Update stacked: 3 packages #211
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: corresponding-source | |
| # REPORT-ONLY, NON-BLOCKING. For every copyleft package (classified from | |
| # license_spdx), verify its exact source archive is durably present on the | |
| # public mirror (gs://minimal-staging-archives) — the corresponding-source | |
| # offer that distributing copyleft binaries from the cache obligates | |
| # (gominimal/inbox#283 / #53). MUST NOT be a branch-protection required check. | |
| # Seventh sibling of the report-only check family. | |
| # | |
| # Network: unauthenticated HTTPS HEADs against the public mirror bucket ONLY | |
| # (fixed host; charset-validated paths from tracked build.ncl). No secrets. | |
| # The weekly schedule exists because mirror objects can drift/vanish | |
| # independently of any PR — that silent drift is the main thing to catch. | |
| on: | |
| workflow_dispatch: {} | |
| schedule: | |
| - cron: "43 7 * * 1" # weekly drift sweep over the full catalog | |
| pull_request: | |
| branches: ["main"] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: corresponding-source-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| report: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Pinned to a SHA (matches the sibling report-only workflows). | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| fetch-depth: 0 # base..head reachable for the changed-file diff | |
| - name: Package set | |
| id: pkgset | |
| env: | |
| # SHAs via env per repo convention (zizmor template-injection). | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| EVENT: ${{ github.event_name }} | |
| run: | | |
| set -uo pipefail | |
| if [ "$EVENT" = "pull_request" ]; then | |
| git diff --name-only "$BASE_SHA" "$HEAD_SHA" -- 'packages/*/build.ncl' \ | |
| | cut -d/ -f2 | sort -u > pkgs.txt || : > pkgs.txt | |
| echo "mode=file" >> "$GITHUB_OUTPUT" | |
| echo "count=$(wc -l < pkgs.txt | tr -d ' ')" >> "$GITHUB_OUTPUT" | |
| else | |
| : > pkgs.txt # --all sweeps the whole catalog | |
| echo "mode=all" >> "$GITHUB_OUTPUT" | |
| echo "count=1" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Corresponding-source report | |
| if: steps.pkgset.outputs.count != '0' | |
| run: | | |
| set -uo pipefail | |
| # Report-only: a genuine error is downgraded to a warning so the | |
| # check never reds. | |
| if [ "${{ steps.pkgset.outputs.mode }}" = "file" ]; then | |
| python3 .github/scripts/corresponding_source_report.py --packages-file pkgs.txt \ | |
| || echo "::warning::corresponding-source report hit an internal error; see logs (non-blocking)" | |
| else | |
| python3 .github/scripts/corresponding_source_report.py --all \ | |
| || echo "::warning::corresponding-source report hit an internal error; see logs (non-blocking)" | |
| fi | |
| - name: No package changes | |
| if: steps.pkgset.outputs.count == '0' | |
| run: echo "No packages/*/build.ncl changed in this PR — nothing to report." >> "$GITHUB_STEP_SUMMARY" |