ci: codeql-guard to keep CodeQL out of evalops/* #26
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: codex-rails-check | |
| on: | |
| pull_request: | |
| paths: | |
| - "AGENTS.md" | |
| - "**/AGENTS.md" | |
| - "README.md" | |
| - ".agents/skills/**" | |
| - ".github/codex/schemas/**" | |
| - ".github/scripts/**" | |
| - ".github/ISSUE_TEMPLATE/**" | |
| - ".github/pull_request_template.md" | |
| - ".github/workflows/**" | |
| - ".github/workflow-templates/**" | |
| - "profile/**" | |
| - "services.yaml" | |
| - "test/**" | |
| workflow_call: | |
| inputs: | |
| require_agents: | |
| description: "Fail when the repository does not have AGENTS.md" | |
| required: false | |
| type: boolean | |
| default: false | |
| runner_label: | |
| description: "Runner label used for the validation job" | |
| required: false | |
| type: string | |
| default: blacksmith-4vcpu-ubuntu-2404 | |
| permissions: | |
| contents: read | |
| jobs: | |
| validate: | |
| runs-on: ${{ inputs.runner_label || 'blacksmith-4vcpu-ubuntu-2404' }} | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 | |
| - name: Validate issue template YAML | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| shopt -s globstar nullglob | |
| files=(.github/ISSUE_TEMPLATE/*.yml .github/ISSUE_TEMPLATE/*.yaml) | |
| if [ "${#files[@]}" -eq 0 ]; then | |
| echo "No issue template YAML files found." | |
| exit 0 | |
| fi | |
| ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f); puts "ok #{f}" }' "${files[@]}" | |
| - name: Validate workflow YAML | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| shopt -s nullglob | |
| files=(.github/workflows/*.yml .github/workflows/*.yaml .github/workflow-templates/*.yml .github/workflow-templates/*.yaml) | |
| if [ "${#files[@]}" -eq 0 ]; then | |
| echo "No workflow YAML files found." | |
| exit 0 | |
| fi | |
| ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f); puts "ok #{f}" }' "${files[@]}" | |
| - name: Validate workflow template metadata | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| shopt -s nullglob | |
| files=(.github/workflow-templates/*.properties.json) | |
| if [ "${#files[@]}" -eq 0 ]; then | |
| echo "No workflow template metadata files found." | |
| exit 0 | |
| fi | |
| ruby -e ' | |
| require "json" | |
| ARGV.each do |f| | |
| data = JSON.parse(File.read(f)) | |
| icon = data["iconName"].to_s | |
| if !icon.empty? && !icon.match?(/\Aocticon [a-z0-9-]+\z/) && !File.exist?(".github/workflow-templates/#{icon}.svg") | |
| warn "#{f}: iconName must be an octicon reference like \"octicon tag\" or a local SVG basename" | |
| exit 1 | |
| end | |
| puts "ok #{f}" | |
| end | |
| ' "${files[@]}" | |
| - name: Validate Codex JSON schemas | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| shopt -s nullglob | |
| files=(.github/codex/schemas/*.json) | |
| if [ "${#files[@]}" -eq 0 ]; then | |
| echo "No Codex JSON schemas found." | |
| exit 0 | |
| fi | |
| ruby -e 'require "json"; ARGV.each { |f| JSON.parse(File.read(f)); puts "ok #{f}" }' "${files[@]}" | |
| - name: Check AGENTS.md files | |
| shell: bash | |
| env: | |
| REQUIRE_AGENTS: ${{ inputs.require_agents || false }} | |
| run: | | |
| set -euo pipefail | |
| shopt -s globstar nullglob | |
| if [ "${REQUIRE_AGENTS}" = "true" ] && [ ! -f AGENTS.md ]; then | |
| echo "::error::AGENTS.md is required for this repository." | |
| exit 1 | |
| fi | |
| agents=(**/AGENTS.md) | |
| if [ "${#agents[@]}" -eq 0 ]; then | |
| echo "No AGENTS.md files found." | |
| exit 0 | |
| fi | |
| for agent in "${agents[@]}"; do | |
| test -s "${agent}" || { echo "::error::${agent} is empty"; exit 1; } | |
| echo "ok ${agent}" | |
| done | |
| - name: Validate skill frontmatter | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| shopt -s globstar nullglob | |
| skills=(.agents/skills/**/SKILL.md) | |
| if [ "${#skills[@]}" -eq 0 ]; then | |
| echo "No repo skills found." | |
| exit 0 | |
| fi | |
| for skill in "${skills[@]}"; do | |
| echo "checking ${skill}" | |
| ruby -e ' | |
| path = ARGV.fetch(0) | |
| text = File.read(path) | |
| unless text.start_with?("---\n") | |
| warn "#{path}: missing YAML frontmatter" | |
| exit 1 | |
| end | |
| _, yaml, = text.split(/^---\s*$/, 3) | |
| require "yaml" | |
| data = YAML.safe_load(yaml) | |
| unless data.is_a?(Hash) && data["name"].to_s.match?(/\A[a-z0-9][a-z0-9_-]*\z/) | |
| warn "#{path}: frontmatter must include kebab/snake-safe name" | |
| exit 1 | |
| end | |
| unless data["description"].to_s.strip.length >= 20 | |
| warn "#{path}: frontmatter must include a useful description" | |
| exit 1 | |
| end | |
| ' "${skill}" | |
| done | |
| - name: Validate service catalog | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [ ! -f services.yaml ]; then | |
| echo "No services.yaml found." | |
| exit 0 | |
| fi | |
| if [ ! -f .github/scripts/validate-services-catalog.rb ]; then | |
| echo "::error::.github/scripts/validate-services-catalog.rb is required when services.yaml exists." | |
| exit 1 | |
| fi | |
| ruby .github/scripts/validate-services-catalog.rb services.yaml | |
| - name: Run repo Ruby tests | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| shopt -s globstar nullglob | |
| tests=(test/**/*_test.rb) | |
| if [ "${#tests[@]}" -eq 0 ]; then | |
| echo "No Ruby tests found." | |
| exit 0 | |
| fi | |
| ruby -Itest -e 'ARGV.each { |path| require "./#{path}" }' "${tests[@]}" |