ci(validate): unbreak Validate learner branches (git identity + gitleaks OSS) #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Validate learner branches | |
| # Validation gate for the ACC start-of-module-N delta store. Runs on any PR that | |
| # touches the delta store / course-build tooling, and is reusable (workflow_call) | |
| # so the dispatch receiver can gate a regen PR on the same checks. | |
| on: | |
| pull_request: | |
| paths: | |
| - 'course-build/**' | |
| - '.github/workflows/validate-branches.yml' | |
| workflow_dispatch: | |
| inputs: | |
| dispatch_id: | |
| description: 'Staging namespace to validate (regen/<id>/...)' | |
| required: false | |
| default: 'ci-manual' | |
| ref: | |
| description: 'Git ref (branch/SHA) to validate' | |
| required: false | |
| default: '' | |
| workflow_call: | |
| inputs: | |
| dispatch_id: | |
| description: 'Staging namespace to validate' | |
| required: false | |
| type: string | |
| default: 'ci-call' | |
| ref: | |
| description: 'Git ref (branch/SHA) to validate. Defaults to the caller ref.' | |
| required: false | |
| type: string | |
| default: '' | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: validate-branches-${{ github.ref }}-${{ inputs.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Fast, deterministic checks: deltas apply cleanly onto acc-base, each cumulative | |
| # tree matches manifest.expectedTreeSha, expected .github assets present, ancestry | |
| # linear. Also emits the buildable start-branch matrix for the heavy job. | |
| verify-deltas: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| branches: ${{ steps.matrix.outputs.branches }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # need full history + base commit for git am | |
| ref: ${{ inputs.ref || github.ref }} | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| - name: Ensure base commit present | |
| run: git fetch --no-tags origin "$(node -e "console.log(require('./course-build/manifest.json').base.sha)")" || true | |
| - name: Configure git identity (for git am) | |
| run: | | |
| git config user.name "acc-course-bot" | |
| git config user.email "acc-course-bot@users.noreply.github.com" | |
| - name: Deterministic delta check (trees, assets, ancestry) | |
| run: node course-build/scripts/build-branches.mjs --check | |
| - name: Self-test (classification + path detection) | |
| run: node course-build/scripts/selftest.mjs | |
| - name: Compute buildable start-branch matrix | |
| id: matrix | |
| run: | | |
| branches=$(node -e "const m=require('./course-build/manifest.json');const b=m.modules.filter(x=>x.status==='backfilled'&&(x.patches||[]).length).map(x=>x.startBranch);process.stdout.write(JSON.stringify(b))") | |
| echo "branches=$branches" >> "$GITHUB_OUTPUT" | |
| echo "Buildable: $branches" | |
| # Secret scan of the delta store and everything the built branches would contain. | |
| # Runs the gitleaks OSS binary directly rather than gitleaks/gitleaks-action@v2, | |
| # which requires a paid GITLEAKS_LICENSE secret for organization repositories. | |
| secret-scan: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ inputs.ref || github.ref }} | |
| - name: gitleaks (delta store + course-build) | |
| env: | |
| GITLEAKS_VERSION: '8.30.1' | |
| run: | | |
| set -euo pipefail | |
| curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o /tmp/gitleaks.tar.gz | |
| tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks | |
| /tmp/gitleaks version | |
| # Scan the full commit history (fetch-depth: 0). Exits non-zero on any finding. | |
| /tmp/gitleaks git . --redact --verbose | |
| # Heavy gate: build each buildable learner branch from deltas and run the suites | |
| # that exist in that cumulative state (web / .NET / Java / Python / Playwright), | |
| # plus the no-uncommitted-files-after-setup assertion. | |
| build-and-test: | |
| needs: verify-deltas | |
| if: needs.verify-deltas.outputs.branches != '[]' | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| start_branch: ${{ fromJSON(needs.verify-deltas.outputs.branches) }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ inputs.ref || github.ref }} | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: '22' | |
| - uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: '10.0' | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - uses: actions/setup-java@v4 | |
| with: | |
| distribution: 'temurin' | |
| java-version: '21' | |
| - name: Ensure base commit present | |
| run: git fetch --no-tags origin "$(node -e "console.log(require('./course-build/manifest.json').base.sha)")" || true | |
| - name: Configure git identity (for git am) | |
| run: | | |
| git config user.name "acc-course-bot" | |
| git config user.email "acc-course-bot@users.noreply.github.com" | |
| - name: Provision /data volume for service DBs | |
| # The services default their SQLite databases to /data/<svc>.db (overridable via | |
| # *_DB_PATH), where /data is a mounted volume under docker compose. Bare `mvn test` | |
| # / `dotnet test` / `pytest` on the runner have no such volume, so the Spring | |
| # services abort at startup with "path to '/data/...': '/data' does not exist". | |
| # Create it writable to mirror the runtime contract without touching learner-branch | |
| # app files (which would change the delta-store tree SHAs verify-deltas asserts). | |
| run: sudo mkdir -p /data && sudo chmod 777 /data | |
| - name: Build + validate ${{ matrix.start_branch }} | |
| run: bash course-build/scripts/validate-branch.sh "${{ matrix.start_branch }}" | |
| env: | |
| DISPATCH_ID: ci-${{ github.run_id }} | |
| # Aggregate result used as the required status check / workflow_call output. | |
| summary: | |
| needs: [verify-deltas, secret-scan, build-and-test] | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Fail if any gate failed | |
| run: | | |
| echo "verify-deltas: ${{ needs.verify-deltas.result }}" | |
| echo "secret-scan: ${{ needs.secret-scan.result }}" | |
| echo "build-and-test:${{ needs.build-and-test.result }}" | |
| test "${{ needs.verify-deltas.result }}" = "success" | |
| test "${{ needs.secret-scan.result }}" = "success" | |
| test "${{ needs.build-and-test.result }}" = "success" |