release-manager
f0bb388587
contract-verb-binding / Vendored contract byte-identical to molecule-ai-sdk canonical (pull_request) Successful in 4s
lint-infisical-extractor / lint-infisical-extractor (pull_request) Successful in 4s
contract-credentials-binding / Vendored credentials contract byte-identical to molecule-ai-sdk canonical (pull_request) Successful in 5s
CI / provenance (pull_request) Failing after 5s
contract-credentials-binding / Reader-binding credentials test (management client reads contract name) (pull_request) Successful in 11s
meta-ci-advisory / meta (advisory) (pull_request) Successful in 12s
contract-verb-binding / Producer-binding verb test (management tool set ⊇ contract) (pull_request) Successful in 17s
CI / test (pull_request) Successful in 20s
44 lines
1.6 KiB
YAML
44 lines
1.6 KiB
YAML
name: audit-force-merge
|
|
# Detect a §SOP-6 force-merge after PR close and emit structured audit JSON.
|
|
# Runs on base branch (pull_request_target) so secrets are available.
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [closed]
|
|
|
|
jobs:
|
|
audit:
|
|
runs-on: ubuntu-latest
|
|
if: github.event.pull_request.merged == true
|
|
steps:
|
|
- name: Checkout base (for scripts)
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
ref: ${{ github.base_ref }}
|
|
persist-credentials: false
|
|
|
|
- name: Detect force-merge
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
GITEA_SERVER_URL: ${{ github.server_url }}
|
|
REPO: ${{ github.repository }}
|
|
PR_NUMBER: ${{ github.event.pull_request.number }}
|
|
# Required-status-check contexts to evaluate at merge time.
|
|
# Branch-aware JSON dict: keys are protected branch names,
|
|
# values are arrays of context names that branch protection
|
|
# requires for that branch. Mirror this against branch
|
|
# protection settings for each branch listed here.
|
|
REQUIRED_CHECKS_JSON: |
|
|
{
|
|
"main": [
|
|
"CI / test (pull_request)"
|
|
]
|
|
}
|
|
run: |
|
|
# Gitea expression lexer mis-parses `| replace` as `||` (job fails before
|
|
# the script runs). Pass github.server_url whole and strip the scheme in shell.
|
|
GITEA_HOST="${GITEA_SERVER_URL#http://}"
|
|
GITEA_HOST="${GITEA_HOST#https://}"
|
|
export GITEA_HOST
|
|
bash .gitea/scripts/audit-force-merge.sh
|