Create policy-enforcement.yml - #6
Conversation
|
Note Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported. |
There was a problem hiding this comment.
Pull request overview
Adds a GitHub Actions workflow intended to enforce repository policies (branch naming, max file size, required directories, and README presence) on PRs and pushes to main.
Changes:
- Introduces a new “Repository Policy Enforcement” workflow.
- Adds branch naming validation, large-file checks, and basic repo structure validation.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| for file in $(git ls-files); do | ||
| size=$(stat -c%s "$file") | ||
| if [ $size -gt $MAX_SIZE ]; then |
There was a problem hiding this comment.
for file in $(git ls-files) will break on filenames containing spaces/newlines due to word-splitting, which can cause incorrect size checks or failures. Use a NUL-delimited loop (e.g., git ls-files -z with while IFS= read -r -d '' file; do ...) or similar quoting-safe iteration.
| for file in $(git ls-files); do | |
| size=$(stat -c%s "$file") | |
| if [ $size -gt $MAX_SIZE ]; then | |
| git ls-files -z | while IFS= read -r -d '' file; do | |
| size=$(stat -c%s "$file") | |
| if [ "$size" -gt "$MAX_SIZE" ]; then |
| pull-requests: read | ||
| checks: write | ||
|
|
There was a problem hiding this comment.
The workflow requests checks: write and pull-requests: read, but the steps only run local shell checks and don't create/update checks or call the PR API. Consider removing unused permissions (or setting permissions: { contents: read }) to follow least-privilege.
| pull-requests: read | |
| checks: write |
| # 🔹 Prevent large files (Excel models can get big—control it) | ||
| - name: Check for large files | ||
| run: | | ||
| MAX_SIZE=5000000 | ||
| for file in $(git ls-files); do | ||
| size=$(stat -c%s "$file") | ||
| if [ $size -gt $MAX_SIZE ]; then | ||
| echo "❌ File $file exceeds 5MB limit" | ||
| exit 1 | ||
| fi | ||
| done | ||
|
|
||
| # 🔹 Ensure required project structure exists | ||
| - name: Validate repo structure | ||
| run: | | ||
| REQUIRED_DIRS=("model" "docs" "screenshots") | ||
| for dir in "${REQUIRED_DIRS[@]}"; do | ||
| if [ ! -d "$dir" ]; then | ||
| echo "❌ Missing required directory: $dir" | ||
| exit 1 | ||
| fi | ||
| done | ||
|
|
||
| # 🔹 Ensure README exists | ||
| - name: Check README | ||
| run: | | ||
| if [ ! -f "README.md" ]; then | ||
| echo "❌ README.md is missing" | ||
| exit 1 | ||
| fi | ||
|
|
There was a problem hiding this comment.
This workflow duplicates checks already enforced in .github/workflows/validate-repo-structure.yml (required dirs/files and large-file scanning) but with different thresholds and required directories. Keeping both will likely lead to inconsistent/duplicated policy failures over time; consider consolidating into the existing workflow (or removing/aligning one set of requirements).
| # 🔹 Prevent large files (Excel models can get big—control it) | |
| - name: Check for large files | |
| run: | | |
| MAX_SIZE=5000000 | |
| for file in $(git ls-files); do | |
| size=$(stat -c%s "$file") | |
| if [ $size -gt $MAX_SIZE ]; then | |
| echo "❌ File $file exceeds 5MB limit" | |
| exit 1 | |
| fi | |
| done | |
| # 🔹 Ensure required project structure exists | |
| - name: Validate repo structure | |
| run: | | |
| REQUIRED_DIRS=("model" "docs" "screenshots") | |
| for dir in "${REQUIRED_DIRS[@]}"; do | |
| if [ ! -d "$dir" ]; then | |
| echo "❌ Missing required directory: $dir" | |
| exit 1 | |
| fi | |
| done | |
| # 🔹 Ensure README exists | |
| - name: Check README | |
| run: | | |
| if [ ! -f "README.md" ]; then | |
| echo "❌ README.md is missing" | |
| exit 1 | |
| fi |
| name: Repository Policy Enforcement | ||
|
|
||
| on: | ||
| pull_request: | ||
| push: | ||
| branches: [ "main" ] |
There was a problem hiding this comment.
This workflow file is placed under .github/workflows/.github/workflows/, but GitHub Actions only loads workflows from the repository root path .github/workflows/*.yml. As-is, this workflow will not run; move it to .github/workflows/policy-enforcement.yml (and remove the extra nested .github/workflows directory).
No description provided.