2026-10-18 12:37:05 +02:00
|
|
|
# RPF-WP-0061-T03: self-service CCR intake gate.
|
|
|
|
|
# ccr/* branches: exactly one new in-profile CCR (+ its new policy file) from a
|
|
|
|
|
# listed submitter, nothing else changed. main: post-merge id uniqueness.
|
|
|
|
|
# Source comes from the exact-revision archive, as in keycape-factor-acceptance.
|
|
|
|
|
name: CCR intake gate
|
|
|
|
|
on:
|
|
|
|
|
push:
|
|
|
|
|
branches: ["ccr/**", main]
|
|
|
|
|
workflow_dispatch:
|
|
|
|
|
jobs:
|
|
|
|
|
gate:
|
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
|
container:
|
|
|
|
|
image: python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
|
|
|
|
|
steps:
|
|
|
|
|
- name: Fetch exact revision and main
|
|
|
|
|
run: |
|
|
|
|
|
set -eu
|
|
|
|
|
python3 - <<'PYCODE'
|
|
|
|
|
import os,tarfile,tempfile,urllib.request
|
|
|
|
|
from pathlib import Path
|
|
|
|
|
base='https://forgejo.coulomb.social/'+os.environ['GITHUB_REPOSITORY']+'/archive/'
|
|
|
|
|
for name,ref in (('branch',os.environ['GITHUB_SHA']),('main','main')):
|
|
|
|
|
root=Path('/tmp/ccr-intake')/name;root.mkdir(parents=True)
|
|
|
|
|
with urllib.request.urlopen(base+ref+'.tar.gz',timeout=30) as response,tempfile.TemporaryFile() as archive:
|
|
|
|
|
archive.write(response.read());archive.seek(0)
|
|
|
|
|
with tarfile.open(fileobj=archive,mode='r:gz') as tar:tar.extractall(root,filter='data')
|
|
|
|
|
PYCODE
|
2026-10-18 12:39:38 +02:00
|
|
|
pip install --quiet --disable-pip-version-check --root-user-action=ignore --timeout 60 pyyaml==6.0.2 jsonschema==4.23.0
|
2026-10-18 12:37:05 +02:00
|
|
|
- name: Gate ccr branch
|
|
|
|
|
if: startsWith(github.ref, 'refs/heads/ccr/')
|
|
|
|
|
run: |
|
|
|
|
|
set -eu
|
|
|
|
|
cd /tmp/ccr-intake/branch/*
|
|
|
|
|
main_root=$(echo /tmp/ccr-intake/main/*)
|
|
|
|
|
PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s tests -p 'test_ccr_intake.py'
|
|
|
|
|
python3 scripts/credential-change.py check-branch --branch "$GITHUB_REF" --main-root "$main_root"
|
|
|
|
|
- name: Check CCR ids on main
|
|
|
|
|
if: github.ref == 'refs/heads/main'
|
|
|
|
|
run: |
|
|
|
|
|
set -eu
|
|
|
|
|
cd /tmp/ccr-intake/branch/*
|
|
|
|
|
python3 scripts/credential-change.py check-ids
|
