Skip to content

fix(hig): finish the unreleased surfaces so Escape, search and column… #329

fix(hig): finish the unreleased surfaces so Escape, search and column…

fix(hig): finish the unreleased surfaces so Escape, search and column… #329

Workflow file for this run

name: Repo Hygiene
# Lints the parts of the repo the macOS suite cannot reach. 7,500 lines of shell build, sign,
# notarize and publish this app, and nothing checked any of it: the six findings actionlint reported
# the first time it ran here were all inside `run:` blocks in the release and plugin workflows.
#
# Runs on ubuntu, where minutes are free on a public repo, and finishes in well under a minute.
on:
pull_request:
paths:
- "scripts/**"
- ".github/workflows/**"
- ".github/actions/**"
- ".github/scripts/**"
- ".github/plugin-registry.json"
- ".github/duplicate-contract-baseline.txt"
- "Plugins/**/*.swift"
- "TablePro/**/*.swift"
- "Packages/**/*.swift"
push:
branches: [main]
paths:
- "scripts/**"
- ".github/workflows/**"
- ".github/actions/**"
- ".github/scripts/**"
- ".github/plugin-registry.json"
- ".github/duplicate-contract-baseline.txt"
- "Plugins/**/*.swift"
- "TablePro/**/*.swift"
- "Packages/**/*.swift"
workflow_dispatch:
concurrency:
group: repo-hygiene-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
lint:
name: Lint workflows and scripts
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Install shellcheck and actionlint
run: |
sudo apt-get update -qq
sudo apt-get install -y -qq shellcheck
bash <(curl -sSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash) 1.7.12
./actionlint --version
# actionlint shells out to shellcheck for every inline `run:` block, which is the only way
# those get checked at all: they are not files, so a plain shellcheck run never sees them.
- name: Lint workflows
run: ./actionlint -color
# --severity=warning is the floor the repo currently holds at zero. The remaining
# informational findings are almost all SC2012 (`ls` where `find` would be sturdier) in
# message strings, and gating on them today would only add noise.
- name: Lint scripts
run: |
set -euo pipefail
mapfile -t SCRIPTS < <(find scripts .claude/skills -name '*.sh' | sort)
echo "checking ${#SCRIPTS[@]} scripts"
shellcheck --severity=warning "${SCRIPTS[@]}"
# shellcheck cannot tell a shell function from a command on PATH, so a script that calls a
# scripts/lib function without sourcing the library reads as correct everywhere and dies at
# run time with exit 127. That is how v0.67.1's DMG job failed: create-dmg.sh called
# notarize_and_staple and never sourced lib/notarize.sh, and a release was the first thing
# to run it.
- name: Check every script sources the libraries it calls into
run: python3 scripts/ci/check-lib-sourcing.py
- name: Check the plugin manifest against the plugin classes
run: python3 scripts/ci/check-plugin-manifest.py
- name: Validate the registry update script
run: python3 .github/scripts/test_update_registry.py
# The macOS suite cannot catch this one: the script runs before any test does, and when it
# gets this wrong no test runs at all. An empty quarantine list made it print a blank line,
# which the caller turned into an empty xcodebuild argument, and main went red for three
# commits with `Unknown build action ''`.
- name: Validate the test quarantine script
run: python3 scripts/ci/test_quarantine_args.py
# A check that guarded a real invariant and ran nowhere. Pure grep over Swift sources, so it
# belongs on the free Linux runner. The MongoDB filter-shape check is the other one that was
# orphaned, but it compiles a C probe against Libs/libbson, so it lives in the macOS build
# job in macos-tests.yml where the toolchain and the libraries already are.
- name: Check the shared-contract drift gates
run: scripts/audit-refactor-health.sh --check