Repository navigation
fix(python): preserve Unicode import aliases #158
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Corpus | |
| permissions: | |
| contents: read | |
| on: | |
| schedule: | |
| # Nightly, off the top of the hour. This is the clock the #173/#178 cap | |
| # lift criterion counts: 14 consecutive green runs (streak comment on | |
| # #172, published by the streak job below). | |
| - cron: "17 3 * * *" | |
| workflow_dispatch: | |
| pull_request: | |
| # Fires on every PR so the corpus check can become required without | |
| # blocking non-corpus PRs on a never-reported status (#172). The changes | |
| # job gates the expensive scan to corpus-relevant paths; a skipped job | |
| # reports Success, so promotion is a one-line flip: mark the `corpus` | |
| # check required in the main ruleset. Gating fails closed: if the | |
| # changes job does not succeed, the corpus job runs and fails rather | |
| # than satisfying a required check with no scan. See | |
| # docs/corpus-promotion.md. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| # Which corpus-relevant paths this PR touches. The full scan runs only when | |
| # one of these changes - engine code, the harness, the corpus itself, or | |
| # the dependency surface the detectors see. The path list lives in | |
| # scripts/corpus-gate.mjs, pinned by scripts/corpus-gate.test.mjs. | |
| changes: | |
| name: changes | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| corpus: ${{ steps.filter.outputs.corpus }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - id: filter | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| run: | | |
| # Checked BEFORE writing GITHUB_OUTPUT: under the runner's | |
| # bash -eo pipefail, a failed diff fails this step (fail closed), | |
| # never a swallowed substitution writing corpus=false (#172). | |
| relevant=$(git diff --name-only "${BASE_SHA}...HEAD" | node scripts/corpus-gate.mjs) | |
| echo "corpus=${relevant}" >> "$GITHUB_OUTPUT" | |
| corpus: | |
| name: corpus | |
| needs: changes | |
| # Scan on schedule/dispatch, on relevant PRs, and - fail closed - on any | |
| # PR whose gating did not succeed. Otherwise skip, which reports Success. | |
| if: ${{ always() && (github.event_name != 'pull_request' || needs.changes.outputs.corpus == 'true' || needs.changes.result != 'success') }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Fail closed when path gating did not succeed | |
| if: github.event_name == 'pull_request' && needs.changes.result != 'success' | |
| run: | | |
| echo "error: the changes job did not succeed, so corpus relevance is unknown - failing closed rather than passing unscanned (#172)" >&2 | |
| exit 1 | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6 | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 | |
| with: | |
| node-version: 22 | |
| cache: pnpm | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm build | |
| - run: node scripts/corpus.mjs | |
| # Publishes the machine-visible streak for the cap-lift clock (#172). | |
| # Stateless: recomputed from scheduled-run history every night, so its own | |
| # failure can never corrupt the streak it reports. | |
| streak: | |
| name: streak | |
| if: github.event_name == 'schedule' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read # Read scheduled corpus runs to compute the streak. | |
| issues: write # Update the streak comment on #172. | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7 | |
| with: | |
| node-version: 22 | |
| - run: node scripts/corpus-streak.mjs | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |