Skip to content

Commit aa306a6

Browse files
PatrickJSPatrickJS
committed
refactor(repo-checks): split hygiene by concern
1 parent 29c9a6b commit aa306a6

11 files changed

Lines changed: 783 additions & 250 deletions

‎.github/workflows/main.yml‎

Lines changed: 198 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Repo Hygiene
1+
name: Repo Checks
22

33
on:
44
pull_request_target:
@@ -13,16 +13,15 @@ permissions:
1313
contents: read
1414

1515
jobs:
16-
repo-hygiene:
16+
pull-request-trust:
1717
runs-on: ubuntu-latest
18-
if: github.event_name == 'pull_request_target' || github.event_name == 'push'
18+
if: github.event_name == 'pull_request_target'
1919
steps:
2020
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
2121
with:
2222
node-version: 20
2323

2424
- name: Checkout trusted base checks
25-
if: github.event_name == 'pull_request_target'
2625
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
2726
with:
2827
ref: ${{ github.event.pull_request.base.ref }}
@@ -31,7 +30,6 @@ jobs:
3130
persist-credentials: false
3231

3332
- name: Check PR author account age
34-
if: github.event_name == 'pull_request_target'
3533
env:
3634
GITHUB_TOKEN: ${{ github.token }}
3735
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
@@ -43,6 +41,23 @@ jobs:
4341
--minimum-age-days "$PR_AUTHOR_MINIMUM_AGE_DAYS" \
4442
--allowlist "$PR_AUTHOR_AGE_ALLOWLIST"
4543
44+
readme-hygiene:
45+
runs-on: ubuntu-latest
46+
if: github.event_name == 'pull_request_target' || github.event_name == 'push'
47+
steps:
48+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
49+
with:
50+
node-version: 20
51+
52+
- name: Checkout trusted base checks
53+
if: github.event_name == 'pull_request_target'
54+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
55+
with:
56+
ref: ${{ github.event.pull_request.base.ref }}
57+
path: .trusted-base
58+
fetch-depth: 0
59+
persist-credentials: false
60+
4661
- name: Checkout pull request content
4762
if: github.event_name == 'pull_request_target'
4863
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
@@ -66,9 +81,9 @@ jobs:
6681
git -C pr diff --name-only "$base"...HEAD > pr/.changed-files
6782
git -C pr diff --unified=0 "$base"...HEAD -- README.md > pr/.readme.diff || true
6883
69-
- name: Run trusted repo hygiene checks
84+
- name: Run trusted README hygiene checks
7085
if: github.event_name == 'pull_request_target'
71-
run: node .trusted-base/scripts/check-repo-hygiene.mjs --root "$GITHUB_WORKSPACE/pr" --changed-files .changed-files --diff-file .readme.diff
86+
run: node .trusted-base/scripts/check-readme-hygiene.mjs --root "$GITHUB_WORKSPACE/pr" --changed-files .changed-files --diff-file .readme.diff
7287

