ba986de6d6
Some checks failed
repository checks / lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text (push) Has been cancelled
WAI breaking changes and the conformance runner / WAI breaking · does this change touch WAI (push) Successful in 12s
WAI breaking changes and the conformance runner / WAI breaking · wire, record and API against main · linux (push) Successful in 46s
WAI breaking changes and the conformance runner / WAI breaking and conform · their tests, and the independent verifiers through wai conform · linux (push) Successful in 3m25s
The workflow step ran scripts/check-frozen-rules.sh from the checkout, so a commit that added `exit 0` to it, together with a coordinated change to a rule, its text and its verifier, passed that run and every later one, though the history still showed the change. The step now takes the runner as the first commit of the first-parent history to add it held, and runs it as well as the checkout's copy; the job fails if either does. A runner edited, emptied or removed, in the rule's commit or an earlier one, hides nothing, and the check goes red on that commit and on the ones after it. A branch made before the runner takes it from the pull request's base, and a history that never held it fails. What is left is the step itself, which is read from the commit under test: a commit that edits it silences the check from then on, until that edit is undone, and the diff in the history records it. The record's page and its changelog entry now say this, and limit "does not hide" to the two scripts. They also say that a merge is read from its first parent, so one that puts another line of commits first changes the history the check reads. scripts/check-frozen-rules-selftest.sh runs the step's own text, from its marker in the workflow, in its scratch repository. It requires each of those cases, and it records the first-parent reading: a merge with main as its second parent pins its own line's rule, and only the comparison with a base shows it. Co-Authored-By: Claude Opus 5.5 <[email protected]>
252 lines
13 KiB
YAML
252 lines
13 KiB
YAML
# Repository checks: the script checks every change runs, in one job.
|
|
#
|
|
# Each of these is a script that reads the tree for a few seconds. They were six
|
|
# workflows and nine jobs (lockfiles, tests-in-ci, workflow-hygiene, wai-section-refs,
|
|
# spec-refs and no-vanity-metrics' four), and each job paid for a container and a
|
|
# checkout to run them. On 2026-10-14 the light checks were about half of the 119 jobs
|
|
# waiting for the linux-arm64 runner, queued behind the long standards-build legs, and
|
|
# spec-refs held a place on the one x86_64 runner. One job runs them all now, one step
|
|
# a check: every step runs even after an earlier one fails (`!cancelled()`), so a red
|
|
# job names each failing check in its own step, and the job fails if any did.
|
|
#
|
|
# The two path filters the old workflows had (public text on Markdown and wai/ sources,
|
|
# section references on the WAI documents) are gone: the checks take seconds, and a
|
|
# filter that is wrong skips a check silently.
|
|
name: repository checks
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
checks:
|
|
name: lockfiles, advisories, tests in CI, workflow hygiene, spec and section references, public text
|
|
runs-on: linux-arm64
|
|
timeout-minutes: 30
|
|
steps:
|
|
# The whole history: the changelog check diffs a pull request against its base and
|
|
# reads, from the base's first-parent history, when the check reached main
|
|
# (scripts/check-changelog-fragment.py), and it fails rather than pass unchecked when
|
|
# it cannot.
|
|
- uses: actions/checkout@v5
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.11'
|
|
|
|
# check-lockfiles.sh runs `cargo` against every lockfile.
|
|
- name: Install Rust 1.99.1
|
|
shell: bash
|
|
run: |
|
|
export PATH="$HOME/.cargo/bin:$PATH"
|
|
command -v rustup >/dev/null 2>&1 || \
|
|
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.99.1
|
|
rustup toolchain install 1.99.1 --profile minimal
|
|
rustup default 1.99.1
|
|
echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
|
|
|
|
# ── Every Cargo.lock is current ──────────────────────────────────────────
|
|
- name: "lockfiles: the check fails closed (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: ./scripts/check-lockfiles-selftest.sh
|
|
- name: "lockfiles: every Cargo.lock is current"
