debug.yaml

---
name: 🩺 Debug
"on":
  workflow_call:
  workflow_dispatch:
  push:
    branches:
      - main
    paths:
      - .github/workflows/debug.yaml
  schedule:
    # Run monthly on the 1st at 12:00 UTC to spot silent regressions.
    - cron: "0 12 1 * *"

permissions: {}

concurrency:
  group: >-
    ${{ github.workflow }}-${{
      github.event.pull_request.number
      || github.ref
    }}
  cancel-in-progress: >-
    ${{ !startsWith(github.event.head_commit.message,
      '[changelog] Release') }}

# Supply-chain cooldown: no package published within the window can be resolved by
# any command in this workflow. Set here, not per command, so it also covers the
# `metadata` bootstrap and any step added later; a workflow-level `env:` cannot
# reference `needs`, so the window is a literal kept equal to `[tool.repomatic]
# minimum-release-age`. repomatic's own test suite enforces that upstream; a
# synced copy is kept in step by hand. Deliberate bypasses are per-package CLI
# flags (`--exclude-newer-package`, `--min-release-age-exclude`).
# See claude.md for the rationale.
env:
  NPM_CONFIG_MIN_RELEASE_AGE: 7
  UV_EXCLUDE_NEWER: "1 week"

jobs:

  metadata:
    name: 🧬 Project metadata
    runs-on: ubuntu-26.04
    timeout-minutes: 15
    outputs:
      build_targets: ${{ steps.extend-matrix.outputs.targets }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
        with:
          version: "0.12.3"
      - name: Run repomatic metadata
        id: metadata
        run: >
          uv --no-progress run --frozen -- repomatic --verbosity DEBUG metadata
          --format github-json --output "$GITHUB_OUTPUT"
          build_targets
      # Unwraps the nested JSON string the metadata output carries. Every job
      # runs on a test axis, so the build targets already span the fleet.
      - name: Unwrap build targets
        id: extend-matrix
        env:
          METADATA: ${{ steps.metadata.outputs.metadata }}
        run: |
          targets=$(echo "${METADATA}" | jq -c '.build_targets | fromjson')
          echo "targets=$targets" >> "$GITHUB_OUTPUT"

  dump-context:
    name: 🩺 ${{ matrix.os }} info dump
    needs:
      - metadata
    if: needs.metadata.outputs.build_targets
    strategy:
      # Info-gathering matrix: see docs/workflows.md "Matrix fail-fast strategy".
      fail-fast: false
      matrix:
        include: ${{ fromJSON(needs.metadata.outputs.build_targets) }}
    runs-on: ${{ matrix.os }}
    # Wider than the default: this job provisions a toolchain, so its runtime tracks how much it has to install.
    timeout-minutes: 30
    steps:
      # `toJSON()` already pretty-prints, so each context reaches the log
      # readable with no jq in the way, which also keeps this step identical on
      # the Windows runners. `::group::` folds each dump the way the action
      # this replaced did. The `steps` context is left out: this is the first
      # step of the job, so it is always empty. Secrets appearing in a context
      # or an environment variable are redacted by the runner's log masking,
      # and this workflow is granted none anyway (`permissions: {}`).
      - name: Dump GitHub contexts
        shell: bash
        env:
          GITHUB_CONTEXT: ${{ toJSON(github) }}
          JOB_CONTEXT: ${{ toJSON(job) }}
          MATRIX_CONTEXT: ${{ toJSON(matrix) }}
          RUNNER_CONTEXT: ${{ toJSON(runner) }}
          STRATEGY_CONTEXT: ${{ toJSON(strategy) }}
        run: |
          for context in GITHUB JOB MATRIX RUNNER STRATEGY; do
            variable="${context}_CONTEXT"
            echo "::group::${context} context"
            printf '%s\n' "${!variable}"
            echo "::endgroup::"
          done
          echo "::group::Environment variables"
          env | sort
          echo "::endgroup::"
      # Host probes the runner ships on its own: nothing is installed to read
      # them, which is the point. The Docker, cgroup and containerd probes the
      # action ran are dropped along with the `apt-get install` they needed, as
      # no job in this repository builds an image or runs a container outside
      # the release engine's digest-pinned manylinux one.
      - name: Dump host info
        shell: bash
        # Every probe tolerates its own absence: a diagnostics job that goes
        # red because one runner image dropped a utility teaches people to
        # ignore its red runs, which then hides a real failure.
        # `wmic` is deliberately not used: Windows Server 2025 and Windows 11
        # 24H2 (both runner images here) ship without it.
        run: |
          echo "::group::Kernel and host"
          uname -a || true
          echo "::endgroup::"
          echo "::group::Disk space"
          df -h || true
          echo "::endgroup::"
          echo "::group::CPU and memory"
          case "${RUNNER_OS}" in
            Linux)
              cat /proc/cpuinfo || true
              free -h || true
              ;;
            macOS)
              sysctl hw machdep.cpu || true
              ;;
            Windows)
              powershell -NoProfile -Command "Get-CimInstance Win32_Processor |
                Format-List Name, NumberOfCores, NumberOfLogicalProcessors;
                Get-CimInstance Win32_OperatingSystem |
                Format-List TotalVisibleMemorySize, FreePhysicalMemory" || true
              ;;
          esac
          echo "::endgroup::"
      - uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
        with:
          version: "0.12.3"
      - run: uvx --no-progress 'extra-platforms==13.6.0'