crosscheck: mechanical consistency across the yukart repos

Decisions, topics, doc references, deployed binaries and front matter, each checked against the repo that owns the fact. A reusable workflow runs it from every repo on push. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz
2026-10-13 00:36:20 +09:00
commit 2401663b4b
4 changed files with 370 additions and 0 deletions
@@ -0,0 +1,45 @@
+# The reusable half. Every yukart repo calls this on push (see caller/crosscheck.yml):
+# it clones every repo of the org at master, puts the caller at the commit that was
+# pushed, and runs crosscheck.py over the lot. A finding fails the caller's run, on
+# the commit that introduced it.
+on:
+  workflow_call:
+    inputs:
+      repo:
+        description: "The calling repository's name"
+        required: true
+        type: string
+      sha:
+        description: "The commit pushed to it"
+        required: true
+        type: string
+
+jobs:
+  crosscheck:
+    # The yukart org's runner on halogen (host mode). Needs only git, curl and python3.
+    runs-on: flutter-android
+    steps:
+      - name: Clone every yukart repo
+        env:
+          # YUKART_READ_TOKEN (org secret, read-only) reaches the private repos; without it
+          # only the public ones are checked, and the run says so.
+          TOKEN: ${{ secrets.YUKART_READ_TOKEN }}
+          SERVER: ${{ gitea.server_url }}
+        run: |
+          set -euo pipefail
+          rm -rf ws && mkdir ws
+          host="${SERVER#*://}"; scheme="${SERVER%%://*}"
+          auth=(); [ -n "$TOKEN" ] && auth=(-H "Authorization: token $TOKEN")
+          repos=$(curl -fsS "${auth[@]}" "$SERVER/api/v1/orgs/yukart/repos?limit=50" \
+                  | python3 -c 'import json,sys; print(" ".join(r["name"] for r in json.load(sys.stdin) if not r["archived"]))')
+          [ -n "$TOKEN" ] || echo "::warning::no YUKART_READ_TOKEN: private repos are not checked"
+          for r in $repos; do
+            url="$scheme://${TOKEN:+crosscheck:$TOKEN@}$host/yukart/$r.git"
+            git clone -q --depth 1 "$url" "ws/$r"
+          done
+          git -C "ws/${{ inputs.repo }}" fetch -q --depth 1 origin "${{ inputs.sha }}"
+          git -C "ws/${{ inputs.repo }}" checkout -q FETCH_HEAD
+          echo "checking: $repos"
+
+      - name: Crosscheck
+        run: python3 ws/tool-crosscheck/crosscheck.py ws