archvillainetteandClaude Opus 5
f3ca6be698
ci / ci (pull_request) Successful in 3m6s
Gitea has no release-asset retention, so every v* tag kept its full cross-platform binary set forever — 31 tags had accumulated 1.8 GB on the production host disk. Nothing consumes an old asset: CI takes the Crucible binary from the Nix flake, and every deleted file is reproducible from its tag. scripts/prune-release-assets.sh lists every release page, sorts by creation date, skips the newest two published releases, and deletes the remaining releases' attachments. Two rather than one so a release in flight never leaves the previous download broken. Drafts never consume a keep slot. Releases, tags, source archives and release notes are untouched. Nothing is excluded — SHA256SUMS and the wrappers go with the binaries: the checksums are only meaningful next to the files they cover, and the consumer drift-check reads the wrappers from the latest release, which stays complete. The step is best-effort: a stale asset is cheaper than a blocked publish, so API failures warn and the step carries continue-on-error. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
87 lines
3.6 KiB
Bash
Executable File
87 lines
3.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
contract_script="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/$(basename "${BASH_SOURCE[0]}")"
|
|
default_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
repo_root="${WORKFLOW_ROOT:-$default_root}"
|
|
cd "$repo_root"
|
|
|
|
ci=.gitea/workflows/ci.yml
|
|
release=.gitea/workflows/build-binaries.yml
|
|
sync=.gitea/workflows/sync-wrappers.yml
|
|
checkout='actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683'
|
|
|
|
assert_exact_events() {
|
|
local workflow="$1" expected="$2" actual
|
|
actual="$(awk '
|
|
/^on:$/ { in_on = 1 }
|
|
in_on && /^$/ { next }
|
|
in_on && $0 != "on:" && $0 !~ /^[[:space:]]/ { exit }
|
|
in_on { print }
|
|
' "$workflow")"
|
|
[[ "$actual" == "$expected" ]] || {
|
|
echo "workflow-contract: unexpected event scope in $workflow" >&2
|
|
return 1
|
|
}
|
|
}
|
|
|
|
[[ -f "$ci" ]] || { echo "missing consolidated CI workflow" >&2; exit 1; }
|
|
[[ ! -e .gitea/workflows/test.yml ]] || { echo "legacy test workflow still present" >&2; exit 1; }
|
|
|
|
assert_exact_events "$ci" $'on:\n pull_request:'
|
|
grep -Fqx 'permissions: read-all' "$ci"
|
|
grep -Fqx ' timeout-minutes: 60' "$ci"
|
|
[[ "$(grep -Fc "$checkout" "$ci")" -eq 1 ]]
|
|
grep -Fqx ' fetch-depth: 0' "$ci"
|
|
grep -Fq 'go vet ./...' "$ci"
|
|
grep -Fq 'go test ./...' "$ci"
|
|
grep -Fq 'shellcheck scripts/*.sh' "$ci"
|
|
grep -Fq 'yamllint .gitea' "$ci"
|
|
grep -Fq 'make smoke' "$ci"
|
|
grep -Fq 'for target in linux/amd64 linux/arm64 darwin/amd64 darwin/arm64 windows/amd64 windows/arm64; do' "$ci"
|
|
|
|
assert_exact_events "$release" $'on:\n push:\n tags: [\'v*\']'
|
|
grep -Fqx ' code: read' "$release"
|
|
grep -Fqx ' releases: write' "$release"
|
|
grep -Fqx ' timeout-minutes: 30' "$release"
|
|
[[ "$(grep -Fc "$checkout" "$release")" -eq 1 ]]
|
|
grep -Fq 'secrets.GITEA_TOKEN' "$release"
|
|
grep -Fq 'scripts/prune-release-assets.sh' "$release"
|
|
grep -Fq 'continue-on-error: true' "$release"
|
|
if grep -Fq 'secrets.GITHUB_TOKEN' "$release"; then
|
|
echo "workflow-contract: release uses the GitHub token alias" >&2
|
|
exit 1
|
|
fi
|
|
|
|
grep -Fqx 'permissions: read-all' "$sync"
|
|
grep -Fqx ' timeout-minutes: 30' "$sync"
|
|
[[ "$(grep -Fc "$checkout" "$sync")" -eq 1 ]]
|
|
assert_exact_events "$sync" $'on:\n push:\n branches: [main]\n paths:\n - \'wrappers/crucible.sh\'\n - \'wrappers/crucible.ps1\''
|
|
|
|
expect_mutation_rejected() {
|
|
local name="$1" workflow="$2" expression="$3" tmp
|
|
tmp="$(mktemp -d)"
|
|
mkdir -p "$tmp/.gitea"
|
|
cp -R "$default_root/.gitea/workflows" "$tmp/.gitea/workflows"
|
|
sed -i "$expression" "$tmp/$workflow"
|
|
if WORKFLOW_ROOT="$tmp" WORKFLOW_CONTRACT_MUTATION=1 bash "$contract_script" >/dev/null 2>&1; then
|
|
echo "workflow-contract: accepted forbidden mutation: $name" >&2
|
|
rm -rf "$tmp"
|
|
return 1
|
|
fi
|
|
rm -rf "$tmp"
|
|
}
|
|
|
|
if [[ "${WORKFLOW_CONTRACT_MUTATION:-0}" != 1 ]]; then
|
|
mutations_ok=0
|
|
expect_mutation_rejected 'CI workflow_dispatch event' "$ci" '/^ pull_request:$/a\ workflow_dispatch:' || mutations_ok=1
|
|
expect_mutation_rejected 'release develop branch' "$release" "/^ tags:/a\\ branches: [develop]" || mutations_ok=1
|
|
expect_mutation_rejected 'release schedule event' "$release" "/^ tags:/a\\ schedule:\n - cron: '0 0 * * *'" || mutations_ok=1
|
|
expect_mutation_rejected 'release extra tag pattern' "$release" "s/tags: \['v\*'\]/tags: ['v*', 'release-*']/" || mutations_ok=1
|
|
expect_mutation_rejected 'wrapper sync pull_request event' "$sync" '/^ push:$/i\ pull_request:' || mutations_ok=1
|
|
expect_mutation_rejected 'wrapper sync broad path' "$sync" "/^ - 'wrappers\/crucible.ps1'$/a\\ - 'wrappers/**'" || mutations_ok=1
|
|
(( mutations_ok == 0 )) || exit 1
|
|
fi
|
|
|
|
echo "workflow-contract: CI is PR-only; release and wrapper sync retain their narrow triggers"
|