open-standards/.github/workflows/no-vanity-metrics.yml

name: no-vanity-metrics

# Blocks reintroduction of codebase-state numbers (crate counts, test
# counts, LOC, "N+ adapters", etc.) into READMEs and other Markdown
# surfaces. Those numbers drift on every code change and create
# permanent sync debt with the websites; the open-standards posture is
# "describe the shape, not the size." See CONTRIBUTING.md for the
# rationale and the opt-out marker.
#
# Two more jobs hold WAI's public text (wai/) to its writing rules
# (wai/CONTRIBUTING.md, *Public text*): no comparative or promotional phrasing
# (a public phrase list), and no company, vendor, customer or product names
# (patterns kept private, in the WAI_NAME_DENYLIST secret; prints locations
# only). Both checks fail closed: a grep error or a pattern that does not compile
# fails the job, and scripts/test-public-text-checks.sh proves it on every run.
# The secret is given to one step, on a push to main only: a pull request runs
# code from its own branch, and a step of it that held the list could print it to
# a public log. Without the secret, a push to main fails; a pull request shows a
# failed (continue-on-error) step saying the name check did not run.

# One run per branch at a time. A push supersedes the run before it.
#
# There is one `macos` runner and it is the dev Mac, so every macOS job in this
# repo queues on it. With no concurrency group, a session pushing four versions
# of a branch queued four complete sets of runs and every one of them had to
# drain: on 2026-10-05 a PR's 21 contexts settled none in 70 minutes behind a
# backlog of 25 runs, and the queue grew faster than it cleared. Only the newest
# commit's verdict is wanted, so the older runs are cancelled.
#
# Verified on this forge (Forgejo 16.0.5) in `ci-test` before being added here:
# the key parses, and a newer push moves an older run to `cancelled` even while
# it is still queued, which is the case that matters.
#
# `cancel-in-progress: true` also applies to `main`. That is deliberate and
# safe here: main advances by merge commits whose tree contains the commits
# before them, so the newer run covers the older one's changes.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - '**/*.md'
      # The public-text checks below scan WAI's code comments and data too.
      - 'wai/**/*.rs'
      - 'wai/**/*.toml'
      - 'wai/**/*.py'
      - 'wai/**/*.sh'
      - 'wai/**/*.js'
      - 'wai/**/*.mjs'
      - 'wai/**/*.json'
      - 'wai/**/*.html'
      - 'wai/**/*.css'
      - 'wai/**/*.ttl'
      - 'wai/**/*.h'
      - 'wai/**/*.c'
      - 'wai/**/*.txt'
      - 'wai/**/.gitignore'
      - '.github/workflows/no-vanity-metrics.yml'
      - 'scripts/check-no-vanity-metrics.sh'
      - 'scripts/check-comparative-prose.sh'
      - 'scripts/check-public-names.sh'
      - 'scripts/test-public-text-checks.sh'
  push:
    branches:
      - main
    paths:
      - '**/*.md'
      # The public-text checks below scan WAI's code comments and data too.
      - 'wai/**/*.rs'
      - 'wai/**/*.toml'
      - 'wai/**/*.py'
      - 'wai/**/*.sh'
      - 'wai/**/*.js'
      - 'wai/**/*.mjs'
      - 'wai/**/*.json'
      - 'wai/**/*.html'
      - 'wai/**/*.css'
      - 'wai/**/*.ttl'
      - 'wai/**/*.h'
      - 'wai/**/*.c'
      - 'wai/**/*.txt'
      - 'wai/**/.gitignore'
      - '.github/workflows/no-vanity-metrics.yml'
      - 'scripts/check-no-vanity-metrics.sh'
      - 'scripts/check-comparative-prose.sh'
      - 'scripts/check-public-names.sh'
      - 'scripts/test-public-text-checks.sh'

jobs:
  scan:
    name: Scan committed Markdown for vanity metrics
    runs-on: linux
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Run scanner
        run: bash scripts/check-no-vanity-metrics.sh

  wai-comparative-prose:
    name: WAI public text names no comparison
    runs-on: linux
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      - name: The two public-text checks fail closed (self-test)
        run: bash scripts/test-public-text-checks.sh
      - name: Run the comparative-prose check
        run: bash scripts/check-comparative-prose.sh

  wai-public-names:
    name: WAI public text names no company or product
    runs-on: linux
    steps:
      - name: Checkout
        uses: actions/checkout@v4
      # The list reaches this step only, and only on a push to main, whose code
      # has been merged. Without the list the check cannot run, and that fails.
      - name: Run the public-name check
        if: github.event_name != 'pull_request'
        env:
          # Newline-separated patterns, never committed: a public list would
          # publish the names it keeps out.
          WAI_NAME_DENYLIST: ${{ secrets.WAI_NAME_DENYLIST }}
        run: |
          if [ -z "$WAI_NAME_DENYLIST" ]; then
            echo "::error::WAI_NAME_DENYLIST is not set: the public-name check cannot run"
            exit 1
          fi
          bash scripts/check-public-names.sh
      # A pull request never receives the list. The step fails visibly without
      # failing the job; the push to main runs the check.
      - name: The public-name check did not run on this pull request
        if: github.event_name == 'pull_request'
        continue-on-error: true
        run: |
          echo "::warning::the public-name check does not run on a pull request (its pattern list is never given to pull-request code); it runs on the push to main"
          exit 1

# (touched to test that this very change supersedes its own queued runs)