04ec6693b3
All checks were successful
CI / skinny-install (aco) (push) Successful in 51s
CI / skinny-install (api) (push) Successful in 30s
CI / skinny-install (bcda) (push) Successful in 24s
CI / skinny-install (bib) (push) Successful in 25s
CI / skinny-install (bls) (push) Successful in 20s
CI / skinny-install (ccw) (push) Successful in 34s
CI / skinny-install (cli) (push) Successful in 27s
CI / skinny-install (cms) (push) Successful in 24s
CI / skinny-install (conf) (push) Successful in 25s
CI / skinny-install (pfs) (push) Successful in 25s
CI / skinny-install (rex) (push) Successful in 25s
CI / lint-test (push) Successful in 6m4s
Infra CI / notebooks (push) Successful in 7s
Infra CI / zotero (push) Successful in 7s
Infra CI / docs (push) Successful in 37s
Infra CI / api (push) Successful in 6s
Infra CI / mc (push) Successful in 7s
Deploy / build-scan-report (push) Successful in 4m0s
Add backend-agnostic CI failure reporter (api.diag.ci) and wire `if: failure()` steps into every job across all generated workflows. - src/api/diag/ci.py: CLI tool that files Gitea issues with workflow, job, run, commit context — works with Gitea Actions, GitHub Actions, and Woodpecker (takes args, not env-specific) - dev/scripts/backends/gitea.py: _failure_step() added to all 6 workflows (11 jobs total) - dev/scripts/backends/github.py: same _failure_step() pattern for GitHub Actions backend - .gitea/workflows/pkg-supply-chain.yml: manual failure step added (stale generated file) - 6 new tests, 12,061 total passing Now ANY step failure in ANY CI workflow on ANY backend will auto-create a Gitea issue with the workflow name, job, run number, and commit SHA.
71 lines
2.1 KiB
YAML
71 lines
2.1 KiB
YAML
# DO NOT EDIT — generated by gen_config.py from stack.toml
|
|
# Re-generate: uv run python dev/scripts/gen_config.py
|
|
|
|
name: Package Supply Chain
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- "**/Dockerfile*"
|
|
- "pyproject.toml"
|
|
- "uv.lock"
|
|
- "docs/package.json"
|
|
- "docs/pnpm-lock.yaml"
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "0 6 * * *"
|
|
|
|
jobs:
|
|
pkg-supply-chain:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Set up uv
|
|
run: curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
env:
|
|
UV_INSTALL_DIR: /usr/local/bin
|
|
|
|
- name: Install dependencies
|
|
run: uv sync --no-dev
|
|
|
|
- name: Package inventory
|
|
run: uv run python dev/scripts/pkg_inventory.py
|
|
|
|
- name: Check manifest freshness
|
|
run: uv run python dev/scripts/pkg_inventory.py --check
|
|
|
|
- name: Sync to Gitea package registry
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: uv run python dev/scripts/pkg_mirror_sync.py
|
|
|
|
- name: Drift detection
|
|
run: uv run python dev/scripts/pkg_drift.py
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
|
|
|
|
- name: Vulnerability scan
|
|
run: |
|
|
trivy fs --scanners vuln --format json -o data/pkg-vulns.json uv.lock || true
|
|
trivy fs --scanners vuln --format json -o data/pkg-vulns-pyproject.json pyproject.toml || true
|
|
|
|
- name: Auto-create issues for drift and vulns
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: uv run python dev/scripts/pkg_issues.py
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Package Supply Chain" --job "pkg-supply-chain" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|