feat(docs-hygiene): a reusable file-name audit, realign, and gate set #1019
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: managed-files-guard | |
| # SYNC-MANAGED FILE — DO NOT EDIT IN THE CONSUMING REPOSITORY. | |
| # Source of truth: melodic-software/standards, | |
| # components/managed-files-guard/managed-files-guard.yml (the | |
| # `managed-files-guard-caller` component in distribution/sync-manifest.yml). | |
| # Downstream edits are overwritten by the next sync PR; change the component | |
| # upstream, or move the component to `locally-owned` in the manifest to | |
| # customize. | |
| # | |
| # Thin caller for the org's managed-files-guard composite action | |
| # (melodic-software/ci-workflows, ci-workflows#208). The action resolves this | |
| # repository's sync-manifest-managed destination paths from the standards ref | |
| # it is given and fails the pull request when the diff hand-edits one of them | |
| # (ADR-0007: a managed file is byte-exact with its standards source; the fix | |
| # path is a standards change, never a downstream edit). Pull requests opened | |
| # by the sync itself — labelled `standards-sync`, or authored by | |
| # `melodic-standards-sync[bot]` — are exempt inside the action. | |
| # | |
| # ADVISORY during soak (standards#496): this check is NOT aggregated into | |
| # `ci-status` and is not a required context. Promotion is a per-target | |
| # decision taken after a clean soak, recorded in the component README. | |
| # | |
| # Hosted-only shape: `runs-on` names the approved hosted label directly, so the | |
| # same bytes serve public and un-enrolled private targets. A private target | |
| # enrolled for local CI routing needs a sibling that names the managed fleet | |
| # label instead (see the component README) and is not a consumer of this file. | |
| on: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| # Canonical block from the standards `concurrency-policy` component: a newer | |
| # push to the same pull request cancels the in-flight guard run; the | |
| # `run_id` fallback keeps non-PR runs unique and never cancelled. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }} | |
| cancel-in-progress: true | |
| jobs: | |
| managed-files-guard: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Check out | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| # The guard diffs base...head; a shallow checkout has no base to | |
| # diff against, and the action fails closed on a diff it cannot see. | |
| fetch-depth: 0 | |
| - name: Guard managed files | |
| # Pinned to the ci-workflows release that carries the close of the | |
| # guard's fail-open on an unreadable diff (ci-workflows#530). A release | |
| # now contains that commit, so the pin-comment takes the convention's | |
| # release-tag form rather than the short-SHA fallback | |
| # (components/managed-files-guard/README.md). | |
| uses: melodic-software/ci-workflows/.github/actions/managed-files-guard@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2 | |
| with: | |
| # `main` for the soak, per the action's own input contract ("Pin to | |
| # a full SHA in callers once soak completes"): the guard must read | |
| # the manifest that is live for this repository, and a fixed | |
| # standards SHA would stop tracking target roster and component | |
| # changes the moment it landed. `standards-ref` is a workflow input | |
| # naming a ref of a different repository, so the ci-workflows | |
| # pin-comment convention does not apply to it. | |
| standards-ref: main |