Skip to content

Create policy-enforcement.yml #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mr-adonis-jimenez merged 1 commit into from
Mar 26, 2026
Merged

Create policy-enforcement.yml #6

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 68 additions & 0 deletions .github/workflows/.github/workflows/policy-enforcement.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,68 @@
name: Repository Policy Enforcement

on:
pull_request:
push:
branches: [ "main" ]
Comment on lines +1 to +6

Copilot AI Mar 26, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow file is placed under .github/workflows/.github/workflows/, but GitHub Actions only loads workflows from the repository root path .github/workflows/*.yml. As-is, this workflow will not run; move it to .github/workflows/policy-enforcement.yml (and remove the extra nested .github/workflows directory).

Copilot uses AI. Check for mistakes.

permissions:
contents: read
pull-requests: read
checks: write

Comment on lines +10 to +12

Copilot AI Mar 26, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The workflow requests checks: write and pull-requests: read, but the steps only run local shell checks and don't create/update checks or call the PR API. Consider removing unused permissions (or setting permissions: { contents: read }) to follow least-privilege.

Suggested change
pull-requests: read
checks: write

Copilot uses AI. Check for mistakes.
concurrency:
group: policy-${{ github.ref }}
cancel-in-progress: true

jobs:
policy-checks:
runs-on: ubuntu-latest

steps:
- name: Checkout repo
uses: actions/checkout@v4

# 🔹 Enforce branch naming convention
- name: Validate branch name
if: github.event_name == 'pull_request'
run: |
BRANCH_NAME="${{ github.head_ref }}"
echo "Checking branch: $BRANCH_NAME"
if [[ ! "$BRANCH_NAME" =~ ^(main|feature\/.+|bugfix\/.+|hotfix\/.+|chore\/.+)$ ]]; then
echo "❌ Invalid branch naming convention"
exit 1
fi

# 🔹 Prevent large files (Excel models can get big—control it)
- name: Check for large files
run: |
MAX_SIZE=5000000
for file in $(git ls-files); do
size=$(stat -c%s "$file")
if [ $size -gt $MAX_SIZE ]; then
Comment on lines +40 to +42

Copilot AI Mar 26, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for file in $(git ls-files) will break on filenames containing spaces/newlines due to word-splitting, which can cause incorrect size checks or failures. Use a NUL-delimited loop (e.g., git ls-files -z with while IFS= read -r -d '' file; do ...) or similar quoting-safe iteration.

Suggested change
for file in $(git ls-files); do
size=$(stat -c%s "$file")
if [ $size -gt $MAX_SIZE ]; then
git ls-files -z | while IFS= read -r -d '' file; do
size=$(stat -c%s "$file")
if [ "$size" -gt "$MAX_SIZE" ]; then

Copilot uses AI. Check for mistakes.
echo "❌ File $file exceeds 5MB limit"
exit 1
fi
done

# 🔹 Ensure required project structure exists
- name: Validate repo structure
run: |
REQUIRED_DIRS=("model" "docs" "screenshots")
for dir in "${REQUIRED_DIRS[@]}"; do
if [ ! -d "$dir" ]; then
echo "❌ Missing required directory: $dir"
exit 1
fi
done

# 🔹 Ensure README exists
- name: Check README
run: |
if [ ! -f "README.md" ]; then
echo "❌ README.md is missing"
exit 1
fi

Comment on lines +36 to +66

Copilot AI Mar 26, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow duplicates checks already enforced in .github/workflows/validate-repo-structure.yml (required dirs/files and large-file scanning) but with different thresholds and required directories. Keeping both will likely lead to inconsistent/duplicated policy failures over time; consider consolidating into the existing workflow (or removing/aligning one set of requirements).

Suggested change
# 🔹 Prevent large files (Excel models can get big—control it)
- name: Check for large files
run: |
MAX_SIZE=5000000
for file in $(git ls-files); do
size=$(stat -c%s "$file")
if [ $size -gt $MAX_SIZE ]; then
echo "❌ File $file exceeds 5MB limit"
exit 1
fi
done
# 🔹 Ensure required project structure exists
- name: Validate repo structure
run: |
REQUIRED_DIRS=("model" "docs" "screenshots")
for dir in "${REQUIRED_DIRS[@]}"; do
if [ ! -d "$dir" ]; then
echo "❌ Missing required directory: $dir"
exit 1
fi
done
# 🔹 Ensure README exists
- name: Check README
run: |
if [ ! -f "README.md" ]; then
echo "❌ README.md is missing"
exit 1
fi

Copilot uses AI. Check for mistakes.
- name: Policy checks passed
run: echo "✅ All policy checks passed"
Loading