open-standards/.github/workflows/repo-checks.yml

# Repository checks: the script checks every change runs, in one job.
#
# Each of these is a script that reads the tree for a few seconds. They were six
# workflows and nine jobs (lockfiles, tests-in-ci, workflow-hygiene, wai-section-refs,
# spec-refs and no-vanity-metrics' four), and each job paid for a container and a
# checkout to run them. On 2026-10-14 the light checks were about half of the 119 jobs
# waiting for the linux-arm64 runner, queued behind the long standards-build legs, and
# spec-refs held a place on the one x86_64 runner. One job runs them all now, one step
# a check: every step runs even after an earlier one fails (`!cancelled()`), so a red
# job names each failing check in its own step, and the job fails if any did.
#
# The two path filters the old workflows had (public text on Markdown and wai/ sources,
# section references on the WAI documents) are gone: the checks take seconds, and a
# filter that is wrong skips a check silently.
name: repository checks

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  checks:
    name: lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text
    runs-on: linux-arm64
    timeout-minutes: 30
    steps:
      # The whole history: the changelog check diffs a pull request against its base and
      # reads, from the base's first-parent history, when the check reached main
      # (scripts/check-changelog-fragment.py), and it fails rather than pass unchecked when
      # it cannot.
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      # check-lockfiles.sh runs `cargo` against every lockfile.
      - name: Install Rust 1.99.1
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.99.1
          rustup toolchain install 1.99.1 --profile minimal
          rustup default 1.99.1
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"

      # ── Every Cargo.lock is current ──────────────────────────────────────────
      - name: "lockfiles: the check fails closed (self-test)"
        if: ${{ !cancelled() }}
        run: ./scripts/check-lockfiles-selftest.sh
      - name: "lockfiles: every Cargo.lock is current"
        if: ${{ !cancelled() }}
        run: ./scripts/check-lockfiles.sh

      # ── No workspace carries an advisory nobody has read ─────────────────────
      # cargo-audit reads the lockfile and the advisory database; it builds
      # nothing. The runner is persistent, so this installs once.
      - name: Install cargo-audit
        if: ${{ !cancelled() }}
        shell: bash
        run: command -v cargo-audit >/dev/null || cargo install cargo-audit --locked
      - name: "advisories: the check fails closed (self-test)"
        if: ${{ !cancelled() }}
        run: ./scripts/check-advisories-selftest.sh
      - name: "advisories: every advisory is fixed or allowed with a reason"
        if: ${{ !cancelled() }}
        run: python3 -I scripts/check-advisories.py

      # ── Every test file is run by a job or listed with its reason ────────────
      - name: "tests in CI: the check fails closed (self-test)"
        if: ${{ !cancelled() }}
        run: ./scripts/check-tests-in-ci-selftest.sh
      - name: "tests in CI: every test file is run or listed, and none can run empty"
        if: ${{ !cancelled() }}
        run: python3 -I scripts/check-tests-in-ci.py

      # ── Every workflow supersedes its own queue; the path gate fails open ───
      - name: "workflow hygiene: the check fails closed (self-test)"
        if: ${{ !cancelled() }}
        run: ./scripts/check-workflow-concurrency-selftest.sh
      - name: "workflow hygiene: every workflow is grouped per ref"
        if: ${{ !cancelled() }}
        run: ./scripts/check-workflow-concurrency.sh
      - name: "workflow hygiene: the path gate fails open (self-test)"
        if: ${{ !cancelled() }}
        run: ./scripts/pr-touches-paths-selftest.sh

      # ── One pinned wasmtime, run with both determinism settings ─────────────
      - name: "workflow hygiene: the wasmtime pin check fails closed (self-test)"
        if: ${{ !cancelled() }}
        run: bash scripts/check-wasmtime-pin-selftest.sh
      - name: "workflow hygiene: every wasmtime is the pinned release, run with both determinism settings"
        if: ${{ !cancelled() }}
        run: python3 -I scripts/check-wasmtime-pin.py

      # ── Code cites no section its SPEC lacks; WAI's cited sections exist ────
      - name: "spec references: the check can fail (self-test)"
        if: ${{ !cancelled() }}
        run: bash scripts/check-spec-refs-selftest.sh
      - name: "spec references: every SPEC citation resolves"
        if: ${{ !cancelled() }}
        run: python3 scripts/check-spec-refs.py
      - name: "section references: every section WAI's documents cite exists"
        if: ${{ !cancelled() }}
        run: python scripts/check-wai-section-refs.py

