Tenant Firewall Gate #20
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Tenant Firewall Gate | |
| # The Mind-side leg of the tenant-firewall PR gates (issue #198). The organ | |
| # repos gate their own PRs with `repos_sync.py --only "tenant firewall (organ | |
| # code)"`; this workflow closes the remaining hole — an edit to the CHECKER | |
| # itself (an allowlist grant, a token-pattern change, an --only regression) is | |
| # otherwise verified by nothing. It checks Mind out beside the organ repos' | |
| # mains and runs the full drift check, so an allowlist over-grant or a check | |
| # that stopped finding real drift fails the PR that authors it. | |
| # | |
| # Path-filtered to scripts/repos_sync.py (plus this file): registry/prompt | |
| # pushes — the overwhelming bulk of Mind traffic — never trigger it. | |
| # | |
| # All three organs are checked out. PyAutoHands was omitted at first — its | |
| # firewall clear waited behind the version-stamp task that claimed the repo | |
| # (PyAutoHands#235) — and joined once that leg landed as PyAutoHands#237, | |
| # clearing the last of issue #198's 9 findings. | |
| on: | |
| push: | |
| branches: [main] | |
| paths: | |
| - "scripts/repos_sync.py" | |
| - ".github/workflows/firewall_gate.yml" | |
| pull_request: | |
| paths: | |
| - "scripts/repos_sync.py" | |
| - ".github/workflows/firewall_gate.yml" | |
| workflow_dispatch: | |
| concurrency: | |
| group: firewall-gate-${{ github.ref }} | |
| cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} | |
| jobs: | |
| firewall: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout PyAutoMind | |
| uses: actions/checkout@v4 | |
| with: | |
| path: PyAutoMind | |
| # The organ repos, pinned to main: the checker is verified against the | |
| # CURRENT organ code, the same pairing a local workspace has. All | |
| # public, so the default GITHUB_TOKEN suffices. | |
| - name: Checkout PyAutoBrain | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: PyAutoLabs/PyAutoBrain | |
| path: PyAutoBrain | |
| - name: Checkout PyAutoHeart | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: PyAutoLabs/PyAutoHeart | |
| path: PyAutoHeart | |
| - name: Checkout PyAutoHands | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: PyAutoLabs/PyAutoHands | |
| path: PyAutoHands | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.13" | |
| - name: Install (PyYAML — the whole dependency set) | |
| run: pip install PyYAML | |
| - name: Drift check (all legs — absent repos are skipped) | |
| run: python3 PyAutoMind/scripts/repos_sync.py --check --root "$GITHUB_WORKSPACE" |