smoke.yml

name: Smoke tests

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  smoke:
    runs-on: ubuntu-latest
    steps:
      # Fork sync forks from the merge base of HEAD and origin/main, and a
      # fork's release checks read its tag history, so a shallow clone
      # fails both.
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: pip install pyyaml
      # A fork names its upstream in the UPSTREAM_REPO repository variable.
      # Its history then holds upstream's commits, whose issue numbers belong
      # to another tracker, and SYS-20 needs upstream's manifest to compare
      # against. Upstream sets no variable and skips this.
      - name: Fetch the upstream this fork names
        if: vars.UPSTREAM_REPO != ''
        env:
          UPSTREAM_REPO: ${{ vars.UPSTREAM_REPO }}
        run: |
          git fetch --no-tags "https://github.com/${UPSTREAM_REPO}.git" \
            "+refs/heads/main:refs/remotes/upstream/main"
          echo "SAIT_UPSTREAM_REF=upstream/main" >> "$GITHUB_ENV"
          echo "UPSTREAM_REF=upstream/main" >> "$GITHUB_ENV"
          git log -1 --format='upstream/main: %h %s' upstream/main
      - name: Run smoke tests
        run: python tests/run_smoke.py
      - name: Run the templates' own checks against this repository
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: python tests/run_conformance.py
      # A fork syncs by merging upstream. This merges the change under test
      # into a simulated fork and runs smoke on the result.
      - name: Check a fork that only appends merges this change
        run: python tests/run_fork_sync.py
      - name: Check the release check still reads its planted cases
        run: python tools/release_check.py --self-test
      - name: Check generated docs are up to date
        run: python tools/sync.py --check
      - name: Check generated/ files are up to date
        run: python tools/resolve.py --check
      - name: Check for new redundant rules
        run: python tools/audit_redundancy.py --check
      # A template may get better, never worse: each file's score is held to
      # its row in tests/template-quality-baseline.txt.
      - name: Check no template's quality score fell
        run: python tools/template_quality.py --check
      # The tooling is the gate, so an unused import or an undefined name in
      # it is a defect nothing else reports. Versions are pinned so a release
      # of either linter cannot turn a green tree red.
      - name: Lint the Python tooling
        run: |
          pip install pyflakes==4.0.2
          python -m pyflakes tools tests
      # Reads .markdownlint.json for the rules and .markdownlint-cli2.jsonc
      # for the files, which records the ones that predate this step.
      - name: Lint Markdown
        run: npx --yes markdownlint-cli2@0.23.3
      - name: Install gitleaks
        run: |
          curl -sSfL https://github.com/gitleaks/gitleaks/releases/download/v8.21.2/gitleaks_8.21.2_linux_x64.tar.gz | tar -xz
          sudo mv gitleaks /usr/local/bin/
      - name: Secret detection (gitleaks)
        run: gitleaks detect --source . --verbose