mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-26 05:29:43 +00:00
Oliver Kieselbach
c26542776e
Every job that runs third-party code (restore, build, tests, npm ci, next build, wix) now holds only a read-only token and hands its output on as one archive. Signing, publishing and deploying happen in separate jobs on a fresh runner that run only this repository's scripts and pinned actions, unpack artifacts outside the checkout and take no build-job output into a script. - build-agent: reserve -> build -> release - build-msi: sign-loader -> build -> release - deploy-backend: reserve -> build -> deploy (publish output as one tar.gz) - deploy-web: build -> deploy (SWA token only, no id-token) -> record - combine-rules: validate (read-only, PRs too) -> publish (push to main only) - deploy-mcp: same shape; documents docker build as its boundary Deploy-only jobs run in the production environment. The jobs that sign stay without an environment for now: a job carries one OIDC subject, and the signing identity still trusts the ref. oidc-login-test.yml is removed; combine-rules no longer triggers on the dev branch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
93 lines
3.5 KiB
YAML
93 lines
3.5 KiB
YAML
name: Validate & Combine Rules
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'rules/gather/**'
|
|
- 'rules/analyze/**'
|
|
- 'rules/ime-log-patterns/**'
|
|
- 'rules/schema/**'
|
|
- 'rules/scripts/**'
|
|
- 'rules/guardrails.json'
|
|
- '.github/workflows/combine-rules.yml'
|
|
pull_request:
|
|
paths:
|
|
- 'rules/gather/**'
|
|
- 'rules/analyze/**'
|
|
- 'rules/ime-log-patterns/**'
|
|
- 'rules/schema/**'
|
|
- 'rules/scripts/**'
|
|
- 'rules/guardrails.json'
|
|
- '.github/workflows/combine-rules.yml'
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
# Pull requests and pushes alike; read-only, because the validator is third-party code.
|
|
validate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: '22'
|
|
|
|
# Lockfile and no lifecycle scripts: rules/scripts/package-lock.json pins ajv,
|
|
# ajv-formats and every transitive package (Dependabot keeps it current); ajv is pure
|
|
# JS and needs no install hooks.
|
|
- name: Install the rules validator from the lockfile
|
|
working-directory: rules/scripts
|
|
run: npm ci --ignore-scripts
|
|
|
|
# Gather, analyze and IME log pattern files plus guardrails.json, each against its
|
|
# schema; the guardrails schema is what keeps a "data" PR from becoming code in the
|
|
# generated TypeScript (see validate.js).
|
|
- name: Validate rules and guardrails against their schemas
|
|
run: node rules/scripts/validate.js
|
|
|
|
- name: Combine rules into dist/
|
|
run: node rules/scripts/combine.js
|
|
|
|
# The one job that can push to main, and it installs nothing: combine.js needs only node's
|
|
# built-ins, so no package code ever runs next to the write token. Keep it that way -- a
|
|
# dependency in combine.js would need its own job.
|
|
publish:
|
|
needs: validate
|
|
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write
|
|
steps:
|
|
# Checkout leaves the job's GITHUB_TOKEN in the remote credential helper, which is all
|
|
# `git push` needs.
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
|
|
- uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
|
|
with:
|
|
node-version: '22'
|
|
|
|
- name: Combine rules into dist/
|
|
run: node rules/scripts/combine.js
|
|
|
|
# Plain git instead of a third-party action, so no code we do not control gets to push.
|
|
# NOTE: combine.js writes THREE outputs; committing only dist/ would silently discard
|
|
# the two generated TS modules and leave the guardrails-in-sync CI check red.
|
|
- name: Commit generated outputs
|
|
run: |
|
|
set -euo pipefail
|
|
git config user.name "github-actions[bot]"
|
|
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
|
|
git add -- rules/dist/ \
|
|
src/Web/autopilot-monitor-web/lib/generated/guardrails.generated.ts \
|
|
src/McpServer/autopilot-monitor-mcp/src/rule-authoring.generated.ts
|
|
if git diff --cached --quiet; then
|
|
echo "Generated outputs unchanged - nothing to commit"
|
|
exit 0
|
|
fi
|
|
git commit -m "chore: regenerate rules/dist + generated TS from individual files"
|
|
git push origin HEAD:main
|