@@ -2,9 +2,10 @@ name: final-check
22
33# A maintainer adds the `final-check` label to an important PR. The check job
44# builds what pages.yml would publish from the PR (both validators, the
5- # integrity gate, the whole generated API and the site), and TechEngineBot
6- # leaves ONE comment with the verdict; adding the label again edits that
7- # comment. This is the only place the TechEngineBot account is used.
5+ # integrity gate, the whole generated API and the site) and runs the engine's
6+ # Tier 0-3 verification of the records the PR changes. TechEngineBot leaves ONE
7+ # comment with the verdict; adding the label again edits that comment. This is
8+ # the only place the TechEngineBot account is used.
89#
910# The check job runs PR code, so it gets no secrets and a read-only token.
1011# Only the comment job sees TECHENGINEBOT_TOKEN, which must be a fine-grained
5556 tail -n 40 "$RUNNER_TEMP/install.log"
5657 exit "$status"
5758
59+ # The only step here that goes online. Tiers 1 and 2 fetch the source URLs
60+ # of at most 40 changed records and look them up on Wikidata, with the
61+ # engine's own bot User-Agent; Tier 3 is a dry run that writes nothing.
62+ # Informational: the verdict doesn't depend on it.
63+ - name : Verify the changed records
64+ id : verify
65+ if : steps.install.outcome == 'success'
66+ continue-on-error : true
67+ timeout-minutes : 20
68+ working-directory : TechEngine
69+ env :
70+ TECHAPI_DATA_DIR : ${{ github.workspace }}/data
71+ PYTHONDONTWRITEBYTECODE : " 1"
72+ run : |
73+ status=0
74+ python -m app.verify pr --base "$(git -C .. rev-parse HEAD^1)" \
75+ > "$RUNNER_TEMP/verify.md" 2> "$RUNNER_TEMP/verify.log" || status=$?
76+ cat "$RUNNER_TEMP/verify.md"
77+ tail -n 20 "$RUNNER_TEMP/verify.log"
78+ exit "$status"
79+
5880name : Validate the data and generate the API
5981 id : api
6082 if : steps.install.outcome == 'success'
@@ -83,13 +105,17 @@ jobs:
83105 exit "$status"
84106
85107# The comment quotes tool output, which can carry text from the PR's
86- # records: it stays inside code fences with backticks and @ removed, so
87- # it can neither break out into markdown nor mention anyone.
108+ # records: logs stay inside code fences with backticks and @ removed, so
109+ # they can neither break out into markdown nor mention anyone. The
110+ # verification report keeps its markdown tables, but loses every @ and has
111+ # a zero-width space put into #123, GH-123 and links, so it can't mention
112+ # anyone or cross-reference another issue either.
88113 - name : Report
89114 id : report
90115 if : always()
91116 env :
92117 INSTALL : ${{ steps.install.outcome }}
118+ VERIFY : ${{ steps.verify.outcome }}
93119 API : ${{ steps.api.outcome }}
94120 SITE : ${{ steps.site.outcome }}
95121 HEAD_SHA : ${{ github.event.pull_request.head.sha }}
@@ -101,6 +127,9 @@ jobs:
101127 tail -n "$2" "$1" 2>/dev/null | clean
102128 echo '```'
103129 }
130+ zw=$(printf '\342\200\213')
131+ ref="s/(#|[Gg][Hh]-)([0-9]+)(\$|[^0-9A-Za-z_])/\1$zw\2\3/g" # not #3fb950, a chart colour
132+ md_clean() { tr -d '@' | sed -E -e "$ref" -e "$ref" -e "s#://#:$zw//#g" -e "s/www\./www$zw./g" | cut -c1-300; }
104133 verdict='✅ Final check passed'
105134 [ "$INSTALL/$API/$SITE" = success/success/success ] || verdict='❌ Final check failed'
106135 engine=$(git rev-parse --short HEAD:TechEngine 2>/dev/null || echo '?')
@@ -115,10 +144,20 @@ jobs:
115144 echo "| Install the pinned TechEngine | ${INSTALL:-skipped} |"
116145 echo "| Validators, integrity gate, generated API | ${API:-skipped} |"
117146 echo "| Site build | ${SITE:-skipped} |"
147+ echo "| Data verification, Tiers 0-3 (informational) | ${VERIFY:-skipped} |"
118148 if [ -s "$RUNNER_TEMP/api.log" ]; then
119149 echo
120150 sed -n '/^| Collection /,/^$/p' "$RUNNER_TEMP/api.log" | tr -d '`@'
121151 fi
152+ if [ -s "$RUNNER_TEMP/verify.md" ]; then
153+ echo
154+ echo '<details><summary>Data verification, Tiers 0-3</summary>'
155+ echo
156+ md_clean < "$RUNNER_TEMP/verify.md" | head -c 30000
157+ echo
158+ echo '</details>'
159+ fi
160+ [ "$VERIFY" = failure ] && { echo; echo '<details><summary>Verification log</summary>'; echo; fence "$RUNNER_TEMP/verify.log" 20; echo '</details>'; }
122161 [ "$INSTALL" = failure ] && { echo; echo '<details><summary>Install log</summary>'; echo; fence "$RUNNER_TEMP/install.log" 20; echo '</details>'; }
123162 [ "$API" = failure ] && { echo; echo '<details><summary>Validation and generation log</summary>'; echo; fence "$RUNNER_TEMP/api.log" 30; echo '</details>'; }
124163 [ "$SITE" = failure ] && { echo; echo '<details><summary>Site build log</summary>'; echo; fence "$RUNNER_TEMP/site.log" 20; echo '</details>'; }
0 commit comments