | |
| if: steps.commit.outputs.changed == 'true' && steps.public.outputs.changed == 'true' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: gh workflow run pages.yml --ref main |