dynamo/.github/workflows/codeowners.yml at main · sachalmalick/dynamo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
name: codeowners

# Keeps CODEOWNERS in sync with the declarative source (.github/codeowners/areas.yaml)
# and gates PRs that would leave a path unowned. Ownership STRUCTURE only -- team
# membership (who is on each team) is managed separately.

on:
  pull_request:
    paths:
      - "**"
  push:
    branches: [main]
    paths:
      - "**"

# This workflow runs scripts sourced from the PR diff; keep the token
# read-only and out of the persisted git config (zizmor: artipacked,
# excessive-permissions).
permissions:
  contents: read

jobs:
  codeowners:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install pyyaml pytest

      # Unit tests for the canonical matcher + the emitter's tree-independence
      # contract. These are the only piece the gates below trust -- if they
      # fail, nothing else means anything.
      - name: Unit tests (matcher + tree-independence)
        run: |
          python -m pytest .github/codeowners/test_codeowners.py -v \
            -p no:cacheprovider \
            --override-ini="addopts=" \
            --override-ini="filterwarnings="

      # Coverage gate on PRs: DIFF-AWARE. checkout builds the base+PR merge
      # tree, so git ls-files sees paths that only ever landed on the base
      # branch. --changed-only gates just the paths THIS PR adds/renames/
      # modifies vs base.sha; unowned paths inherited unchanged from the base
      # are a non-fatal warning. That stops unrelated base churn from red-Xing
      # long-running PRs while still requiring the PR's own surface to be 100%
      # owned. A PR that edits ownership policy (areas/scripts/CODEOWNERS) is
      # judged full-tree, since a policy edit can orphan any path. base.sha is
      # fetched by fetch-depth: 0 above.
      - name: Validate coverage (diff-aware, PR)
        if: github.event_name == 'pull_request'
        run: |
          python .github/codeowners/build_codeowners.py \
            --areas .github/codeowners/areas.yaml \
            --repo . \
            --strict \
            --changed-only \
            --base ${{ github.event.pull_request.base.sha }}

      # Coverage gate off PRs (push to main / manual): whole-tree 100%. This is
      # the maintenance assertion that every tracked file has a real owner, and
      # the only step that reads git ls-files without a diff filter.
      - name: Validate 100% coverage (strict, full tree)
        if: github.event_name != 'pull_request'
        run: |
          python .github/codeowners/build_codeowners.py \
            --areas .github/codeowners/areas.yaml \
            --repo . \
            --strict

      # Regenerate, then fail if the committed CODEOWNERS or CONTRIBUTORS.md
      # drifted from what the sources produce. emit_codeowners.py is a PURE
      # FUNCTION of areas.yaml + external_contributors.yaml (no tree walk),
      # so this diff only ever fires when a policy input or a committed output
      # actually changed -- never because unrelated files moved on the base
      # branch.
      - name: Regenerate and check for drift
        run: |
          python .github/codeowners/emit_codeowners.py \
            --areas .github/codeowners/areas.yaml \
            --out CODEOWNERS \
            --external .github/codeowners/external_contributors.yaml \
            --contributors-out CONTRIBUTORS.md
          git diff --exit-code CODEOWNERS CONTRIBUTORS.md \
            || { echo "::error::CODEOWNERS/CONTRIBUTORS.md are out of date. Regenerate from areas.yaml + external_contributors.yaml and commit."; exit 1; }