Accept canonical executor evidence during cook publication #5941
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # PR quality pipeline. | |
| # | |
| # Keep these checks direct in this repository so PRs do not depend on an extra | |
| # reusable-workflow planning job before actionable Audit/Lint/Test checks exist. | |
| name: CI | |
| on: | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ci-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| actions: read | |
| contents: write | |
| pull-requests: write | |
| issues: write | |
| jobs: | |
| homeboy: | |
| name: homeboy / ${{ matrix.title }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - command: review audit | |
| title: Audit | |
| section_key: audit | |
| section_title: Audit | |
| - command: review lint | |
| title: Lint | |
| section_key: lint | |
| section_title: Lint | |
| - command: review test | |
| title: Test | |
| section_key: test | |
| section_title: Test | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| fetch-depth: 0 | |
| - name: Check out Homeboy Action | |
| uses: actions/checkout@v6 | |
| with: | |
| repository: Extra-Chill/homeboy-action | |
| ref: v2 | |
| path: .homeboy-action | |
| - name: Generate GitHub App token | |
| id: app-token | |
| uses: actions/create-github-app-token@v3 | |
| continue-on-error: true | |
| with: | |
| app-id: ${{ secrets.HOMEBOY_APP_ID }} | |
| private-key: ${{ secrets.HOMEBOY_APP_PRIVATE_KEY }} | |
| - uses: ./.homeboy-action | |
| with: | |
| source: . | |
| component: homeboy | |
| commands: ${{ matrix.command }} | |
| expected-commands: review audit,review lint,review test | |
| differential-gating: true | |
| # Autofix is explicitly disabled on PRs: an on-failure autofix push | |
| # lands a bot commit mid-review and supersedes in-flight CI runs, | |
| # which reads as a spurious failure (see #3819). Require manual fixes. | |
| autofix: 'false' | |
| app-token: ${{ steps.app-token.outputs.token || github.token }} | |
| comment-section-key: ${{ matrix.section_key }} | |
| comment-section-title: ${{ matrix.section_title }} |