verify.yml

name: verify

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    # Mondays 06:00 UTC — refreshes the cargo-deny advisory DB and surfaces
    # newly-disclosed RUSTSEC advisories on pinned dependencies between PRs.
    - cron: '0 6 * * 1'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  gate:
    # Skip scheduled runs on forks — only the upstream repo's cron should fire.
    if: github.event_name != 'schedule' || github.repository == 'no42-org/onmsctl'
    # Shared with release.yml and docker.yml — see gates.yml.
    uses: ./.github/workflows/gates.yml

  notify-on-cron-failure:
    # Open a tracking issue when the scheduled run fails, so a freshly-disclosed
    # RUSTSEC advisory does not silently rot. Only fires for the cron event.
    needs: gate
    if: failure() && github.event_name == 'schedule' && github.repository == 'no42-org/onmsctl'
    runs-on: ubuntu-24.04 # was ubuntu-latest
    permissions:
      issues: write
    timeout-minutes: 5
    steps:
      - name: Open tracking issue
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          set -euo pipefail
          gh issue create \
            --repo "${GITHUB_REPOSITORY}" \
            --title "Scheduled verify failed: $(date -u +%Y-%m-%d)" \
            --body "$(printf 'Weekly cron run failed. Likely a freshly-disclosed advisory or a transient infrastructure issue.\n\nRun: %s\n' "${RUN_URL}")" \
            --label ci \
            --label scheduled-failure