mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-09-01 21:27:58 +00:00
Anso
9940efb94f
* feat(tier-reconcile): seed tier-catalog with validated inventory Verified current-state catalog (29 entries) with cross-field invariant (tier: internal iff availability: internal). No internal Linear IDs in committed file; publicRoadmapKey slugs used instead. Canonical validator (scripts/website-catalog/canonical-validate.mjs) passes. Refs: SEN-549 * feat(tier-reconcile): add canonical catalog, sync scripts, and CI drift check Add canonical feature catalog (29 entries, no SEN-NNN identifiers) with cross-field invariant (tier:internal iff availability:internal). Sencho-owned scripts: - canonical-validate.mjs: schema + invariant validation - sync-feature-catalog.mjs: builds sanitized public projection - check-website-drift.mjs: checksum-based drift detection - test-drift-detection.mjs: unit tests for drift logic - test-catalog-no-leak.mjs: no prohibited identifiers GitHub Actions catalog-drift.yml: pull_request required check + push safeguard. Refs: SEN-549 * fix(tier-reconcile): correct relative paths in scripts for standalone runs Use fileURLToPath to resolve paths relative to script directory rather than cwd. Fixes PA-01/PA-02 script execution from any directory. Also removes SEN-NNN references from docs/feature-catalog.yaml entries and updates limitation text per audit. * ci(catalog-drift): authenticate the cross-repo website checkout The drift check reads the website repository, which is private, so the ambient workflow token cannot see it and the checkout failed with a not-found error before any validation ran. Mint a GitHub App installation token scoped to that one repository with read-only contents access, matching the pattern the docs sync workflow already uses. Also declare contents: read at the workflow level so the job stops inheriting the repository default token permissions. * fix(catalog-drift): make the drift check able to fail The job reported success no matter what the website repository contained, for two compounding reasons. The root checkout ran after the website checkout. actions/checkout cleans its destination, so it deleted website-checkout before any script ran. Reorder so the root checkout comes first. The verify step then regenerated the snapshot into that directory before comparing against it, so the comparison only ever read back what it had just written, recreating the deleted tree along the way. Drop the sync call and compare against what the website has actually committed. The comparison also trusted the checksum recorded in the snapshot metadata without checking that it described the snapshot file sitting next to it, so a hand-edited or stale snapshot passed beside fresh metadata. Require both to agree. Round out the surrounding tooling: a catalog with no entries array now fails validation instead of reporting zero entries, the unused clone branch no longer calls require from an ES module, and the failure output names the regeneration command, which is now reachable as an npm script. * ci(catalog-drift): check for website-side drift on a daily schedule The path filters only fire on changes inside this repository, so an edited or reverted snapshot in the website repository left the check green while the two were genuinely out of sync. A daily run closes that window without waiting for someone to touch the canonical catalog. * fix(catalog-scripts): check every prohibited key and drop an inert test The leak check listed five prohibited keys but only tested three by hand, so an entry carrying route or service would have reached the public catalog unnoticed. Drive the loop from the list instead. Remove test-drift-detection.mjs. Nothing invoked it, and it asserted against a reimplemented normalizer rather than the drift script it named, so it reported coverage it did not provide.
62 lines
2.3 KiB
YAML
62 lines
2.3 KiB
YAML
name: Catalog Drift Check
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
paths:
|
|
- 'docs/feature-catalog.yaml'
|
|
- 'scripts/website-catalog/**'
|
|
- '.github/workflows/catalog-drift.yml'
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- 'docs/feature-catalog.yaml'
|
|
- 'scripts/website-catalog/**'
|
|
# Drift can also be introduced from the website side, which changes nothing
|
|
# in this repository and so triggers none of the filters above. Check daily
|
|
# so an edited or reverted snapshot cannot sit undetected.
|
|
schedule:
|
|
- cron: '17 6 * * *'
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
verify:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# Mint a read-only installation token scoped to the website repository
|
|
# only. The default GITHUB_TOKEN cannot read Studio-Saelix/sencho-website.
|
|
- name: Generate GitHub App installation token
|
|
id: app-token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
|
|
with:
|
|
app-id: ${{ secrets.APP_ID }}
|
|
private-key: ${{ secrets.APP_PRIVATE_KEY }}
|
|
owner: ${{ github.repository_owner }}
|
|
repositories: sencho-website
|
|
permission-contents: read
|
|
|
|
# The root checkout must come first. actions/checkout cleans its
|
|
# destination, so running it after the nested one deletes website-checkout.
|
|
- uses: actions/checkout@v4
|
|
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
repository: ${{ github.repository_owner }}/sencho-website
|
|
token: ${{ steps.app-token.outputs.token }}
|
|
path: website-checkout
|
|
- name: Install root dependencies
|
|
run: npm ci
|
|
- name: Canonical validation
|
|
run: node scripts/website-catalog/canonical-validate.mjs
|
|
# Compare the canonical catalog against the snapshot the website has
|
|
# actually committed. Do not run sync-feature-catalog here: it rewrites
|
|
# that snapshot from the canonical file, so the comparison would only
|
|
# ever read back what it just wrote and could never report drift.
|
|
- name: Compare against the committed website snapshot
|
|
run: node scripts/website-catalog/check-website-drift.mjs --website-dir website-checkout
|
|
- name: Verify no internal identifiers in canonical file
|
|
run: node scripts/website-catalog/test-catalog-no-leak.mjs
|