7388
- name: Checkout push content
7489
if: github.event_name == 'push'
@@ -90,9 +105,183 @@ jobs:
90105
git diff --name-only "$base"...HEAD > .changed-files
91106
git diff --unified=0 "$base"...HEAD -- README.md > .readme.diff || true
92107
93-
- name: Run repo hygiene checks
108+
- name: Run README hygiene checks
109+
if: github.event_name == 'push'
110+
run: node scripts/check-readme-hygiene.mjs --changed-files .changed-files --diff-file .readme.diff
111+
112+
rule-hygiene:
113+
runs-on: ubuntu-latest
114+
if: github.event_name == 'pull_request_target' || github.event_name == 'push'
115+
steps:
116+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
117+
with:
118+
node-version: 20
119+
120+
- name: Checkout trusted base checks
121+
if: github.event_name == 'pull_request_target'
122+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
123+
with:
124+
ref: ${{ github.event.pull_request.base.ref }}
125+
path: .trusted-base
126+
fetch-depth: 0
127+
persist-credentials: false
128+
129+
- name: Checkout pull request content
130+
if: github.event_name == 'pull_request_target'
131+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
132+
with:
133+
repository: ${{ github.event.pull_request.head.repo.full_name }}
134+
ref: ${{ github.event.pull_request.head.sha }}
135+
path: pr
136+
fetch-depth: 0
137+
persist-credentials: false
138+
139+
- name: Determine pull request changed files
140+
if: github.event_name == 'pull_request_target'
141+
shell: bash
142+
env:
143+
BASE_REF: ${{ github.event.pull_request.base.ref }}
144+
run: |
145+
git -C pr remote add trusted-base "$GITHUB_SERVER_URL/${{ github.repository }}.git"
146+
git -C pr fetch --no-tags trusted-base "$BASE_REF"
147+
base="$(git -C pr rev-parse FETCH_HEAD)"
148+
149+
git -C pr diff --name-only "$base"...HEAD > pr/.changed-files
150+
151+
- name: Run trusted rule hygiene checks
152+
if: github.event_name == 'pull_request_target'
153+
run: node .trusted-base/scripts/check-rule-hygiene.mjs --root "$GITHUB_WORKSPACE/pr" --changed-files .changed-files
154+
155+
- name: Checkout push content
156+
if: github.event_name == 'push'
157+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
158+
with:
159+
fetch-depth: 0
160+
persist-credentials: false
161+
162+
- name: Determine push changed files
163+
if: github.event_name == 'push'
164+
shell: bash
165+
run: |
166+
if [[ -n "${{ github.event.before }}" && "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ]]; then
167+
base="${{ github.event.before }}"
168+
else
169+
base="$(git rev-list --max-parents=0 HEAD)"
170+
fi
171+
172+
git diff --name-only "$base"...HEAD > .changed-files
173+
174+
- name: Run rule hygiene checks
175+
if: github.event_name == 'push'
176+
run: node scripts/check-rule-hygiene.mjs --changed-files .changed-files
177+
178+
issue-template-policy:
179+
runs-on: ubuntu-latest
180+
if: github.event_name == 'pull_request_target' || github.event_name == 'push'
181+
steps:
182+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
183+
with:
184+
node-version: 20
185+
186+
- name: Checkout trusted base checks
187+
if: github.event_name == 'pull_request_target'
188+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
189+
with:
190+
ref: ${{ github.event.pull_request.base.ref }}
191+
path: .trusted-base
192+
fetch-depth: 0
193+
persist-credentials: false
194+
195+
- name: Checkout pull request content
196+
if: github.event_name == 'pull_request_target'
197+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
198+
with:
199+
repository: ${{ github.event.pull_request.head.repo.full_name }}
200+
ref: ${{ github.event.pull_request.head.sha }}
201+
path: pr
202+
fetch-depth: 0
203+
persist-credentials: false
204+
205+
- name: Run trusted issue template policy checks
206+
if: github.event_name == 'pull_request_target'
207+
run: node .trusted-base/scripts/check-issue-template-policy.mjs --root "$GITHUB_WORKSPACE/pr"
208+
209+
- name: Checkout push content
210+
if: github.event_name == 'push'
211+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
212+
with:
213+
fetch-depth: 0
214+
persist-credentials: false
215+
216+
- name: Run issue template policy checks
217+
if: github.event_name == 'push'
218+
run: node scripts/check-issue-template-policy.mjs
219+
220+
repo-security:
221+
runs-on: ubuntu-latest
222+
if: github.event_name == 'pull_request_target' || github.event_name == 'push'
223+
steps:
224+
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
225+
with:
226+
node-version: 20
227+
228+
- name: Checkout trusted base checks
229+
if: github.event_name == 'pull_request_target'
230+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
231+
with:
232+
ref: ${{ github.event.pull_request.base.ref }}
233+
path: .trusted-base
234+
fetch-depth: 0
235+
persist-credentials: false
236+
237+
- name: Checkout pull request content
238+
if: github.event_name == 'pull_request_target'
239+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
240+
with:
241+
repository: ${{ github.event.pull_request.head.repo.full_name }}
242+
ref: ${{ github.event.pull_request.head.sha }}
243+
path: pr
244+
fetch-depth: 0
245+
persist-credentials: false
246+
247+
- name: Determine pull request changed files
248+
if: github.event_name == 'pull_request_target'
249+
shell: bash
250+
env:
251+
BASE_REF: ${{ github.event.pull_request.base.ref }}
252+
run: |
253+
git -C pr remote add trusted-base "$GITHUB_SERVER_URL/${{ github.repository }}.git"
254+
git -C pr fetch --no-tags trusted-base "$BASE_REF"
255+
base="$(git -C pr rev-parse FETCH_HEAD)"
256+
257+
git -C pr diff --name-only "$base"...HEAD > pr/.changed-files
258+
259+
- name: Run trusted repo security checks
260+
if: github.event_name == 'pull_request_target'
261+
run: node .trusted-base/scripts/check-repo-security.mjs --root "$GITHUB_WORKSPACE/pr" --changed-files .changed-files
262+
263+
- name: Checkout push content
264+
if: github.event_name == 'push'
265+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
266+
with:
267+
fetch-depth: 0
268+
persist-credentials: false
269+
270+
- name: Determine push changed files
271+
if: github.event_name == 'push'
272+
shell: bash
273+
run: |
274+
if [[ -n "${{ github.event.before }}" && "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ]]; then
275+
base="${{ github.event.before }}"
276+
else
277+
base="$(git rev-list --max-parents=0 HEAD)"
278+
fi
279+
280+
git diff --name-only "$base"...HEAD > .changed-files
281+
282+
- name: Run repo security checks
94283
if: github.event_name == 'push'
95-
run: node scripts/check-repo-hygiene.mjs --changed-files .changed-files --diff-file .readme.diff
284+
run: node scripts/check-repo-security.mjs --changed-files .changed-files
96285

