mikkeli
667678b9ae
/ crosscheck (push) Successful in 1s
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DDwfd6Ki8UfG4hK6W5YpJz
45 lines
1.8 KiB
YAML
45 lines
1.8 KiB
YAML
# The reusable half. Every yukart repo calls this on push (see caller/crosscheck.yml):
|
|
# it clones every repo of the org at master, puts the caller at the commit that was
|
|
# pushed, and runs crosscheck.py over the lot. A finding fails the caller's run, on
|
|
# the commit that introduced it.
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
repo:
|
|
description: "The calling repository's name"
|
|
required: true
|
|
type: string
|
|
sha:
|
|
description: "The commit pushed to it"
|
|
required: true
|
|
type: string
|
|
|
|
jobs:
|
|
crosscheck:
|
|
# halogen-yukart, the org's runner on halogen (host mode). Needs only git, curl and python3.
|
|
runs-on: halogen
|
|
steps:
|
|
- name: Clone every yukart repo
|
|
env:
|
|
# Every yukart repo is public, so no token is needed. Should one become private,
|
|
# an org secret YUKART_READ_TOKEN (read-only) lets this clone it again.
|
|
TOKEN: ${{ secrets.YUKART_READ_TOKEN }}
|
|
SERVER: ${{ gitea.server_url }}
|
|
run: |
|
|
set -euo pipefail
|
|
rm -rf ws && mkdir ws
|
|
host="${SERVER#*://}"; scheme="${SERVER%%://*}"
|
|
auth=(); [ -n "$TOKEN" ] && auth=(-H "Authorization: token $TOKEN")
|
|
repos=$(curl -fsS "${auth[@]}" "$SERVER/api/v1/orgs/yukart/repos?limit=50" \
|
|
| python3 -c 'import json,sys; print(" ".join(r["name"] for r in json.load(sys.stdin) if not r["archived"]))')
|
|
for r in $repos; do
|
|
url="$scheme://${TOKEN:+crosscheck:$TOKEN@}$host/yukart/$r.git"
|
|
git clone -q --depth 1 "$url" "ws/$r"
|
|
done
|
|
git -C "ws/${{ inputs.repo }}" fetch -q --depth 1 origin "${{ inputs.sha }}"
|
|
git -C "ws/${{ inputs.repo }}" checkout -q FETCH_HEAD
|
|
echo "checking: $repos"
|
|
|
|
- name: Crosscheck
|
|
run: python3 ws/tool-crosscheck/crosscheck.py ws
|