fix(ci): sync hypatia-scan.yml to canonical #118
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: PMPL-1.0-or-later | |
| # Rhodibot - RSR compliance checking | |
| # Part of gitbot-fleet (hyperpolymath/gitbot-fleet :: bots/rhodibot) | |
| name: Rhodibot RSR Compliance | |
| permissions: | |
| contents: read | |
| on: | |
| push: | |
| branches: [main, develop] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| env: | |
| # Pinned gitbot-fleet commit. Must include the `rhodibot check` CLI | |
| # subcommand (gitbot-fleet#150). Bump in lockstep when the fleet changes. | |
| GITBOT_FLEET_REF: 2e0ea3ca67821a91e650f51bf48a6cfd1c7aae1c | |
| jobs: | |
| rsr-compliance: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4 | |
| - name: Setup Rust toolchain | |
| uses: dtolnay/rust-toolchain@6d9817901c499d6b02debbb57edb38d33daa680b # stable | |
| with: | |
| toolchain: stable | |
| - name: Cache dependencies | |
| uses: Swatinem/rust-cache@ad397744b0d591a723ab90405b7247fac0e6b8db # v2 | |
| with: | |
| workspaces: ${{ runner.temp }}/gitbot-fleet/bots/rhodibot | |
| - name: Fetch gitbot-fleet at pinned ref | |
| run: | | |
| git clone --no-checkout --filter=tree:0 \ | |
| https://github.com/hyperpolymath/gitbot-fleet.git \ | |
| "$RUNNER_TEMP/gitbot-fleet" | |
| git -C "$RUNNER_TEMP/gitbot-fleet" checkout "$GITBOT_FLEET_REF" | |
| - name: Build rhodibot | |
| working-directory: ${{ runner.temp }}/gitbot-fleet/bots/rhodibot | |
| env: | |
| OPENSSL_NO_VENDOR: 1 | |
| run: cargo build --release | |
| - name: Run rhodibot check | |
| id: rhodibot | |
| continue-on-error: true | |
| env: | |
| # Public-repo read via the GitHub REST API; the built-in, | |
| # read-only workflow token is sufficient (no PAT needed). | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: | | |
| "$RUNNER_TEMP/gitbot-fleet/bots/rhodibot/target/release/rhodibot" check \ | |
| --owner "${{ github.repository_owner }}" \ | |
| --repo "${{ github.event.repository.name }}" \ | |
| > rhodibot-results.txt 2>&1 | |
| echo $? > rhodibot-exit-code.txt | |
| - name: Display results | |
| if: always() | |
| run: | | |
| if [ -f rhodibot-results.txt ]; then | |
| echo "## Rhodibot RSR Compliance Results" >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| cat rhodibot-results.txt >> $GITHUB_STEP_SUMMARY | |
| echo '```' >> $GITHUB_STEP_SUMMARY | |
| exit_code=$(cat rhodibot-exit-code.txt) | |
| if [ "$exit_code" = "0" ]; then | |
| echo "✅ RSR compliance checks passed" >> $GITHUB_STEP_SUMMARY | |
| else | |
| echo "❌ RSR compliance issues found (exit code: $exit_code)" >> $GITHUB_STEP_SUMMARY | |
| fi | |
| fi | |
| - name: Upload results | |
| if: always() | |
| uses: actions/upload-artifact@1eb3cb2b3e0f29609092a73eb033bb759a334595 # v4 | |
| with: | |
| name: rhodibot-results | |
| path: rhodibot-results.txt | |
| if-no-files-found: ignore | |
| - name: Fail on high-severity violations | |
| if: steps.rhodibot.outcome == 'failure' | |
| run: exit 1 |