Skip to content

ci(validate): unbreak Validate learner branches (git identity + gitleaks OSS) #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
GeekTrainer merged 10 commits into from
Aug 26, 2026
Merged

ci(validate): unbreak Validate learner branches (git identity + gitleaks OSS) #2

Changes from 2 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
3263ec4
ci(validate): configure git identity in verify-deltas before git am
GeekTrainer Aug 26, 2026
a1cee74
ci(validate): run gitleaks OSS binary instead of the licensed action
GeekTrainer Aug 26, 2026
d7520d7
ci(validate): provision /data volume before build-and-test suites
GeekTrainer Aug 26, 2026
ecf9685
ci(validate): install pytest and gate python suites on real test files
GeekTrainer Aug 26, 2026
9153732
ci(validate): health-gate the full stack before Playwright e2e
GeekTrainer Aug 26, 2026
1488cbb
ci(validate): add e2e failure diagnostics (endpoints + error-context)
GeekTrainer Aug 26, 2026
45ea6ba
ci(validate): sharpen e2e failure diagnostics (real asset id + error-…
GeekTrainer Aug 26, 2026
f5bafe5
ci(validate): revert e2e pre-start/health-gate + diagnostics (wrong t…
GeekTrainer Aug 26, 2026
4ea5a37
fix(course): correct QR e2e selector so it opens a real asset, not /a…
GeekTrainer Aug 26, 2026
6f93ec6
ci(validate): verify gitleaks tarball checksum before executing
GeekTrainer Aug 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 14 additions & 3 deletions .github/workflows/validate-branches.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,10 @@ jobs:
node-version: '22'
- name: Ensure base commit present
run: git fetch --no-tags origin "$(node -e "console.log(require('./course-build/manifest.json').base.sha)")" || true
- name: Configure git identity (for git am)
run: |
git config user.name "acc-course-bot"
git config user.email "acc-course-bot@users.noreply.github.com"
- name: Deterministic delta check (trees, assets, ancestry)
run: node course-build/scripts/build-branches.mjs --check
- name: Self-test (classification + path detection)
Expand All @@ -69,6 +73,8 @@ jobs:
echo "Buildable: $branches"

# Secret scan of the delta store and everything the built branches would contain.
# Runs the gitleaks OSS binary directly rather than gitleaks/gitleaks-action@v2,
# which requires a paid GITLEAKS_LICENSE secret for organization repositories.
secret-scan:
runs-on: ubuntu-latest
steps:
Expand All @@ -77,10 +83,15 @@ jobs:
fetch-depth: 0
ref: ${{ inputs.ref || github.ref }}
- name: gitleaks (delta store + course-build)
uses: gitleaks/gitleaks-action@v2
env:
GITLEAKS_ENABLE_UPLOAD_ARTIFACT: 'false'
GITLEAKS_ENABLE_SUMMARY: 'true'
GITLEAKS_VERSION: '8.30.1'
run: |
set -euo pipefail
curl -sSfL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" -o /tmp/gitleaks.tar.gz
tar -xzf /tmp/gitleaks.tar.gz -C /tmp gitleaks
Comment thread
GeekTrainer marked this conversation as resolved.
/tmp/gitleaks version
# Scan the full commit history (fetch-depth: 0). Exits non-zero on any finding.
/tmp/gitleaks git . --redact --verbose

# Heavy gate: build each buildable learner branch from deltas and run the suites
# that exist in that cumulative state (web / .NET / Java / Python / Playwright),
Expand Down
Loading