|
|
if: ${{ !cancelled() }}
|
|
run: ./scripts/check-lockfiles.sh
|
|
|
|
# ── No workspace carries an advisory nobody has read ─────────────────────
|
|
# cargo-audit reads the lockfile and the advisory database; it builds
|
|
# nothing. The runner is persistent, so this installs once.
|
|
- name: Install cargo-audit
|
|
if: ${{ !cancelled() }}
|
|
shell: bash
|
|
run: command -v cargo-audit >/dev/null || cargo install cargo-audit --locked
|
|
- name: "advisories: the check fails closed (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: ./scripts/check-advisories-selftest.sh
|
|
- name: "advisories: every advisory is fixed or allowed with a reason"
|
|
if: ${{ !cancelled() }}
|
|
run: python3 -I scripts/check-advisories.py
|
|
|
|
# ── Every test file is run by a job or listed with its reason ────────────
|
|
- name: "tests in CI: the check fails closed (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: ./scripts/check-tests-in-ci-selftest.sh
|
|
- name: "tests in CI: every test file is run or listed, and none can run empty"
|
|
if: ${{ !cancelled() }}
|
|
run: python3 -I scripts/check-tests-in-ci.py
|
|
|
|
# ── Every workflow supersedes its own queue; the path gate fails open ───
|
|
- name: "workflow hygiene: the check fails closed (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: ./scripts/check-workflow-concurrency-selftest.sh
|
|
- name: "workflow hygiene: every workflow is grouped per ref"
|
|
if: ${{ !cancelled() }}
|
|
run: ./scripts/check-workflow-concurrency.sh
|
|
- name: "workflow hygiene: the path gate fails open (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: ./scripts/pr-touches-paths-selftest.sh
|
|
|
|
# ── One pinned wasmtime, run with both determinism settings ─────────────
|
|
- name: "workflow hygiene: the wasmtime pin check fails closed (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: bash scripts/check-wasmtime-pin-selftest.sh
|
|
- name: "workflow hygiene: every wasmtime is the pinned release, run with both determinism settings"
|
|
if: ${{ !cancelled() }}
|
|
run: python3 -I scripts/check-wasmtime-pin.py
|
|
|
|
# ── Code cites no section its SPEC lacks; WAI's cited sections exist ────
|
|
- name: "spec references: the check can fail (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: bash scripts/check-spec-refs-selftest.sh
|
|
- name: "spec references: every SPEC citation resolves"
|
|
if: ${{ !cancelled() }}
|
|
run: python3 scripts/check-spec-refs.py
|
|
- name: "section references: every section WAI's documents cite exists"
|
|
if: ${{ !cancelled() }}
|
|
run: python scripts/check-wai-section-refs.py
|
|
|
|
# ── Every wai.quantum string is registered, listed or a schema's name ────
|
|
# The registry export (wai/registry/capabilities.json, generated from
|
|
# wai/wai-rs/src/codecs/registry.rs) and the quantum crates' schema files are the
|
|
# lists; this reads them and every text file, and names the file and line of any
|
|
# string neither accounts for (wai/REGISTRY.md).
|
|
- name: "quantum names: the check fails closed (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: bash scripts/check-wai-quantum-names-selftest.sh
|
|
- name: "quantum names: every wai.quantum string is registered, listed or a schema's name"
|
|
if: ${{ !cancelled() }}
|
|
run: python3 -I scripts/check-wai-quantum-names.py
|
|
|
|
# ── The lists wai-conformance.yml derives hold the hand lists they replaced ─
|
|
# Its feature lists, test lists, verifier steps, corpora and gate paths are read from
|
|
# the files that own them (.github/wai-conformance/, the tags of wai/wai-rs/tests/).
|
|
- name: "workflow lists: the derivation fails closed (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: bash scripts/wai-conformance-lists-selftest.sh
|
|
- name: "workflow lists: every derived list holds every entry of the hand list it replaced"
|
|
if: ${{ !cancelled() }}
|
|
run: python3 -I scripts/wai-conformance-lists.py selftest
|
|
|
|
# ── A change to WAI carries its changelog entry, in a file of its own ──────
|
|
# wai/changes/README.md states the form; the entries go into wai/CHANGELOG.md at a
|
|
# release (scripts/changelog-assemble.py). A pull request opened before the check
|
|
# reached main passes as it is; the check reads when it was opened from the event
|
|
# payload, and when the check reached main from the base's first-parent history.
|
|
- name: "changelog: the check and the assembler fail closed (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: bash scripts/changelog-fragments-selftest.sh
|
|
- name: "changelog: every entry file is one entry in the changelog's form"
|
|
if: ${{ !cancelled() }}
|
|
run: python3 -I scripts/changelog-assemble.py --check
|
|
- name: "changelog: a change to wai/ adds its entry (pull request)"
|
|
if: ${{ !cancelled() && github.event_name == 'pull_request' }}
|
|
run: |
|
|
git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
|
python3 -I scripts/check-changelog-fragment.py \
|
|
"${{ github.event.pull_request.base.sha }}" "${{ github.event.pull_request.head.sha }}"
