feat(workspace): add bounded practice-review rollout controls #705
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Verify Changesets | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| verify-changesets: | |
| name: "Verify changesets" | |
| runs-on: ubuntu-latest | |
| # Bots (renovate, dependabot) can't author changesets; maintainers add one | |
| # when a dependency bump is user-facing. | |
| if: ${{ !github.event.pull_request.draft && github.event.pull_request.user.type != 'Bot' }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup pnpm + Node.js | |
| uses: ./.github/actions/setup-pnpm-node | |
| - name: Install dependencies | |
| run: pnpm install --frozen-lockfile --ignore-scripts | |
| - name: Check for a changeset | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| run: | | |
| set -euo pipefail | |
| # Image contents, excluding tests and in-tree documentation. | |
| SHIPPED_PATHS=( | |
| "server" "webapp" "docker" | |
| ":!**/*.md" ":!server/src/test" ":!webapp/e2e" | |
| ":!**/*.test.ts" ":!**/*.test.tsx" ":!**/*.stories.tsx" | |
| ) | |
| # Compare from the merge base so only this PR's changes count. | |
| shipped_changed=$(git diff --name-only "$BASE_SHA"...HEAD -- "${SHIPPED_PATHS[@]}") | |
| mapfile -t changesets_added < <(git diff --diff-filter=A --name-only "$BASE_SHA"...HEAD -- '.changeset/*.md' | grep -v 'README\.md' || true) | |
| mapfile -t changesets_changed < <(git diff --diff-filter=AM --name-only "$BASE_SHA"...HEAD -- '.changeset/*.md' | grep -v 'README\.md' || true) | |
| mapfile -t changesets_removed < <(git diff --diff-filter=DR --name-only "$BASE_SHA"...HEAD -- '.changeset/*.md' | grep -v 'README\.md' || true) | |
| if [ "${#changesets_removed[@]}" -gt 0 ]; then | |
| echo "::error::Pending changesets may be edited or converted to explained empty changesets, but not deleted or renamed:" | |
| printf '%s\n' "${changesets_removed[@]}" | |
| exit 1 | |
| fi | |
| if [ "${#changesets_changed[@]}" -gt 0 ]; then | |
| pnpm changeset status --since "$BASE_SHA" --output /tmp/changeset-status.json | |
| node scripts/verify-changesets.ts /tmp/changeset-status.json "${changesets_changed[@]}" | |
| fi | |
| if git diff --name-only "$BASE_SHA"...HEAD -- server/src/main/resources/db/changelog/ | grep -q .; then | |
| echo "::notice::This PR contains Liquibase changesets — the release notes will flag the migration automatically. If the operator must act, say so in your changeset and update MIGRATION.md." | |
| fi | |
| if [ -n "$shipped_changed" ] && [ "${#changesets_added[@]}" -eq 0 ]; then | |
| echo "::error::This PR changes shipped code but carries no changeset:" | |
| echo "$shipped_changed" | |
| exit 1 | |
| fi | |
| echo "Changeset check passed." |