chore: update guix.scm from squisher-corpus #317
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # registry-verify — fail the build if the spec registry or the DERIVED | |
| # topology map has drifted from the file tree. This is the in-repo half of | |
| # the drift-detection loop (the estate half is Hypatia rule HYP-S006). | |
| name: Registry Verify | |
| on: | |
| push: | |
| branches: [ main, master ] | |
| pull_request: | |
| branches: [ main, master ] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| actions: read | |
| contents: read | |
| jobs: | |
| verify: | |
| name: Registry + topology in sync | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 # full history so `git ls-files -s` hashes are stable | |
| # The scorecard `--verify` step below EXECUTES every pass-row's check. | |
| # Those checks shell out to real tools; ubuntu-latest ships neither | |
| # ripgrep nor xmllint. Without them `release-pre-flight/v1-audit.sh` | |
| # exits 2 ("v1-audit requires ripgrep") and the k9-svc MIME check exits | |
| # 127 — which the verifier then reported as "claimed PASS but the pass | |
| # is not real". That was a FALSE ACCUSATION: the passes were real, the | |
| # checks simply never ran. A gate that cannot run its own checks must | |
| # not be allowed to call the repo dishonest. | |
| # | |
| # NB this is a distinct fault from standards#381, which concerns | |
| # REGISTRY.a2ml source_hash drift in the *first* step below and is | |
| # not addressed here. | |
| - name: Install check dependencies (ripgrep, xmllint) | |
| run: | | |
| set -euo pipefail | |
| sudo apt-get update -qq | |
| sudo apt-get install -y --no-install-recommends ripgrep libxml2-utils | |
| rg --version | head -1 | |
| xmllint --version 2>&1 | head -1 | |
| - name: Verify registry + derived topology are current | |
| run: | | |
| if ! bash scripts/build-registry.sh --check; then | |
| { | |
| echo "### Registry drift detected" | |
| echo "" | |
| echo "A tracked file under a spec home (or STATE.a2ml) changed without" | |
| echo "regenerating the derived registry/topology. Fix locally:" | |
| echo "" | |
| echo '```sh' | |
| echo "just registry # or: bash scripts/build-registry.sh" | |
| echo "git add .machine_readable/REGISTRY.a2ml TOPOLOGY.md" | |
| echo '```' | |
| echo "" | |
| echo "Install the pre-commit guard so this is caught before push:" | |
| echo "" | |
| echo '```sh' | |
| echo "just hooks-install" | |
| echo '```' | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| exit 1 | |
| fi | |
| - name: Mustfile enforcement (structural + execute invariants) | |
| run: | | |
| # Wave-8 gate promotion: the Mustfile's invariants previously executed | |
| # only on push-to-main (boj-build.yml). PRs now gate on them too — | |
| # a change that breaks a MUST invariant fails before merge, not after. | |
| bash scripts/check-mustfile-structure.sh | |
| bash scripts/run-mustfile.sh | |
| - name: Verify compliance dashboard is current (and pass-checks hold) | |
| run: | | |
| # --verify RUNS every pass-row's executable `check`: a claimed pass | |
| # whose check does not hold fails this job (DYADT on the scorecards). | |
| if ! bash scripts/build-scorecards.sh --check --strict --verify; then | |
| { | |
| echo "### Compliance dashboard drift" | |
| echo "" | |
| echo "COMPLIANCE-DASHBOARD.md is stale, a scorecard is malformed/orphaned," | |
| echo "or a registered spec has no scorecard. Fix locally:" | |
| echo "" | |
| echo '```sh' | |
| echo "just scorecards # regenerate the dashboard" | |
| echo "just scorecards-check-strict" | |
| echo '```' | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| exit 1 | |
| fi |