TFactory/.github/workflows/factory-github-drift.yml at dev · olafkfreund/TFactory · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
name: factory-github drift

# Factory#157 (epic Factory#154): the GitHub/VCS runner layer under
# apps/backend/runners/github/ (gh_client.py, rate_limiter.py, providers/*) is a
# vendored copy of the canonical that lives in the Factory hub at
# shared/factory-github/. This gate fetches the hub's drift checker AND the
# canonical tree at a PINNED hub SHA and fails the build if this repo's copy has
# drifted byte-for-byte. Reconcile by re-vendoring from the hub canonical (do NOT
# edit the copy to silence the gate - fix the hub canonical first; see
# shared/factory-github/README.md).

on:
  pull_request:
    branches: [dev, main]
    # No paths: filter (Factory#3585): a required check must post on every PR.
  push:
    branches: [dev, main]
    paths:
      - "apps/backend/runners/github/**"
      - ".github/workflows/factory-github-drift.yml"

concurrency:
  group: factory-github-drift-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

env:
  # Pinned Factory hub commit that holds the canonical factory-github layer +
  # the drift checker. Bump this (and re-vendor runners/github/) when the
  # canonical changes. See shared/factory-github/README.md in the hub.
  HUB_REPO: "olafkfreund/Factory"
  # The CANONICAL is pinned (reproducible comparison). The CHECKER is not:
  # a gate fetched from its own pin cannot ship its own fix (Factory#405).
  HUB_CHECKER_REF: "main"
  HUB_SHA: "6752fe32de59a215c52c3ab198ffbf183f84db33"

jobs:
  drift:
    name: factory-github canonical drift
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python
        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
        with:
          python-version: "3.12"

      - name: Assert the pinned canonical SHA is really on hub main
        # HUB_SHA lives in THIS file, and on a `pull_request` trigger this file
        # is the PR's copy -- so the pin is PR-controlled. Every fork of Factory
        # shares one object store, so a commit that exists only in a fork is a
        # valid 40-hex SHA and codeload serves it from Factory itself: a fork PR
        # could pin a canonical tree crafted to match its own drifted vendored
        # copy and this gate would diff two matching trees and go green
        # (TFactory#1049). HUB_CHECKER_REF is not checked: `main` is a branch
        # this repo names, not a PR-supplied pin.
        env:
          GH_TOKEN: ${{ github.token }}
          SHA: ${{ env.HUB_SHA }}
        run: .github/scripts/assert-hub-pin-on-main.sh "${SHA}" "factory-github-drift.yml HUB_SHA"

      - name: Fetch hub drift checker (main) + canonical tree (pinned SHA)
        run: |
          set -euo pipefail
          mkdir -p /tmp/hub/canonical
          # Checker from main, NOT from HUB_SHA: every service fetched it from
          # the pin, so Factory#397's fix was unreachable for weeks while the
          # gate stayed green on a credential-holding file (Factory#405).
          curl -fsSL \
            "https://raw.githubusercontent.com/${HUB_REPO}/${HUB_CHECKER_REF}/scripts/check_factory_github_drift.py" \
            -o /tmp/hub/check_factory_github_drift.py
          # ...and its sibling module. Factory#526 added `from gate_evidence
          # import digest` to the checker on the stated assumption that
          # "consumers run this gate out of a full hub checkout" -- which is not
          # true here: we fetch the single file. The self-test therefore died on
          # `ModuleNotFoundError: No module named 'gate_evidence'` in all four
          # services, i.e. the drift gate could not run at all. Fetch it from the
          # SAME ref as the checker, so the two never disagree about a version.
          curl -fsSL \
            "https://raw.githubusercontent.com/${HUB_REPO}/${HUB_CHECKER_REF}/scripts/gate_evidence.py" \
            -o /tmp/hub/gate_evidence.py
          # Canonical as a TREE at the pinned SHA, not a hardcoded file list.
          # The old list could not contain a file nobody knew to add, so the
          # completeness guard globbed a directory that was complete BY
          # CONSTRUCTION and could never fire in CI (Factory#405).
          curl -fsSL "https://codeload.github.com/${HUB_REPO}/tar.gz/${HUB_SHA}" -o /tmp/hub.tgz
          tar -xzf /tmp/hub.tgz -C /tmp/hub/canonical --strip-components=3 \
            --wildcards "*/shared/factory-github/*"

      - name: Verify the checker's own self-test passes
        run: python /tmp/hub/check_factory_github_drift.py --self-test

      - name: Check this repo's copy against the pinned hub canonical (blocking)
        run: |
          python /tmp/hub/check_factory_github_drift.py \
            --canonical /tmp/hub/canonical \
            --service apps/backend/runners/github