Repository navigation
Merge pull request #7 from rulebase-co/chidi/fix-pack-check #36
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: validate | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Lets anyone re-run the checks against a chosen ref without an empty commit. | |
| # Needed in practice: GitHub's hosted runners intermittently fail to pick up | |
| # jobs ("not acquired by Runner of type hosted"), which leaves a red run that | |
| # has nothing to do with the code. | |
| workflow_dispatch: | |
| jobs: | |
| validate: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5 | |
| - uses: actions/setup-node@v5 | |
| with: | |
| node-version: 22 | |
| # No install step: the validator is dependency-free by design. | |
| - name: Validate skill catalog | |
| run: node scripts/validate-skills.mjs --strict | |
| # The published CLI reads skills-index.json from this repo, so a stale | |
| # index ships a catalog that does not match the skills. | |
| - name: Check the skills index is current | |
| run: node scripts/build-index.mjs --check | |
| # The `rulebase` CLI lives in rulebase-co/rulebase-cli and is checked there. | |
| - name: Syntax-check the installer | |
| run: node --check bin/rulebase-skills.js | |
| - name: Syntax-check skill scripts | |
| run: | | |
| set -euo pipefail | |
| shopt -s nullglob globstar | |
| for f in skills/**/scripts/*.mjs; do | |
| echo "checking $f" | |
| node --check "$f" | |
| done | |
| for f in skills/**/scripts/*.sh; do | |
| echo "checking $f" | |
| bash -n "$f" | |
| done | |
| - name: Test skill scripts | |
| run: node --test "tests/*.test.mjs" | |
| - name: Check for committed secrets | |
| run: | | |
| set -euo pipefail | |
| # Zendesk/Intercom/Freshdesk tokens and generic bearer secrets should | |
| # never appear in the catalog. Placeholders in docs use <angle brackets>. | |
| if grep -rInE '(dG9rZW4|Bearer [A-Za-z0-9_-]{20,}|xoxb-[A-Za-z0-9-]{10,}|sk-[A-Za-z0-9]{20,})' \ | |
| --include='*.md' --include='*.mjs' --include='*.sh' --include='*.json' skills/ scripts/; then | |
| echo "::error::possible committed credential above" | |
| exit 1 | |
| fi |