From 97b3a36f772b259dfb36c313b257e999603d8bef Mon Sep 17 00:00:00 2001 From: overtrue Date: Sat, 22 Aug 2026 10:22:41 +0800 Subject: [PATCH] test(ci): guard scheduled alert issue wiring --- scripts/check_test_wiring.py | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff --git a/scripts/check_test_wiring.py b/scripts/check_test_wiring.py index b6fa0f3a6..4b1e34544 100755 --- a/scripts/check_test_wiring.py +++ b/scripts/check_test_wiring.py @@ -282,6 +282,9 @@ def check_scheduled_alerts(root: Path) -> list[str]: "always()", "github.event_name == 'schedule'", "contains(needs.*.result, 'failure')", + "issues: write", + "uses: ./.github/actions/schedule-failure-issue", + "github-token: ${{ secrets.GITHUB_TOKEN }}", ) missing = [token for token in required if token not in job] if missing: @@ -472,6 +475,12 @@ class SelfTests(unittest.TestCase): " alert-on-failure:\n" " if: always() && github.event_name == 'schedule' && " "contains(needs.*.result, 'failure')\n" + " permissions:\n" + " issues: write\n" + " steps:\n" + " - uses: ./.github/actions/schedule-failure-issue\n" + " with:\n" + " github-token: ${{ secrets.GITHUB_TOKEN }}\n" ) names: list[str] = [] for relative in SCHEDULED_ALERT_WORKFLOWS: @@ -492,9 +501,17 @@ class SelfTests(unittest.TestCase): self.assertEqual(check_scheduled_alerts(root), []) first = root / SCHEDULED_ALERT_WORKFLOWS[0] - first.write_text(first.read_text().replace("contains(needs.*.result, 'failure')", "false")) - self.assertEqual(len(check_scheduled_alerts(root)), 1) - first.write_text(first.read_text().replace("false", "contains(needs.*.result, 'failure')")) + mutations = ( + ("contains(needs.*.result, 'failure')", "false"), + ("issues: write", "issues: read"), + ("uses: ./.github/actions/schedule-failure-issue", "uses: actions/checkout@v7"), + ("github-token: ${{ secrets.GITHUB_TOKEN }}", "github-token: missing"), + ) + for required, replacement in mutations: + original = first.read_text() + first.write_text(original.replace(required, replacement)) + self.assertEqual(len(check_scheduled_alerts(root)), 1) + first.write_text(original) watchdog.write_text(watchdog.read_text().replace(f'- "{names[0]}"\n', "")) self.assertEqual(len(check_scheduled_alerts(root)), 1)