feat(coordinator): reviewed SHU-71 M4 prerequisite provisioning entrypoint (SHU-251) #619
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Repository Policy | |
| on: | |
| pull_request: | |
| types: [opened, edited, reopened, synchronize, ready_for_review] | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| repository-policy: | |
| name: repository-policy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| - name: Measure acceptance reference policy and its mutations | |
| if: always() | |
| run: node --test .github/policy/test/*.test.mjs | |
| - name: Reject acceptance references in PR metadata | |
| if: always() && github.event_name == 'pull_request' | |
| run: node .github/policy/acceptance-metadata.mjs | |
| - name: Verify repository ownership controls | |
| if: always() | |
| run: | | |
| test -s .github/CODEOWNERS | |
| awk ' | |
| BEGIN { required["*"]; required["/.github/"] } | |
| /^[[:space:]]*#/ { next } | |
| NF == 0 { next } | |
| { | |
| has_required_owner = 0 | |
| for (i = 2; i <= NF; i++) { | |
| if ($i == "@BAWES") { | |
| has_required_owner = 1 | |
| } | |
| } | |
| if (!has_required_owner) { | |
| invalid = 1 | |
| } | |
| if ($1 in required && has_required_owner) { | |
| found[$1] = 1 | |
| } | |
| } | |
| END { | |
| for (pattern in required) { | |
| if (!found[pattern]) { | |
| invalid = 1 | |
| } | |
| } | |
| exit invalid | |
| } | |
| ' .github/CODEOWNERS | |
| test -s .github/pull_request_template.md | |
| - name: Reject tracked dependency trees and host-absolute symlinks | |
| if: always() | |
| run: | | |
| # Preserve arbitrary Git path bytes and read symlinks by index blob | |
| # ID. Command failures propagate; quoting cannot hide unsafe paths. | |
| index=$(mktemp) | |
| trap 'rm -f "$index"' EXIT | |
| git ls-files --stage -z > "$index" | |
| while IFS= read -r -d '' entry; do | |
| metadata=${entry%%$'\t'*} | |
| file=${entry#*$'\t'} | |
| read -r mode oid stage <<< "$metadata" | |
| case "/$file/" in | |
| */node_modules/*) | |
| echo "::error::a node_modules path is tracked in git" | |
| exit 1 ;; | |
| esac | |
| if [ "$mode" = 120000 ]; then | |
| target=$(git cat-file blob "$oid") | |
| case "$target" in | |
| /*) echo "::error::tracked symlink points at an absolute host path"; exit 1 ;; | |
| esac | |
| fi | |
| done < "$index" |