pr-quality.yml

---
name: PR Quality (soft)
on:
  pull_request:
    types: [opened, synchronize, reopened, labeled, unlabeled, edited]
  workflow_dispatch:
permissions:
  contents: read
  packages: read
  pull-requests: read
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.head_ref || github.ref }}
  cancel-in-progress: true
jobs:
  # All three jobs are `continue-on-error: true` for the first ~2 weeks after
  # this workflow lands, so we can tune the parsers + matrix gates without
  # blocking merges. Flip to hard-fail once the false-positive rate is stable.
  checklist-guard:
    name: PR Submission Checklist
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    container:
      image: ghcr.io/tinyhumansai/openhuman_ci:latest
    continue-on-error: true
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'docs') && !contains(github.event.pull_request.labels.*.name, 'chore') }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 1
      - name: Verify Submission Checklist
        env:
          PR_BODY: ${{ github.event.pull_request.body }}
        run: node scripts/check-pr-checklist.mjs
  coverage-matrix:
    name: Coverage Matrix Sync
    runs-on: ubuntu-22.04
    timeout-minutes: 10
    container:
      image: ghcr.io/tinyhumansai/openhuman_ci:latest
    continue-on-error: true
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'docs') && !contains(github.event.pull_request.labels.*.name, 'chore') }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 1
      - name: Verify Coverage Matrix
        run: node scripts/check-coverage-matrix.mjs
  markdown-link-check:
    name: Markdown Link Check
    runs-on: ubuntu-latest
    timeout-minutes: 10
    continue-on-error: true
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'docs') && !contains(github.event.pull_request.labels.*.name, 'chore') }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 1
      - name: Lychee link check
        id: link-check
        continue-on-error: true
        uses: lycheeverse/lychee-action@v2
        with:
          output: target/link-check/report.md
          # Product Hunt denies GitHub-hosted runners (403) for the translated
          # README badge destination, so it cannot be a stable external-link
          # check.
          # `openhuman-skills` and `homebrew-openhuman` answer 404 to an
          # anonymous request, so neither is a stable external-link check from
          # a runner even though both are linked deliberately.
          # The managed Discord vanity endpoint currently returns 404 before
          # forwarding anonymous requests; keep checking all other links until
          # its provider-side redirect is restored.
          # GitHub intermittently returns 503 when the docs check fans out.
          # Limit the request burst; unsuccessful responses still fail the check.
          args: >-
            --no-progress
            --max-concurrency 4
            --include-fragments
            --exclude '^http://localhost'
            --exclude '^https?://127\.0\.0\.1'
            --exclude '^https://github\.com/tinyhumansai/homebrew-openhuman'
            --exclude '^https://github\.com/tinyhumansai/openhuman-skills'
            --exclude '^https://www\.reddit\.com/r/tinyhumansai/?$'
            --exclude '^https://www\.star-history\.com/#tinyhumansai/openhuman&type=date&legend=top-left$'
            --exclude '^https://github\.com/tinyhumansai/openhuman/stargazers'
            --exclude '^https://api\.star-history\.com/'
            --exclude '^https://x\.com/karpathy/status/2039805659525644595$'
            --exclude '^https://x\.com/intent/follow'
            --exclude '^https://www\.producthunt\.com/'
            --exclude '^https://discord\.tinyhumans\.ai/?$'
            'docs/**/*.md'
            'docs/gitbooks/en/**/*.md'
            'README.md'
            'INSTALL.md'
            'CONTRIBUTING.md'
            '.github/PULL_REQUEST_TEMPLATE.md'
          fail: true
      - name: Recheck transient service failures
        if: steps.link-check.outcome == 'failure'
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: >-
          bash scripts/ci-cancel-aware.sh node scripts/ci/retry-markdown-links.mjs
          target/link-check/report.md
          "$RUNNER_TEMP/lychee/bin/lychee"
  appimage-rpath-guard:
    name: AppImage RPATH + libxdo guard
    runs-on: ubuntu-latest
    timeout-minutes: 5
    continue-on-error: true
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'docs') && !contains(github.event.pull_request.labels.*.name, 'chore') }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v7
        with:
          fetch-depth: 1
      - name: Install patchelf
        run: sudo apt-get update -qq && sudo apt-get install -y -qq patchelf
      - name: Syntax check release scripts
        run: |
          bash -n scripts/release/strip-appimage-graphics-libs.sh
          bash -n scripts/release/upload-macos-artifacts.sh
          bash -n scripts/release/tauri-signer.sh
      - name: Run AppImage RPATH sanitize + libxdo guard test (issue #3224)
        run: bash scripts/release/test-strip-appimage-rpaths.sh
      - name: Run updater-signing guard test (issue #5658)
        run: bash scripts/release/test-tauri-signer.sh