ci: derive the covered set from the matrix, fix the header sim, assert schedule

Three fixes from review on b13d801.

The uncovered warning still named the kinds, which is the one place a stale list
misleads a person rather than a job: adding a fourth kind would have had it report an
example as "not built or booted" while the new job was building and booting it — a
false claim in the only signal a reviewer has, since the per-example job names vanish
when the matrix is filtered. It now derives the covered set from the file, and the
selector publishes one kind-agnostic `selected` output that examples-verified consumes
instead of binding image/zip/stream a third time.

The simulated commit header now uses the entry's own prefix, and stays deliberately
pessimistic: it assumes the `(deps)` scope and a three-digit update count. That is why
it reads longer than the 137 the comment cites, which was measured without the scope.
The report argued for dropping the scope as too strict; I kept it, because being wrong
in the strict direction costs a shortened group name while being wrong in the lax
direction costs a red Commit Lint on a pull request nobody wrote — which is the whole
reason the assertion exists — and every Dependabot pull request in this repository is
titled `chore(deps): ...`, so the scope is what Dependabot infers here. It still leaves
9 characters of headroom at the longest directory configured today, so the pessimism
costs nothing.

schedule.interval is now asserted. It is required for an updates entry and its absence
is the worst copy-paste failure available: Dependabot rejects the whole file, so all 47
groups stop applying at once. Asserted outside the is_example gate, since an invalid
root cargo or github-actions entry invalidates the file just the same.

Exercised: `selected` on all four selector paths; a fourth matrix kind honoured by both
the warning and `selected`; the gate reporting from the single output and still exiting
1 on a failure; a missing schedule on an example and on github-actions.

Author: bnusunny

.github/scripts/check-example-config.sh

@@ -159,6 +159,15 @@ for update in config["updates"]:
             )
         configured.add(key)
 
+    # schedule.interval is required for an updates entry, and its absence is the worst of
+    # the copy-paste failures: Dependabot rejects the whole file, so all 47 groups stop
+    # applying at once and every example reverts to one pull request per advisory. Asserted
+    # for every entry, not just examples — an invalid root cargo or github-actions entry
+    # invalidates the file just the same.
+    if not (update.get("schedule") or {}).get("interval"):
+        problems.append(f"{where}: needs `schedule.interval`; without it Dependabot "
+                        "rejects the whole config and none of the grouping applies.")
+
     # The two grouping assertions below apply to example entries only. Everything else in
     # this script is scoped to examples/ — `found` comes from `git ls-files examples`, the
     # stale check filters on the prefix — and applying them to the root cargo and
@@ -186,6 +195,8 @@ for update in config["updates"]:
         problems.append(f"{where}: needs `open-pull-requests-limit: 0`, or version "
                         "updates come back on for it.")
 
+    prefix = (update.get("commit-message") or {}).get("prefix")
+
     # `patterns` is the other half of the grouping claim: a group with
     # patterns: ["lodash"] satisfies the applies-to assertion above while leaving every
     # other advisory for that example ungrouped, which is the state this file exists to
@@ -206,8 +217,20 @@ for update in config["updates"]:
             # that, so the next example could reintroduce it — headroom is 11 characters
             # at the longest directory configured today.
             for directory in directories:
-                header = (f"chore(deps): bump the {group_name} group in {directory} "
-                          "with 5 updates")
+                # Built from this entry's own prefix, and deliberately pessimistic in two
+                # ways: it assumes the `(deps)` scope and a three-digit update count.
+                #
+                # The scope is why this reads 6 characters longer than the 137 the comment
+                # above cites, which was measured without it. Dependabot infers a
+                # conventional-commit scope from history — every existing Dependabot pull
+                # request here is titled `chore(deps): ...` — and an explicit prefix
+                # without `include: scope` should drop it, but being wrong in the strict
+                # direction costs a shortened group name, while being wrong in the lax
+                # direction costs a red Commit Lint on a pull request nobody wrote, weeks
+                # later. That is the whole point of this assertion. It still leaves 9
+                # characters of headroom at the longest directory configured today.
+                header = (f"{prefix or 'chore'}(deps): bump the {group_name} group in "
+                          f"{directory} with 100 updates")
                 if len(header) > COMMITLINT_HEADER_MAX:
                     problems.append(
                         f"{where}: group {group_name!r} makes a "
@@ -226,7 +249,6 @@ for update in config["updates"]:
     # list comes back empty and the assertion falls back to "a prefix is set", which is
     # the part that matters; a wrong-but-present prefix would then be caught by Commit
     # Lint on the pull request that adds the entry.
-    prefix = (update.get("commit-message") or {}).get("prefix")
     if not prefix:
         problems.append(f"{where}: needs `commit-message.prefix`, or Commit Lint rejects "
                         "the header Dependabot generates.")