97286
awesome-lint:
98287
name: awesome-lint

‎package.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,12 @@
77
"check:awesome-list:upstream": "pnpm dlx awesome-lint",
88
"test": "node --test scripts/*.test.mjs",
99
"check:awesome-list": "node scripts/check-awesome-list.mjs",
10-
"check:prompt-safety": "node scripts/check-repo-hygiene.mjs",
10+
"check:repo-hygiene": "node scripts/check-repo-hygiene.mjs",
11+
"check:readme-hygiene": "node scripts/check-readme-hygiene.mjs",
12+
"check:rule-hygiene": "node scripts/check-rule-hygiene.mjs",
13+
"check:issue-template-policy": "node scripts/check-issue-template-policy.mjs",
14+
"check:repo-security": "node scripts/check-repo-security.mjs",
15+
"check:prompt-safety": "node scripts/check-repo-security.mjs",
1116
"links:absolute": "node scripts/convert-readme-links.mjs --to absolute",
1217
"links:relative": "node scripts/convert-readme-links.mjs --to relative",
1318
"cleanup:legacy": "node scripts/cleanup-legacy-artifacts.mjs"

‎scripts/check-issue-template-policy.mjs‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/usr/bin/env node
2+
3+
import { spawnSync } from "node:child_process";
4+
5+
const scriptPath = new URL("./check-repo-hygiene.mjs", import.meta.url).pathname;
6+
const result = spawnSync(
7+
process.execPath,
8+
[scriptPath, "--only", "issues", ...process.argv.slice(2)],
9+
{ stdio: "inherit" },
10+
);
11+
12+
process.exit(result.status ?? 1);

‎scripts/check-readme-hygiene.mjs‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/usr/bin/env node
2+
3+
import { spawnSync } from "node:child_process";
4+
5+
const scriptPath = new URL("./check-repo-hygiene.mjs", import.meta.url).pathname;
6+
const result = spawnSync(
7+
process.execPath,
8+
[scriptPath, "--only", "readme", ...process.argv.slice(2)],
9+
{ stdio: "inherit" },
10+
);
11+
12+
process.exit(result.status ?? 1);

0 commit comments

Comments
 (0)