Recovery liveness, storage fault-injection matrix, and one storage implementation over object_store #137
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CODEOWNERS | |
| # Runs on EVERY pull request (no paths filter). The two jobs below are | |
| # required status checks on `main`; a path-filtered required check never | |
| # reports for PRs outside the filter and leaves them permanently "pending" | |
| # (the trap that forced admin-override merges). Always-run + cheap | |
| # short-circuit is what keeps them honest. | |
| on: | |
| pull_request: | |
| workflow_dispatch: | |
| # `drift` auto-commits the regenerated artifacts back to same-repo PR | |
| # branches, so it needs write access. | |
| permissions: | |
| contents: write | |
| jobs: | |
| # NOTE: the job `name:` values below ("CODEOWNERS matches source" / | |
| # "CODEOWNERS not hand-edited") ARE the status-check contexts that | |
| # .github/branch-protection.json must list verbatim. Renaming a job here | |
| # is a branch-protection change — update the JSON and re-apply. | |
| drift: | |
| name: CODEOWNERS matches source | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5.0.1 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5.4.0 | |
| with: | |
| python-version: '3.13' | |
| - name: Install PyYAML | |
| run: pip install pyyaml | |
| - name: Re-render CODEOWNERS + ownership docs | |
| run: python3 .github/scripts/render-codeowners.py | |
| # Same-repo PR: push the regenerated artifacts back so contributors | |
| # never have to run the script locally. Mirrors the openapi.json | |
| # auto-commit in ci.yml (separate shallow clone of the head branch so | |
| # the pushed commit carries only the regenerated files). | |
| - name: Commit regenerated artifacts to PR branch | |
| if: | | |
| github.event_name == 'pull_request' && | |
| github.event.pull_request.head.repo.full_name == github.repository | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| if git diff --quiet -- .github/CODEOWNERS docs/dev/codeowners.md; then | |
| echo "CODEOWNERS and ownership docs already in sync." | |
| exit 0 | |
| fi | |
| tmp=$(mktemp -d) | |
| git clone --depth 1 --branch "${{ github.head_ref }}" \ | |
| "https://x-access-token:${GITHUB_TOKEN}@github.com/${{ github.repository }}.git" \ | |
| "$tmp" | |
| cp .github/CODEOWNERS "$tmp/.github/CODEOWNERS" | |
| cp docs/dev/codeowners.md "$tmp/docs/dev/codeowners.md" | |
| cd "$tmp" | |
| if git diff --quiet -- .github/CODEOWNERS docs/dev/codeowners.md; then | |
| echo "Head branch already matches; nothing to push." | |
| exit 0 | |
| fi | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add .github/CODEOWNERS docs/dev/codeowners.md | |
| git commit -m "chore: regenerate CODEOWNERS + ownership docs" | |
| git push | |
| # Fork PR / workflow_dispatch: cannot push back, so enforce drift | |
| # strictly. The contributor runs the script and commits the result. | |
| - name: Verify in sync (forks / manual runs) | |
| if: | | |
| !(github.event_name == 'pull_request' && | |
| github.event.pull_request.head.repo.full_name == github.repository) | |
| run: | | |
| if ! git diff --quiet -- .github/CODEOWNERS docs/dev/codeowners.md; then | |
| echo "::error::Generated CODEOWNERS / ownership docs are out of sync with .github/codeowners-roles.yml." | |
| echo "::error::Run \`python3 .github/scripts/render-codeowners.py\` and commit the result." | |
| echo "--- diff ---" | |
| git --no-pager diff -- .github/CODEOWNERS docs/dev/codeowners.md | |
| exit 1 | |
| fi | |
| echo "Generated artifacts are in sync with their source." | |
| noedit: | |
| name: CODEOWNERS not hand-edited | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v5.0.1 | |
| with: | |
| # Need history so we can diff against the PR base. | |
| fetch-depth: 0 | |
| - name: Reject hand-edits to generated file | |
| # Only meaningful for PRs (needs a base to diff against). | |
| if: github.event_name == 'pull_request' | |
| run: | | |
| base="origin/${{ github.base_ref }}" | |
| git fetch origin "${{ github.base_ref }}" --quiet | |
| changed=$(git diff --name-only "$base" HEAD) | |
| edited_generated=$(echo "$changed" | grep -E '^\.github/CODEOWNERS$' || true) | |
| edited_source=$(echo "$changed" | grep -E '^\.github/codeowners-roles\.yml$' || true) | |
| if [ -n "$edited_generated" ] && [ -z "$edited_source" ]; then | |
| echo "::error::This PR edits .github/CODEOWNERS but not its source .github/codeowners-roles.yml." | |
| echo "::error::Edit the yml and regenerate via \`python3 .github/scripts/render-codeowners.py\`." | |
| exit 1 | |
| fi | |
| echo "CODEOWNERS edits accompany source edits (or no CODEOWNERS edits in this PR)." |