Validate rldyour-opencode #39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validate rldyour-opencode | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: {} | |
| # Least-privilege token (OSSF Scorecard "Token-Permissions" check). | |
| # Validation jobs only need read access to the repository contents. | |
| permissions: | |
| contents: read | |
| # Serialize parallel CI runs on the same ref. Stale PR pushes cancel | |
| # in-flight runs to free runner minutes for the latest revision. | |
| concurrency: | |
| group: validate-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| validate: | |
| strategy: | |
| # Matrix the strict frontmatter validator + pytest corpus across both | |
| # platforms the owner runs locally (Linux + macOS). The runner difference | |
| # surfaces script portability defects (sed -i flags, mktemp semantics, | |
| # readlink behaviour) before they hit a local checkout. | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 15 | |
| steps: | |
| # Actions pinned to commit SHA (supply-chain hardening — defends against | |
| # tag hijack on the action repository). Update SHAs in lockstep when | |
| # bumping the major version; verify via `gh api repos/actions/<name>/git/refs/tags/<tag>`. | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Prepare agent-only validation context | |
| shell: bash | |
| run: | | |
| # Unit tests validate cross-layer contracts that reference AGENTS.md, | |
| # while normal branches keep agent-only files on origin/fullrepo. | |
| # Restore only instruction docs needed by tests; do not run | |
| # bootstrap-init here because it would replace scripts/.opencode | |
| # from fullrepo and could mask the exact PR/main files under test. | |
| git fetch --no-tags origin +refs/heads/fullrepo:refs/remotes/origin/fullrepo | |
| bash scripts/fullrepo_sync.sh install-exclude | |
| git show origin/fullrepo:AGENTS.md > AGENTS.md | |
| mkdir -p .claude | |
| git show origin/fullrepo:.claude/CLAUDE.md > .claude/CLAUDE.md | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.13" | |
| - name: Install pytest + PyYAML (pinned) | |
| run: python3 -m pip install --upgrade pip "pytest==9.0.2" "PyYAML==6.0.3" | |
| - name: Run repo validator (opencode.json + skill/agent/command frontmatter + VERSION) | |
| run: bash scripts/validate_config.sh | |
| - name: Run validator unit tests | |
| run: python3 -m pytest scripts/tests/ -v | |
| - name: Report project file count | |
| run: | | |
| total=$(find . -type f \( -name '*.md' -o -name '*.json' -o -name '*.yml' -o -name '*.yaml' -o -name '*.sh' -o -name '*.ts' -o -name '*.py' -o -name 'VERSION' -o -name 'LICENSE' -o -name '.gitignore' \) ! -path './.git/*' ! -path './.github/*' | wc -l | tr -d ' ') | |
| echo "Total project files: $total" | |
| shell-strict-mode: | |
| # Tiny linter that asserts every scripts/*.sh begins with the env-bash | |
| # shebang and `set -euo pipefail`. Runs once on Linux only — shebang | |
| # contents are platform-independent. | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.13" | |
| - name: Verify shell strictness contract | |
| run: | | |
| python3 - <<'PY' | |
| from pathlib import Path | |
| bad = [] | |
| for p in sorted(Path("scripts").glob("*.sh")): | |
| text = p.read_text(encoding="utf-8") | |
| if not text.startswith("#!/usr/bin/env bash"): | |
| bad.append(f"{p}: missing #!/usr/bin/env bash shebang") | |
| if "set -euo pipefail" not in text: | |
| bad.append(f"{p}: missing `set -euo pipefail`") | |
| if bad: | |
| for line in bad: | |
| print("[ERR]", line) | |
| raise SystemExit(1) | |
| print("[OK] all scripts/*.sh start with env-bash and enable strict mode") | |
| PY |