Repository navigation
fix(linux-sqlite): tell a locked file apart from a full server #2486
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Repo Hygiene | |
| # Checks that need no Mac: workflows, shell, release tooling and repo invariants. Ubuntu minutes are | |
| # free on a public repo, so it runs on every pull request and needs no change filter. | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main, 'release/**'] | |
| workflow_dispatch: | |
| concurrency: | |
| group: repo-hygiene-${{ github.event_name == 'pull_request' && github.ref || github.sha }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| permissions: | |
| contents: read | |
| jobs: | |
| hygiene: | |
| name: Repo Hygiene | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install shellcheck, PyYAML and actionlint | |
| run: | | |
| sudo apt-get update -qq | |
| sudo apt-get install -y -qq shellcheck python3-yaml | |
| bash <(curl -sSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash) 1.7.12 | |
| # actionlint runs shellcheck over every inline run: block, which nothing else sees. | |
| - name: Lint workflows | |
| env: | |
| SHELLCHECK_OPTS: --severity=warning | |
| run: ./actionlint -color | |
| - name: Lint scripts | |
| run: | | |
| set -euo pipefail | |
| mapfile -t SCRIPTS < <(find scripts apple/scripts .claude/skills -name '*.sh' | sort) | |
| shellcheck --severity=warning "${SCRIPTS[@]}" | |
| - name: Test the CI and release tooling | |
| run: | | |
| set -euo pipefail | |
| python3 -m unittest discover -s scripts/ci -p 'test_*.py' | |
| python3 -m unittest discover -s apple/scripts/ci -p 'test_*.py' | |
| python3 -m unittest discover -s apple/scripts/lib -p 'test_*.py' | |
| python3 -m unittest discover -s apple/scripts -p 'test_localization.py' | |
| bash apple/scripts/ci/test_libs_release.sh | |
| # 3.9 is the macOS /usr/bin/python3 that runs notes.py in the build. The other steps keep the | |
| # runner's Python, which has PyYAML. | |
| - name: Set up Python 3.9 for the release tooling | |
| id: python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.9" | |
| update-environment: false | |
| - name: Install the release tooling | |
| env: | |
| PYTHON: ${{ steps.python.outputs.python-path }} | |
| run: | | |
| set -euo pipefail | |
| "$PYTHON" -m venv "$RUNNER_TEMP/release-venv" | |
| "$RUNNER_TEMP/release-venv/bin/pip" install --quiet --disable-pip-version-check --require-hashes \ | |
| -r scripts/release/requirements.txt | |
| - name: Test the release tooling | |
| run: '"$RUNNER_TEMP/release-venv/bin/python" -m unittest discover -s apple/scripts/release -p "test_*.py"' | |
| # towncrier refuses a fragment name it cannot parse once its config sets ignore. | |
| - name: Render the changelog fragments | |
| run: | | |
| set -euo pipefail | |
| "$RUNNER_TEMP/release-venv/bin/towncrier" build --draft --dir apple --version 0.0.0 | |
| "$RUNNER_TEMP/release-venv/bin/towncrier" build --draft --dir linux --version 0.0.0 | |
| # shellcheck cannot tell a library function from a command, so a missing source is exit 127 | |
| # at release time (v0.67.1). | |
| - name: Check every script sources the libraries it calls into | |
| run: python3 apple/scripts/ci/check-lib-sourcing.py | |
| - name: Check plugin-registry.json against the project.yml plugin aggregates | |
| run: python3 apple/scripts/ci/check-plugin-manifest.py | |
| # The app registers a plugin from these keys without loading it, and loads one without them at launch. | |
| - name: Check every plugin Info.plist declares the ids its class provides | |
| run: python3 apple/scripts/ci/check-plugin-provides.py | |
| - name: Check no build script hardcodes the deployment target | |
| run: bash apple/scripts/ci/check-deployment-target.sh | |
| # A plugin's or package's String(localized:) resolves against the host app's bundle, so its | |
| # strings live in each app's catalog by hand. | |
| - name: Check plugin and package strings reach the string catalogs | |
| working-directory: apple | |
| run: | | |
| set -euo pipefail | |
| python3 scripts/localization.py plugins | |
| python3 scripts/localization.py plugins --target ios | |
| # xcstringstool accepts a %lld retyped as %@ or a dropped argument, and String(format:) then | |
| # formats the wrong value at run time. | |
| - name: Check the string catalogs | |
| run: python3 apple/scripts/ci/check-string-catalogs.py | |
| - name: Check the license inventory against what the build ships | |
| run: python3 apple/scripts/ci/check-license-inventory.py | |
| - name: Check both apps pin the Production CloudKit environment | |
| run: python3 apple/scripts/ci/check-entitlements.py | |
| - name: Check every test target is in its test plan | |
| run: python3 apple/scripts/ci/check-test-plans.py | |
| - name: Decide whether the SAP HANA helper changed | |
| id: native | |
| env: | |
| BASE: ${{ github.event.pull_request.base.sha || github.event.before }} | |
| REF: ${{ github.ref }} | |
| run: | | |
| set -euo pipefail | |
| hana=$(scripts/ci/detect-changed-paths.sh --base "$BASE" --ref "$REF" hana) | |
| echo "hana=$hana" >> "$GITHUB_OUTPUT" | |
| - name: Set up Go | |
| if: steps.native.outputs.hana == 'true' | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: apple/Native/HanaBridge/go.mod | |
| cache: false | |
| # The helper is pure Go, so Linux analyses it as well as the Mac that builds it. | |
| - name: Check the SAP HANA helper | |
| if: steps.native.outputs.hana == 'true' | |
| working-directory: apple/Native/HanaBridge | |
| run: | | |
| set -euo pipefail | |
| unformatted="$(gofmt -l .)" | |
| if [ -n "$unformatted" ]; then | |
| echo "::error::gofmt would rewrite: $unformatted" | |
| exit 1 | |
| fi | |
| go mod verify | |
| go mod tidy -diff | |
| GOOS=darwin go vet ./... | |
| # go tool would build staticcheck for GOOS too, and Linux cannot run a darwin binary. | |
| go build -modfile=tools.mod -o "$RUNNER_TEMP/staticcheck" honnef.co/go/tools/cmd/staticcheck | |
| GOOS=darwin "$RUNNER_TEMP/staticcheck" ./... | |
| GOBIN="$RUNNER_TEMP/bin" go install golang.org/x/vuln/cmd/govulncheck@v1.8.0 | |
| GOOS=darwin "$RUNNER_TEMP/bin/govulncheck" ./... |