      # ── The lists wai-conformance.yml derives hold the hand lists they replaced ─
      # Its feature lists, test lists, verifier steps, corpora and gate paths are read from
      # the files that own them (.github/wai-conformance/, the tags of wai/wai-rs/tests/).
      - name: "workflow lists: the derivation fails closed (self-test)"
        if: ${{ !cancelled() }}
        run: bash scripts/wai-conformance-lists-selftest.sh
      - name: "workflow lists: every derived list holds every entry of the hand list it replaced"
        if: ${{ !cancelled() }}
        run: python3 -I scripts/wai-conformance-lists.py selftest

      # ── A change to WAI carries its changelog entry, in a file of its own ──────
      # wai/changes/README.md states the form; the entries go into wai/CHANGELOG.md at a
      # release (scripts/changelog-assemble.py). A pull request opened before the check
      # reached main passes as it is; the check reads when it was opened from the event
      # payload, and when the check reached main from the base's first-parent history.
      - name: "changelog: the check and the assembler fail closed (self-test)"
        if: ${{ !cancelled() }}
        run: bash scripts/changelog-fragments-selftest.sh
      - name: "changelog: every entry file is one entry in the changelog's form"
        if: ${{ !cancelled() }}
        run: python3 -I scripts/changelog-assemble.py --check
      - name: "changelog: a change to wai/ adds its entry (pull request)"
        if: ${{ !cancelled() && github.event_name == 'pull_request' }}
        run: |
          git config --global --add safe.directory "$GITHUB_WORKSPACE"
          python3 -I scripts/check-changelog-fragment.py \
            "${{ github.event.pull_request.base.sha }}" "${{ github.event.pull_request.head.sha }}"

      # ── Public text: no vanity metrics, no comparison, no company names ─────
      - name: "public text: no vanity metrics in committed Markdown"
        if: ${{ !cancelled() }}
        run: bash scripts/check-no-vanity-metrics.sh
      - name: "public text: the two public-text checks fail closed (self-test)"
        if: ${{ !cancelled() }}
        run: bash scripts/test-public-text-checks.sh
      - name: "public text: WAI's public text names no comparison"
        if: ${{ !cancelled() }}
        run: bash scripts/check-comparative-prose.sh
      # The maintainers' product names are public, held in the script itself: this run
      # reads no secret, so it checks every change, a pull request included.
      - name: "public text: WAI's public text names no product of its maintainers"
        if: ${{ !cancelled() }}
        run: bash scripts/check-public-names.sh --maintainer-products-only
      # The pattern list is a secret, never given to pull-request code: the check runs
      # on the push to main.
      - name: "public text: WAI's public text names no company or product (push to main)"
        if: ${{ !cancelled() && github.event_name != 'pull_request' }}
        env:
          WAI_NAME_DENYLIST: ${{ secrets.WAI_NAME_DENYLIST }}
        run: |
          if [ -z "$WAI_NAME_DENYLIST" ]; then
            echo "::error::WAI_NAME_DENYLIST is not set: the public-name check cannot run"
            exit 1
          fi
          bash scripts/check-public-names.sh

      # ── No library source file is unreachable from its crate root ───────────
      # An orphan `.rs` (one no `mod`, `#[path]` or `include!` names) is never compiled,
      # so nothing else in this repository can see it. Both directions, before trusting
      # the result: a planted orphan must fail the check, and removing it must pass.
      - name: "orphan sources: the check fails closed (self-test)"
        if: ${{ !cancelled() }}
        run: |
          set -euo pipefail
          probe=jcp/jcp-rs/crates/jcp-efficiency/src/_ci_orphan_probe.rs
          printf 'pub fn never_compiled() -> u64 { 0 }\n' > "$probe"
          if python3 scripts/check-orphan-sources.py >/dev/null 2>&1; then
            rm -f "$probe"
            echo "::error::the orphan check passed with a planted orphan present"
            exit 1
          fi
          rm -f "$probe"
      - name: "orphan sources: no new orphan source files"
        if: ${{ !cancelled() }}
        run: python3 scripts/check-orphan-sources.py