netscript/.github/workflows/code-quality.yml at main · rickylabs/netscript · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
name: Code quality

# Draft PR pushes schedule no quality work. The ready flip and subsequent
# non-draft pushes materialize the gate.

on:
  pull_request:
    types: [opened, synchronize, reopened, ready_for_review]
    paths:
      - 'packages/**'
      - '!packages/**/*.md'
      - '!packages/**/*.mdx'
      - 'plugins/**'
      - '!plugins/**/*.md'
      - '!plugins/**/*.mdx'
      - '.llm/tools/**'
      - 'deno.json'
  push:
    branches: [main]
  schedule:
    # Weekly repo-wide drift scan (Mon 07:17 UTC) so unchanged-file drift on
    # main is surfaced even when no PR touches it.
    - cron: '17 7 * * 1'

permissions:
  contents: read

jobs:
  # PR gate — blocking. Scans only the files the PR changed.
  code-quality:
    if: github.event_name == 'pull_request' && github.event.pull_request.draft == false
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - uses: denoland/setup-deno@v2
        with:
          deno-version: v2.9.5
      - name: Require an issue link for allowance budget increases
        run: >-
          deno run --allow-read --allow-write --allow-run --allow-env
          .llm/tools/gates/run-gate.ts --gate allowance-budget --id code-quality-allowance
          --output .llm/tmp/gate-receipts/code-quality/allowance.json --
          "${{ github.event.pull_request.base.sha }}" "${{ github.event.pull_request.head.sha }}" --pretty
      - name: Scan changed source files
        shell: bash
        run: |
          changed_files=$(deno run --allow-run .llm/tools/quality/changed-source-files.ts "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}")
          mapfile -t files <<< "$changed_files"
          args=()
          for file in "${files[@]}"; do args+=(--changed-file "$file"); done
          deno run --allow-read --allow-write --allow-run --allow-env \
            .llm/tools/gates/run-gate.ts --gate quality-scan --id code-quality-scan \
            --output .llm/tmp/gate-receipts/code-quality/scan.json -- --pretty "${args[@]}"
      - name: Architecture check
        run: >-
          deno run --allow-read --allow-write --allow-run --allow-env
          .llm/tools/gates/run-gate.ts --gate arch-check --id code-quality-arch
          --output .llm/tmp/gate-receipts/code-quality/arch.json
      - name: Lint changed publish surfaces
        run: |
          deno run --allow-read --allow-write --allow-run --allow-env \
            .llm/tools/gates/run-gate.ts --gate doc-lint --id code-quality-cli-docs \
            --output .llm/tmp/gate-receipts/code-quality/cli-docs.receipt.json \
            --child-report .llm/tmp/gate-receipts/code-quality/cli-docs.report.json -- \
            --root packages/cli --output .llm/tmp/gate-receipts/code-quality/cli-docs.report.json --pretty
          deno run --allow-read --allow-write --allow-run --allow-env \
            .llm/tools/gates/run-gate.ts --gate public-doc-lint --id code-quality-plugin-docs \
            --output .llm/tmp/gate-receipts/code-quality/plugin-docs.json -- \
            packages/plugin/src/config/mod.ts packages/plugin/src/protocol/mod.ts
      - name: Upload code-quality gate receipts
        if: always()
        uses: actions/upload-artifact@v5
        with:
          name: ${{ github.workflow }}-${{ github.job }}-gate-receipts-${{ github.run_id }}-${{ github.run_attempt }}
          path: .llm/tmp/gate-receipts/code-quality/*.json
          if-no-files-found: error

  # Blocking repo-wide drift scan on push-to-main + schedule.
  code-quality-repo:
    if: github.event_name != 'pull_request'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: denoland/setup-deno@v2
        with:
          deno-version: v2.9.5
      - name: Repo-wide quality scan
        run: >-
          deno run --allow-read --allow-write --allow-run --allow-env
          .llm/tools/gates/run-gate.ts --gate quality-scan-repo --id code-quality-repo-scan
          --output .llm/tmp/gate-receipts/code-quality-repo/scan.json -- --pretty
      - name: Upload repo-wide quality receipt
        if: always()
        uses: actions/upload-artifact@v5
        with:
          name: ${{ github.workflow }}-${{ github.job }}-gate-receipts-${{ github.run_id }}-${{ github.run_attempt }}
          path: .llm/tmp/gate-receipts/code-quality-repo/*.json
          if-no-files-found: error