docs: Update projects #3724
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: 2026 The RISE Project | |
| # SPDX-License-Identifier: MIT | |
| name: PR verification checks | |
| on: | |
| # 'edited' (title/body changes alone) is added so that stripping an | |
| # auto-injected AI-attribution footer from a PR body re-runs the check | |
| # against the fixed body. Without it, editing the body doesn't retrigger | |
| # the workflow, and re-running the same job replays the original event | |
| # payload, so the check just fails again against the stale text — this | |
| # cost two ports a close-and-reopen of their own PR to get a fresh event. | |
| pull_request: | |
| types: [opened, synchronize, reopened, edited] | |
| jobs: | |
| check_commit_messages: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Reject revertme / DO NOT MERGE commits | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| range="$BASE_SHA..$HEAD_SHA" | |
| if git log --pretty=format:%s "$range" | grep -i -e '^revertme' -e '^revert me'; then | |
| echo "::error::Merge request contains at least a commit starting with a 'revert me' tag. Fix it before merging." | |
| exit 1 | |
| fi | |
| if git log --pretty=format:%s "$range" | grep -i -e '^DO NOT MERGE'; then | |
| echo "::error::Merge request contains at least a commit starting with a 'DO NOT MERGE' tag. Review it." | |
| exit 1 | |
| fi | |
| - name: Reject AI-attributed commits | |
| # Catches what the local commit-msg/pre-push hooks | |
| # (ci_scripts/git-hooks/, ci_scripts/check_no_ai_attribution.sh) exist to | |
| # prevent, for a clone that never installed them. | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| status=0 | |
| for commit in $(git rev-list "$BASE_SHA..$HEAD_SHA"); do | |
| if ! git log --format=%B -1 "$commit" | ci_scripts/check_no_ai_attribution.sh -; then | |
| echo "::error::Commit $commit attributes work to an AI tool; see the message above." | |
| status=1 | |
| fi | |
| done | |
| exit $status | |
| - name: Reject an AI-attributed PR title or body | |
| # A different leak vector from the commit-message one above: a PR-creation | |
| # tool can silently append its own "Generated by ..." footer to the PR | |
| # description (or title) without touching any commit message, so the | |
| # commit-scanning check above never sees it. Pass title/body through env, | |
| # never interpolated into the script text, since both are attacker- | |
| # (or tool-) controlled. | |
| env: | |
| PR_TITLE: ${{ github.event.pull_request.title }} | |
| PR_BODY: ${{ github.event.pull_request.body }} | |
| run: | | |
| set -euo pipefail | |
| status=0 | |
| if ! printf '%s' "$PR_TITLE" | ci_scripts/check_no_ai_attribution.sh -; then | |
| echo "::error::The PR title attributes work to an AI tool; see the message above." | |
| status=1 | |
| fi | |
| if ! printf '%s' "$PR_BODY" | ci_scripts/check_no_ai_attribution.sh -; then | |
| echo "::error::The PR description attributes work to an AI tool; see the message above." | |
| status=1 | |
| fi | |
| exit $status | |
| check_patches: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: '3' | |
| - name: Validate Upstream-Status in added/modified patches | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: python ci_scripts/check_patch.py "$BASE_SHA" "$HEAD_SHA" | |
| check_packages_yaml: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 | |
| with: | |
| enable-cache: false | |
| - name: Validate changed docs/packages/*.yaml and their build workflows | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| ret=0 | |
| for path in $(git diff --name-only --diff-filter=ACMR "$BASE_SHA" "$HEAD_SHA" -- 'docs/packages/*.yaml'); do | |
| uv run --quiet ci_scripts/pending_versions.py --check "$(basename "$path" .yaml)" || ret=1 | |
| done | |
| for path in $(git diff --name-only --diff-filter=ACMR "$BASE_SHA" "$HEAD_SHA" -- '.github/workflows/build-*.yml' '.github/workflows/test-*.yml'); do | |
| package=$(sed -En 's/^[[:space:]]+package:[[:space:]]*([^ #]+).*/\1/p' "$path" | head -n1) | |
| if [[ -z "$package" ]]; then | |
| echo "::error file=$path::the setup job must call _setup.yml with a package: input" | |
| ret=1 | |
| elif [[ ! -f "docs/packages/$package.yaml" ]]; then | |
| echo "::error file=$path::docs/packages/$package.yaml does not exist; add it with the versions to build" | |
| ret=1 | |
| fi | |
| done | |
| exit $ret |