build(deps): Bump the actions group with 2 updates #242
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> | |
| # | |
| # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate | |
| # Validates that the repo uses hyperpolymath's own formats and tools. | |
| # Companion to static-analysis-gate.yml (security) — this is for format compliance. | |
| name: Dogfood Gate | |
| on: | |
| pull_request: | |
| branches: ['**'] | |
| push: | |
| branches: [main, master] | |
| permissions: | |
| contents: read | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # Job 1: A2ML manifest validation | |
| # --------------------------------------------------------------------------- | |
| a2ml-validate: | |
| name: Validate A2ML manifests | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Check for A2ML files | |
| id: detect | |
| run: | | |
| # audits/assail-classifications.a2ml is panic-attack's user-classification | |
| # registry — an S-expression dialect by that tool's spec (see panic-attack | |
| # CLAUDE.md), not the TOML-like manifest A2ML this gate validates. Exclude | |
| # it rather than feeding it to a validator for a different dialect. | |
| COUNT=$(find . -name '*.a2ml' -not -path './.git/*' -not -name 'assail-classifications.a2ml' | wc -l) | |
| echo "count=$COUNT" >> "$GITHUB_OUTPUT" | |
| if [ "$COUNT" -eq 0 ]; then | |
| echo "::warning::No .a2ml manifest files found. Every RSR repo should have 0-AI-MANIFEST.a2ml" | |
| fi | |
| - name: Validate A2ML manifests | |
| if: steps.detect.outputs.count > 0 | |
| uses: hyperpolymath/a2ml-validate-action@6bff6ec134fc977e86d25166a5c522ddea5c1e78 | |
| with: | |
| path: '.' | |
| strict: 'false' | |
| # Re-state the action's default carve-outs (a custom value REPLACES | |
| # the default list), plus panic-attack's user-classification | |
| # registry: that file is an S-expression dialect by panic-attack's | |
| # spec, not the TOML-like manifest A2ML this action validates. | |
| paths-ignore: | | |
| vendor/ | |
| vendored/ | |
| verified-container-spec/ | |
| .audittraining/ | |
| integration/fixtures/ | |
| test/fixtures/ | |
| tests/fixtures/ | |
| assail-classifications.a2ml | |
| - name: Write summary | |
| run: | | |
| A2ML_COUNT="${{ steps.detect.outputs.count }}" | |
| if [ "$A2ML_COUNT" -eq 0 ]; then | |
| cat <<'EOF' >> "$GITHUB_STEP_SUMMARY" | |
| ## A2ML Validation | |
| :warning: **No .a2ml files found.** Every RSR-compliant repo should have at least `0-AI-MANIFEST.a2ml`. | |
| Create one with: `a2mliser init` or copy from [rsr-template-repo](https://github.com/hyperpolymath/rsr-template-repo). | |
| EOF | |
| else | |
| echo "## A2ML Validation" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "Scanned **${A2ML_COUNT}** .a2ml file(s). See step output for details." >> "$GITHUB_STEP_SUMMARY" | |
| fi |