|
|
|
|
# ── A rule committed before the runs it judges stays as it first reached main ──
|
|
# A research record's rule (wai/research/<record>/*-rule*.json) is worth what it is
|
|
# because it was fixed before the data, and a rule changed together with every copy of
|
|
# its digest passes every check that reads the tree alone. This reads the first-parent
|
|
# history from the start, so a cancelled run hides nothing: the next run finds the same
|
|
# change. The step below runs scripts/check-frozen-rules.sh as it first reached the
|
|
# history and as it stands, and that script runs scripts/check-frozen-rules.py the same
|
|
# way, so an edit of either script hides no change to a rule. The step itself is read
|
|
# from the commit under test: a commit that edits it silences this check from then on,
|
|
# until that edit is undone, and the diff in the history records it. A pull request is
|
|
# also compared with its base. The self-test runs the step's text from its marker on.
|
|
- name: "frozen rules: the check fails closed (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: bash scripts/check-frozen-rules-selftest.sh
|
|
- name: "frozen rules: every rule file is as it first reached main"
|
|
if: ${{ !cancelled() }}
|
|
run: |
|
|
set -euo pipefail
|
|
git config --global --add safe.directory "$GITHUB_WORKSPACE"
|
|
if [ "${{ github.event_name }}" = pull_request ]; then
|
|
set -- "${{ github.event.pull_request.head.sha }}" "${{ github.event.pull_request.base.sha }}"
|
|
else
|
|
set -- "${{ github.sha }}"
|
|
fi
|
|
# frozen rules: the runner as it first reached the history, then as it stands.
|
|
runner=scripts/check-frozen-rules.sh
|
|
first_add() { git log --first-parent -m --diff-filter=A --format=%H "$1" -- "$runner" | tail -n 1; }
|
|
first=$(first_add "$1" || true)
|
|
if [ -z "$first" ] && [ $# -eq 2 ]; then first=$(first_add "$2" || true); fi
|
|
if [ -z "$first" ]; then
|
|
echo "::error::frozen rules: no commit of the first-parent history of $* adds $runner"
|
|
exit 1
|
|
fi
|
|
copy=$(mktemp)
|
|
git show "$first:$runner" > "$copy"
|
|
rc=0
|
|
echo "frozen rules: the runner as it first reached this history, in $first"
|
|
bash "$copy" "$@" || rc=1
|
|
echo "frozen rules: the runner as this checkout holds it"
|
|
bash "$runner" "$@" || rc=1
|
|
rm -f "$copy"
|
|
exit $rc
|
|
|
|
# ── Public text: no vanity metrics, no comparison, no company names ─────
|
|
- name: "public text: no vanity metrics in committed Markdown"
|
|
if: ${{ !cancelled() }}
|
|
run: bash scripts/check-no-vanity-metrics.sh
|
|
- name: "public text: the two public-text checks fail closed (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: bash scripts/test-public-text-checks.sh
|
|
- name: "public text: WAI's public text names no comparison"
|
|
if: ${{ !cancelled() }}
|
|
run: bash scripts/check-comparative-prose.sh
|
|
# The maintainers' product names are public, held in the script itself: this run
|
|
# reads no secret, so it checks every change, a pull request included.
|
|
- name: "public text: WAI's public text names no product of its maintainers"
|
|
if: ${{ !cancelled() }}
|
|
run: bash scripts/check-public-names.sh --maintainer-products-only
|
|
# The pattern list is a secret, never given to pull-request code: the check runs
|
|
# on the push to main.
|
|
- name: "public text: WAI's public text names no company or product (push to main)"
|
|
if: ${{ !cancelled() && github.event_name != 'pull_request' }}
|
|
env:
|
|
WAI_NAME_DENYLIST: ${{ secrets.WAI_NAME_DENYLIST }}
|
|
run: |
|
|
if [ -z "$WAI_NAME_DENYLIST" ]; then
|
|
echo "::error::WAI_NAME_DENYLIST is not set: the public-name check cannot run"
|
|
exit 1
|
|
fi
|
|
bash scripts/check-public-names.sh
|
|
|
|
# ── Every vector of a corpus that keeps licence records has one ──────────
|
|
- name: "corpus licences: the check fails closed (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: bash scripts/check-wai-corpus-licences-selftest.sh
|
|
- name: "corpus licences: every vector has a record and a licence that permits redistribution"
|
|
if: ${{ !cancelled() }}
|
|
run: python3 -I scripts/check-wai-corpus-licences.py
|
|
|
|
# ── No library source file is unreachable from its crate root ───────────
|
|
# An orphan `.rs` (one no `mod`, `#[path]` or `include!` names) is never compiled,
|
|
# so nothing else in this repository can see it. Both directions, before trusting
|
|
# the result: a planted orphan must fail the check, and removing it must pass.
|
|
- name: "orphan sources: the check fails closed (self-test)"
|
|
if: ${{ !cancelled() }}
|
|
run: |
|
|
set -euo pipefail
|
|
probe=jcp/jcp-rs/crates/jcp-efficiency/src/_ci_orphan_probe.rs
|
|
printf 'pub fn never_compiled() -> u64 { 0 }\n' > "$probe"
|
|
if python3 scripts/check-orphan-sources.py >/dev/null 2>&1; then
|
|
rm -f "$probe"
|
|
echo "::error::the orphan check passed with a planted orphan present"
|
|
exit 1
|
|
fi
|
|
rm -f "$probe"
|
|
- name: "orphan sources: no new orphan source files"
|
|
if: ${{ !cancelled() }}
|
|
run: python3 scripts/check-orphan-sources.py
|