docs: refresh preset profile hardening intake #1090
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Homogeneity Check | |
| on: | |
| push: | |
| pull_request: | |
| jobs: | |
| check: | |
| name: Homogeneity Check (${{ matrix.os }}) | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 10 | |
| strategy: | |
| matrix: | |
| os: [ubuntu-22.04, macos-14, windows-2022] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| # Statistics Profile 2 derives deterministic activity from full Git history. | |
| fetch-depth: 0 | |
| - name: Install ripgrep (Ubuntu) | |
| if: runner.os == 'Linux' | |
| run: sudo apt-get install -y ripgrep | |
| - name: Install ripgrep (macOS) | |
| if: runner.os == 'macOS' | |
| run: brew install ripgrep | |
| - name: Install ripgrep (Windows) | |
| if: runner.os == 'Windows' | |
| run: choco install ripgrep -y | |
| - name: Run Homogeneity Check (Bash) | |
| if: runner.os != 'Windows' | |
| run: | | |
| PARENT="$(dirname "$GITHUB_WORKSPACE")" | |
| REPO="$(basename "$GITHUB_WORKSPACE")" | |
| cd "$PARENT" | |
| bash "${REPO}/scripts/check-homogeneity.sh" "${REPO}" | |
| - name: Run maintenance regression tests | |
| if: runner.os != 'Windows' | |
| run: python3 -m unittest discover -s scripts/tests -p 'test_*.py' | |
| - name: Validate maintenance safe mode on macOS | |
| if: runner.os == 'macOS' | |
| shell: bash | |
| run: | | |
| isolated_home="$(mktemp -d)" | |
| set +e | |
| HOME="$isolated_home" bash scripts/maintain-agentic-workspace.sh \ | |
| --home-dir "$isolated_home" --dry-run --scripts-only | |
| status=$? | |
| set -e | |
| test "$status" -eq 1 | |
| test ! -e "$isolated_home/CSharpProjects" | |
| - name: Run Homogeneity Check (PowerShell on Windows) | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| $parent = Split-Path -Parent $env:GITHUB_WORKSPACE | |
| $repo = Split-Path -Leaf $env:GITHUB_WORKSPACE | |
| Set-Location $parent | |
| pwsh -NoProfile -File "$repo/scripts/check-homogeneity.ps1" -TargetDir $repo | |
| - name: Validate maintenance safe mode on Windows | |
| if: runner.os == 'Windows' | |
| shell: pwsh | |
| run: | | |
| $isolatedHome = Join-Path $env:RUNNER_TEMP 'maintenance-safe-mode' | |
| New-Item -ItemType Directory -Path $isolatedHome -Force | Out-Null | |
| $arguments = @( | |
| '-NoProfile', | |
| '-File', 'scripts/maintain-agentic-workspace.ps1', | |
| '-HomeDir', $isolatedHome, | |
| '-ScriptsOnly', | |
| '-WhatIf' | |
| ) | |
| $process = Start-Process -FilePath 'pwsh' -ArgumentList $arguments ` | |
| -Wait -PassThru -NoNewWindow | |
| $status = $process.ExitCode | |
| if ($status -ne 1) { | |
| throw "Expected drift exit code 1, received $status." | |
| } | |
| if (Test-Path -LiteralPath (Join-Path $isolatedHome 'CSharpProjects')) { | |
| throw 'Dry-run created a target checkout.' | |
| } | |
| - name: Validate generated script reference | |
| shell: pwsh | |
| run: pwsh -NoProfile -File scripts/render-script-reference.ps1 -Repo . -CheckOnly |