Repository navigation
refact(system/init): drop the unused /data/shieldor directory #67
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: Apache-2.0 | |
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - development | |
| permissions: | |
| contents: read | |
| jobs: | |
| dco: | |
| name: DCO sign-off | |
| # Only pull requests. History predating brain decision 0008 is unsigned and | |
| # is deliberately not rewritten, so checking pushes would fail on ancestors. | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Every commit carries a matching Signed-off-by | |
| shell: bash | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| missing=0 | |
| checked=0 | |
| # Merge commits are exempt: they carry no authored change. | |
| while read -r sha; do | |
| [[ -n "${sha}" ]] || continue | |
| checked=$((checked + 1)) | |
| author="$(git log -1 --format='%aN <%aE>' "${sha}")" | |
| if ! git log -1 --format='%(trailers:key=Signed-off-by,valueonly)' "${sha}" \ | |
| | grep -qiFx "${author}"; then | |
| echo "::error::${sha:0:8} $(git log -1 --format=%s "${sha}")" | |
| echo " no Signed-off-by matching the author: ${author}" | |
| missing=$((missing + 1)) | |
| fi | |
| done < <(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}") | |
| if (( missing > 0 )); then | |
| echo | |
| echo "${missing} of ${checked} commit(s) lack a matching sign-off." | |
| echo "Fix with: git rebase --signoff ${BASE_SHA}" | |
| echo "Then: git push --force-with-lease" | |
| echo "See DCO.txt and CONTRIBUTING.md." | |
| exit 1 | |
| fi | |
| echo "OK: all ${checked} commit(s) signed off." | |
| license-headers: | |
| name: SPDX license headers | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Every in-scope file carries an SPDX header | |
| run: .github/scripts/spdx-headers.sh check | |
| shellcheck: | |
| name: shellcheck | |
| runs-on: ubuntu-latest | |
| # Gating since 2026-08-28: every script is clean at --severity=warning in | |
| # all four repositories. A new warning is a change to fix, not to absorb. | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Run shellcheck | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| command -v shellcheck >/dev/null || sudo apt-get install -y shellcheck | |
| mapfile -t files < <(git ls-files '*.sh') | |
| if (( ${#files[@]} == 0 )); then | |
| echo "No shell scripts." | |
| exit 0 | |
| fi | |
| shellcheck --severity=warning --external-sources "${files[@]}" | |
| tests: | |
| name: Bash test suite | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| # The suite needs two tools the repository depends on but does not ship: | |
| # jv validates system.json against system-schema.json (system/cuos/init.sh, | |
| # system-schema.test.sh), and yq reads cloud-init YAML | |
| # (cloud-init-to-system-json.sh). yq happens to exist on ubuntu-latest; | |
| # installing it anyway is the difference between a suite that passes | |
| # because we said what it needs and one that passes because of the runner | |
| # image. Both pinned: a tool that changes under us turns the suite red for | |
| # no reason. | |
| - name: Install jv and yq | |
| shell: bash | |
| env: | |
| JV_VERSION: v6.0.3 | |
| YQ_VERSION: v4.53.6 | |
| run: | | |
| set -euo pipefail | |
| curl -fsSL "https://github.com/santhosh-tekuri/jsonschema/releases/download/${JV_VERSION}/jv-${JV_VERSION}-linux-amd64.tar.gz" \ | |
| | sudo tar -xz -C /usr/local/bin jv | |
| sudo curl -fsSL -o /usr/local/bin/yq \ | |
| "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" | |
| sudo chmod +x /usr/local/bin/yq | |
| jv --version | |
| yq --version | |
| - name: Run every *.test.sh | |
| shell: bash | |
| run: | | |
| set -uo pipefail | |
| # git ls-files, not find: it skips node_modules, build output and | |
| # anything else untracked, and it fails loudly on a broken checkout. | |
| mapfile -t files < <(git ls-files '*.test.sh') | |
| if (( ${#files[@]} == 0 )); then | |
| echo "No test scripts in this repository." | |
| exit 0 | |
| fi | |
| status=0 | |
| for file in "${files[@]}"; do | |
| echo "::group::${file}" | |
| if ! bash "${file}"; then | |
| status=1 | |
| echo "::error file=${file}::${file} failed" | |
| fi | |
| echo "::endgroup::" | |
| done | |
| exit "${status}" |