Repository navigation
fix: make the nest probe guard able to fail #22
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Provenance | |
| on: | |
| pull_request: | |
| schedule: | |
| # monthly, matching the cadence docs/PROVENANCE.md asks for | |
| - cron: "41 4 1 * *" | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| self-test: | |
| # "does the checker work" belongs on every change; "has upstream moved" | |
| # (the check job below) belongs on a schedule — different questions. | |
| # workflow_dispatch is included here, rather than duplicating this job's | |
| # bats step inside check, so a manual run exercises both jobs. | |
| if: ${{ github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Setup mise | |
| uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 | |
| # tests/provenance.bats needs a local upstream clone the same as | |
| # check does below — its own copy here, the way adapters.yml's | |
| # tier-b matrix legs each do their own generation independently. | |
| - name: Clone upstream immich | |
| run: git clone --filter=blob:none --no-checkout https://github.com/immich-app/immich.git "${RUNNER_TEMP}/immich" | |
| - name: Run the provenance self-test | |
| env: | |
| SCAFFOLD_UPSTREAM_CLONE: ${{ runner.temp }}/immich | |
| run: bats tests/provenance.bats | |
| check: | |
| if: ${{ github.event_name != 'pull_request' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| issues: write | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| # check-provenance.sh has no network fallback of its own (a denied | |
| # fetch must fail loudly, not read as "everything drifted"); a | |
| # partial clone gets the full commit graph without every blob. | |
| - name: Clone upstream immich | |
| run: git clone --filter=blob:none --no-checkout https://github.com/immich-app/immich.git "${RUNNER_TEMP}/immich" | |
| - name: Check for upstream drift | |
| id: check | |
| env: | |
| SCAFFOLD_UPSTREAM_CLONE: ${{ runner.temp }}/immich | |
| run: ./scripts/check-provenance.sh | tee "${RUNNER_TEMP}/report.txt" | |
| # a bare custom if: is implicitly ANDed with success() — on a real | |
| # check failure the job is already failing, success() is false, and | |
| # this step would silently never run. failure() first makes the | |
| # step eligible; steps.check.outcome narrows it to the real check | |
| # specifically, not some other step failing. | |
| - name: Open an issue for upstream drift | |
| if: failure() && steps.check.outcome == 'failure' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh issue create --repo "${{ github.repository }}" --title "upstream drift detected" \ | |
| --body-file "${RUNNER_TEMP}/report.txt" |