chock-copilot-plugins/.github/workflows/generated-only.yml at main · open-coder-ai/chock-copilot-plugins · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
name: Generated-only

# This repository is compiled output. The guarantee it offers users is that its contents
# are exactly what the catalog published -- so the check is not a lint, it is the security
# argument: regenerate from the pinned sources and fail on any difference. A hand edit, a
# tampered guard script, or a manually added plugin all surface here as a diff.

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - name: Check out this distribution repo
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
        with:
          persist-credentials: false
          path: dist

      # The catalog is checked out first because it names the framework. `.framework-ref`
      # is the emitter version this catalog's published output is defined against, so the
      # only build that can prove this tree came from the catalog is a build with that
      # framework. Checking out `main` here instead -- which is what this did -- compares a
      # fixed tree against a moving emitter: the next merge that changes emitter output
      # turns this check red on a tree nobody touched, while `publish` keeps building from
      # a pinned ref. Deriving both from one file is what keeps verify and publish honest.
      - name: Check out the catalog
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
        with:
          persist-credentials: false
          repository: open-coder-ai/chock-catalog
          path: catalog

      - name: Read the framework ref the catalog declares
        id: framework
        working-directory: catalog
        run: |
          if [ ! -f .framework-ref ]; then
            echo "::error::chock-catalog has no .framework-ref, so there is no declared framework to verify this tree against."
            exit 1
          fi
          ref="$(tr -d '[:space:]' < .framework-ref)"
          if [ -z "$ref" ]; then
            echo "::error::chock-catalog/.framework-ref is empty, so there is no declared framework to verify this tree against."
            exit 1
          fi
          echo "ref=$ref" >> "$GITHUB_OUTPUT"
          echo "Verifying against framework $ref, from chock-catalog/.framework-ref."

      - name: Check out the framework at the ref the catalog declares
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
        with:
          persist-credentials: false
          repository: open-coder-ai/chock
          ref: ${{ steps.framework.outputs.ref }}
          path: framework

      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
        with:
          python-version: '3.12'

      - name: Install the framework from source
        run: pip install ./framework

      - name: Verify the lockfile and index match the published tree
        working-directory: dist
        run: chock marketplace build --dist . --check

      - name: Regenerate from the catalog and diff
        run: |
          chock plugin build --repo catalog --policies-dir base --format agent-plugins --out-dir dist
          chock plugin build --repo catalog --policies-dir base --format claude --out-dir dist
          chock plugin build --repo catalog --policies-dir base --format copilot --out-dir dist
          chock marketplace build --dist dist
          cd dist
          if ! git diff --exit-code; then
            echo "::error::This repository is generated. Regenerating from the catalog produced a different tree, so something here was not published by the catalog. Open a pull request against open-coder-ai/chock-catalog instead."
            exit 1
          fi
          echo "Tree matches a fresh build from the catalog."

      - name: Validate every package with Claude Code's own validator
        run: |
          # Pinned: this binary IS the verification step, so a floating version means the
          # check itself changes under us without review.
          npm install -g @anthropic-ai/claude-code@2.1.239
          failed=0
          for d in dist/claude/*/; do
            claude plugin validate "$d" || failed=1
          done
          claude plugin validate dist || failed=1
          exit $failed