Template drift audit #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Template drift audit | |
| # Monthly audit — runs `precisa doctor` to detect drift between this | |
| # repo's templated files (workflows, dotfiles, configs) and the current | |
| # `@precisa-saude/cli` templates. When drift shows up, open a PR running | |
| # `pnpm exec precisa sync` to absorb the changes. | |
| # | |
| # Runs on the 1st of each month at 06:00 America/Sao_Paulo (09:00 UTC). | |
| # `workflow_dispatch` is wired so you can trigger it ad-hoc. | |
| # | |
| # This workflow catches the class of incident that motivated it: | |
| # silent drift between canonical workflow templates and the real files | |
| # in each repo. See fhir-brasil#26 (PAT_TOKEN → GitHub App) for the | |
| # concrete failure mode — drift went undetected until a conditional | |
| # job finally fired in production. | |
| on: | |
| schedule: | |
| - cron: '0 9 1 * *' | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| issues: write | |
| jobs: | |
| doctor: | |
| name: precisa doctor | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0 | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: 'pnpm' | |
| - run: pnpm install --frozen-lockfile | |
| - name: Audit templates | |
| id: doctor | |
| run: pnpm exec precisa doctor | |
| continue-on-error: true | |
| - name: Open issue on drift | |
| if: steps.doctor.outcome == 'failure' | |
| uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0 | |
| with: | |
| script: | | |
| const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`; | |
| const body = [ | |
| '`precisa doctor` detected drift between this repo and the canonical templates.', | |
| '', | |
| `Full log: ${runUrl}`, | |
| '', | |
| 'To fix:', | |
| '', | |
| '```bash', | |
| 'pnpm exec precisa sync --dry-run # review the diff', | |
| 'pnpm exec precisa sync # apply', | |
| '```', | |
| '', | |
| 'Drift typically shows up when `@precisa-saude/cli` publishes', | |
| 'new templates (workflow changes, dotfile updates) and this', | |
| 'repo has not run `precisa sync` since.', | |
| ].join('\n'); | |
| await github.rest.issues.create({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| title: 'precisa doctor: template drift detected', | |
| body, | |
| labels: ['dependencies', 'tooling-drift'], | |
| }); |