forked from heavy-duty/ceremony
4fd78615b3
Round 1's shared blocking catch: release-exercise's call job proves the parse but executes no steps (both doors are push-gated, by design), and fixture-chain drives the scripts, not the workflow. The new step-replay job executes the merge door's early sequence for real — both checkout shapes including path: .ceremony-src, both branches of the bypass via a matrix standing in for the repository test, the CEREMONY_DIR wiring, and facts → decide → notes through genuine $GITHUB_OUTPUT plumbing — against a fixture tree with a stubbed gh. Wired into PR CI as standing evidence; PR-only, because a push-to-main workflow_call would hand release.yml the merge door's exact gate. release.yml's honest-gap paragraph narrows to what stays untested until #11: the doors themselves. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
74 lines
2.9 KiB
YAML
74 lines
2.9 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
push:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Shellcheck
|
|
run: bash .github/scripts/shellcheck-all.sh
|
|
- name: Install actionlint
|
|
env:
|
|
ACTIONLINT_VERSION: 1.7.12
|
|
run: |
|
|
curl -fsSLo actionlint.tar.gz \
|
|
"https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
|
|
tar -xzf actionlint.tar.gz actionlint
|
|
sudo install actionlint /usr/local/bin/actionlint
|
|
- name: Actionlint
|
|
run: bash .github/scripts/actionlint-all.sh
|
|
- name: Self-ref pin
|
|
# The pin rules (issue #9; #1 D3): a stale CEREMONY_SELF_REF fails
|
|
# CI here, not a consumer's release.
|
|
run: bash .github/scripts/self-ref-check.sh
|
|
- name: Tests
|
|
env:
|
|
# The npm-backed version_write case may skip locally when npm is
|
|
# absent; in CI a skip must be a failure, or the case could
|
|
# quietly stop running (issue #3's test contract).
|
|
CEREMONY_REQUIRE_NPM: 1
|
|
run: bash test/run.sh
|
|
|
|
# The release exercise (issue #9's scratch caller) on every PR, so the
|
|
# parse proof and the merge door's step-replay are standing, reviewable
|
|
# evidence — not a dispatch someone must remember to run. PR-ONLY, and
|
|
# the gate is load-bearing: this CI also runs on push to main, and a
|
|
# workflow_call from THAT context would hand release.yml a genuine
|
|
# push+refs/heads/main event — the merge door's exact gate — opening a
|
|
# live door from CI. A pull_request event can never satisfy either
|
|
# door's `if:`.
|
|
release-exercise:
|
|
if: github.event_name == 'pull_request'
|
|
uses: ./.github/workflows/release-exercise.yml
|
|
|
|
# Exercises the composite actions the way a consumer does — action.yml
|
|
# resolving, $GITHUB_ACTION_PATH, the relative lib sourcing — which the
|
|
# test suite, driving the scripts directly, cannot prove (issue #5's
|
|
# acceptance criterion).
|
|
action-exercise:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Construct an armed scratch tree in the workspace
|
|
# This repo carries no VERSION or CHANGELOG.md of its own (until
|
|
# #11 dogfoods); the guard reads the workspace, so give it a
|
|
# transient armed tree there. The changelog is scratch-named so a
|
|
# future real CHANGELOG.md is never shadowed; VERSION cannot be —
|
|
# the file backend hardcodes it — so if #11 ever adds a real one,
|
|
# this write must go.
|
|
run: |
|
|
printf '0.0.1-dev\n' > VERSION
|
|
printf '# Changelog\n\n## Unreleased\n\n- Scratch entry.\n' > CHANGELOG.scratch.md
|
|
- uses: ./actions/changelog-armed
|
|
with:
|
|
changelog: CHANGELOG.scratch.md
|