stale-secrets.yml

name: stale-secrets-check

# Catches two failure modes of the chunked-secret release flow before the
# real build runs:
#
#   1. Secret corruption in transit (chunked base64 over Actions env vars
#      is robust, but a single bit-flip in 12 secrets would otherwise
#      produce a build that dies in tarfile.extract with no actionable
#      pointer at the cause).
#
#   2. Drift between the secrets and the working tree. If the maintainer
#      edited src/*.rs locally and forgot to re-pack + refresh the
#      GitHub secrets, the chunks currently in CI do not match the source
#      the build will be tested against. Without this check the wheel
#      ships and the discrepancy is invisible.
#
# The check uses `python scripts/pack_rust_core.py verify`, which is
# already part of the repo. No script changes required.
#
# This is a one-command, ~10s job that runs on every push and PR. If it
# fails the rest of the suite still runs (so a real source bug is not
# hidden behind a stale-secret error) but the failure surfaces a clear
# "you need to re-pack and refresh the RUST_SRC_B64_* secrets" message
# in the run log.

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main, develop]
  workflow_dispatch:

jobs:
  verify-packed-secrets:
    name: packed secrets match working tree
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Verify packed secrets
        env:
          RUST_SRC_B64_1: ${{ secrets.RUST_SRC_B64_1 }}
          RUST_SRC_B64_2: ${{ secrets.RUST_SRC_B64_2 }}
          RUST_SRC_B64_3: ${{ secrets.RUST_SRC_B64_3 }}
          RUST_SRC_B64_4: ${{ secrets.RUST_SRC_B64_4 }}
          RUST_SRC_B64_5: ${{ secrets.RUST_SRC_B64_5 }}
          RUST_SRC_B64_6: ${{ secrets.RUST_SRC_B64_6 }}
          RUST_SRC_B64_7: ${{ secrets.RUST_SRC_B64_7 }}
          RUST_SRC_B64_8: ${{ secrets.RUST_SRC_B64_8 }}
          RUST_SRC_B64_9: ${{ secrets.RUST_SRC_B64_9 }}
          RUST_SRC_B64_10: ${{ secrets.RUST_SRC_B64_10 }}
          RUST_SRC_B64_11: ${{ secrets.RUST_SRC_B64_11 }}
          RUST_SRC_B64_12: ${{ secrets.RUST_SRC_B64_12 }}
        run: |
          # First, restore the proprietary Rust core from the secrets so
          # `verify` has something to compare against.
          python scripts/pack_rust_core.py unpack --from-env
          # Then, re-pack the just-restored tree and compare its SHA-256
          # to the SHA-256 of the chunked archive. The archives are
          # deterministic (fixed mtime, sorted names) so a matching hash
          # is a real guarantee that the secrets are self-consistent.
          python scripts/pack_rust_core.py verify --from-env
          # `verify` above proves the secrets are self-consistent, which on a
          # fresh checkout is all it CAN prove: src/* is gitignored and absent
          # until the line above restores it, so the comparison is the secrets
          # against themselves. It cannot see failure mode 2 in this file's
          # header - a maintainer who edited src/, re-packed, and never ran
          # `gh secret set`. That drift is exactly what shipped a local fix
          # nowhere for hours.
          #
          # rust_core.sha256 IS tracked, so it travels with the commit. Compare
          # the restored tree against it: if the secrets are older than the last
          # pack, the digests differ and this fails with instructions.
          python scripts/pack_rust_core.py check-manifest