Skip to content

ci: guard sample-catalog.json against manual edits #485

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Yimin-Jin wants to merge 1 commit into from
Closed

ci: guard sample-catalog.json against manual edits #485

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions .github/workflows/guard-sample-catalog.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
name: Guard Generated Catalog

# samples/hosted-agent/sample-catalog.json is GENERATED by the "Sync Sample
# Catalog" workflow and must never be edited or committed by hand. This check
# fails any PR that modifies it unless the PR originates from a sync-workflow
# branch (ci/sync-sample-catalog-*).
#
# For this to ENFORCE (not merely report), the protected branch must also:
# - mark the "guard-catalog" check as a REQUIRED status check, and
# - disallow direct pushes (PRs only) — a pull_request guard cannot catch a
# direct push.
#
# A pull_request workflow only guards PRs targeting the branch it lives on, so
# this file must exist on every protected branch you want covered.

on:
pull_request:

permissions:
contents: read

jobs:
guard-catalog:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Reject manual edits to sample-catalog.json
env:
HEAD_REF: ${{ github.head_ref }}
BASE_SHA: ${{ github.event.pull_request.base.sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
shell: bash
run: |
set -euo pipefail
CATALOG="samples/hosted-agent/sample-catalog.json"

# Did this PR change the generated catalog at all?
if git diff --quiet "$BASE_SHA" "$HEAD_SHA" -- "$CATALOG"; then
echo "PR does not touch $CATALOG — OK."
exit 0
fi

# It did. Only the Sync Sample Catalog workflow (which opens PRs from
# ci/sync-sample-catalog-* branches) is allowed to change it.
if [[ "$HEAD_REF" == ci/sync-sample-catalog-* ]]; then
echo "Change to $CATALOG came from sync branch '$HEAD_REF' — OK."
exit 0
fi

echo "::error file=$CATALOG::$CATALOG is generated by the 'Sync Sample Catalog' workflow and must not be edited or committed manually. Revert your changes to this file; CI will regenerate it."
exit 1
Loading