87 lines
3.1 KiB
YAML
87 lines
3.1 KiB
YAML
name: Validate Registry on PR
|
|
|
|
# Contributor code must run only with a read-only token and no secrets.
|
|
# Never change this workflow back to pull_request_target while it checks out
|
|
# and executes pull-request code.
|
|
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
- dev
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
validate-and-update:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
|
|
steps:
|
|
- name: Checkout code without persisted credentials
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Install system dependencies
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y jq
|
|
|
|
- name: Install Bun
|
|
uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: latest
|
|
|
|
- name: Install project dependencies
|
|
run: bun install --frozen-lockfile
|
|
|
|
- name: Make validation scripts executable
|
|
run: |
|
|
chmod +x scripts/registry/validate-registry.sh
|
|
chmod +x scripts/registry/auto-detect-components.sh
|
|
chmod +x scripts/registry/register-component.sh
|
|
chmod +x scripts/prompts/validate-pr.sh
|
|
|
|
- name: Report registry drift
|
|
id: registry_drift
|
|
run: |
|
|
./scripts/registry/auto-detect-components.sh --dry-run > /tmp/detect-output.txt 2>&1
|
|
cat /tmp/detect-output.txt
|
|
sed $'s/\033\\[[0-9;]*m//g' /tmp/detect-output.txt > /tmp/detect-output-plain.txt
|
|
|
|
if grep -Eq 'New Components:[[:space:]]*[1-9][0-9]*([[:space:]]|$)' /tmp/detect-output-plain.txt; then
|
|
echo "drift_detected=true" >> "$GITHUB_OUTPUT"
|
|
echo "## Registry drift detected" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "The repository already contains components not represented in registry.json." >> "$GITHUB_STEP_SUMMARY"
|
|
echo "This is reported but does not block security validation until the existing drift is reconciled." >> "$GITHUB_STEP_SUMMARY"
|
|
else
|
|
echo "drift_detected=false" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
|
|
- name: Validate prompt library structure
|
|
run: ./scripts/prompts/validate-pr.sh
|
|
|
|
- name: Validate markdown context links
|
|
run: npm run validate:context-links
|
|
|
|
- name: Validate registry
|
|
run: npm run validate:registry
|
|
|
|
- name: Validation summary
|
|
if: success()
|
|
run: |
|
|
echo "## All registry validations passed" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "- Prompt library structure is valid" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "- Context markdown links are valid" >> "$GITHUB_STEP_SUMMARY"
|
|
echo "- Registry paths and dependencies are valid" >> "$GITHUB_STEP_SUMMARY"
|
|
if [ "${{ steps.registry_drift.outputs.drift_detected }}" = "true" ]; then
|
|
echo "- Existing registry drift was reported separately" >> "$GITHUB_STEP_SUMMARY"
|
|
else
|
|
echo "- No unregistered components were detected" >> "$GITHUB_STEP_SUMMARY"
|
|
fi
|