community-check.yml

name: Community Entry Check

# Lightweight, non-executing gate for community showcase entries.
# It does NOT run contributor code. It validates entry structure, scans for
# committed secrets, confirms hosted entries use Opik, and verifies the
# generated showcase index is up to date. Secrets-free, so it runs on forks.
#
# Community entries are intentionally exempt from the verified-bucket workflows
# (compliance / pr-test / test-notebooks / scheduled), which are path-scoped to
# examples|integrations|scripts|use-cases|guides and never match community/**.

on:
  pull_request:
    paths:
      - "community/**"

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v7

      - uses: astral-sh/setup-uv@v7
        with:
          version: "latest"
          enable-cache: true
          python-version: "3.12"

      - name: Install tooling
        run: |
          cd community/scripts
          uv sync

      - name: Unit-test the check tooling
        run: |
          cd community/scripts
          uv run pytest -q

      - name: Lint the check tooling
        run: |
          cd community/scripts
          uv run ruff check .
          uv run ruff format --check .

      - name: Validate all community entries
        run: |
          cd community/scripts
          uv run python check_entry.py

      - name: Verify showcase index is up to date
        run: |
          cd community/scripts
          uv run python build_index.py --check