.github/scripts/select-examples.sh

@@ -46,6 +46,7 @@ fi
 # jobs would run and die in fromJSON('') with an error unrelated to the real cause.
 emit_all() {
   local kind matrix
+  echo "selected=$(jq -r '[.[][] | .name] | sort | join(", ")' "$MATRIX")" >>"$GITHUB_OUTPUT"
   for kind in "${KINDS[@]}"; do
     # `has` rather than a bare `.$kind`: jq prints the literal `null` and exits 0 for a
     # missing key, so a renamed top-level key in the matrix file wrote `stream=null`,
@@ -127,6 +128,7 @@ if [[ -z "$example_paths" ]]; then
   for kind in "${KINDS[@]}"; do
     echo "$kind=[]" >>"$GITHUB_OUTPUT"
   done
+  echo "selected=" >>"$GITHUB_OUTPUT"
   exit 0
 fi
 
@@ -139,8 +141,12 @@ echo "Changed examples: $names"
 # say it out loud: a reviewer reading one green aggregate check cannot otherwise tell
 # that the bump they are approving was never launched, because the per-example job names
 # disappear when the matrix is filtered.
+# `.[][]` rather than naming the kinds: this is the reviewer's only signal that a bump
+# was not built or booted, so a stale kind list here would claim an example is unverified
+# while a new job is in fact verifying it — a false statement in the one place someone
+# reads. Same reason KINDS is derived above.
 uncovered="$(jq -r --argjson names "$names" \
-  '([.image, .zip, .stream] | flatten | map(.name)) as $covered
+  '[.[][] | .name] as $covered
    | [$names[] | select(IN($covered[]) | not)] | join(", ")' "$MATRIX")"
 if [[ -n "$uncovered" ]]; then
   echo "::warning::No matrix entry builds or boots: $uncovered — this run verifies templates only for them."
@@ -150,6 +156,13 @@ if [[ -n "$uncovered" ]]; then
   fi
 fi
 
+# One kind-agnostic list of what was selected, so examples-verified can report it without
+# binding the kinds a third time.
+selected="$(jq -r --argjson names "$names" \
+  '[.[][] | .name] as $covered | [$names[] | select(IN($covered[]))] | sort | join(", ")' \
+  "$MATRIX")"
+echo "selected=$selected" >>"$GITHUB_OUTPUT"
+
 for kind in "${KINDS[@]}"; do
   # Same has() assertion as emit_all: without it a renamed top-level key fails here with
   # jq's bare "Cannot iterate over null", naming neither the file nor the key, while the

.github/workflows/examples.yaml

@@ -68,6 +68,9 @@ jobs:
       image: ${{ steps.filter.outputs.image }}
       zip: ${{ steps.filter.outputs.zip }}
       stream: ${{ steps.filter.outputs.stream }}
+      # Every selected example name, kind-agnostic, so examples-verified can say what it
+      # verified without binding each kind again.
+      selected: ${{ steps.filter.outputs.selected }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -453,9 +456,7 @@ jobs:
       - name: Check the verification results
         env:
           RESULTS: ${{ join(needs.*.result, ' ') }}
-          IMAGE: ${{ needs.select.outputs.image }}
-          ZIP: ${{ needs.select.outputs.zip }}
-          STREAM: ${{ needs.select.outputs.stream }}
+          SELECTED: ${{ needs.select.outputs.selected }}
         run: |
           echo "job results: $RESULTS"
           for result in $RESULTS; do
@@ -473,12 +474,9 @@ jobs:
           # arrive here green having built and booted nothing. Say which it was, because a
           # reviewer reading this one check has nothing else to go on — the per-example job
           # names vanish when the matrix is filtered, which is why this job exists.
-          verified=$(jq -rn \
-            --argjson image "${IMAGE:-[]}" --argjson zip "${ZIP:-[]}" --argjson stream "${STREAM:-[]}" \
-            '[$image, $zip, $stream] | flatten | map(.name) | unique | join(", ")')
-          if [[ -n "$verified" ]]; then
-            echo "Built and booted: $verified"
-            echo "**Verified:** $verified" >>"$GITHUB_STEP_SUMMARY"
+          if [[ -n "${SELECTED:-}" ]]; then
+            echo "Built and booted: $SELECTED"
+            echo "**Verified:** $SELECTED" >>"$GITHUB_STEP_SUMMARY"
           else
             echo "No example was built or booted; this run verified templates only."
             echo "**No example was built or booted** — template validation only." \