SHA256
Yuvomi Mobile Contributors
11bf4ca620
Move workflows into Gitea's workflow directory and use the supplied ubuntu-latest and macos-arm64 labels. Provision the Android SDK, require KVM without changing host permissions, support SHA-256 checkout and Gitea artifact uploads, and isolate scratch output on persistent runners. Skip untrusted fork PRs and keep release builds unsigned because Gitea ignores GitHub environment approval gates. Local workflow lint, repository invariants, ten preflight regressions, eight evidence-verifier tests, inline shell checks, scratch cleanup and SHA-256 fetch checks pass; remote runner execution remains unverified.
27 lines
1.2 KiB
Python
27 lines
1.2 KiB
Python
#!/usr/bin/env python3
|
|
"""Lint Gitea workflows using actionlint's GitHub-compatible grammar.
|
|
|
|
Only the forge-specific absolute action URL syntax is normalized for actionlint;
|
|
the real URLs/pins and runner assignments are checked by check-repository.py.
|
|
"""
|
|
from pathlib import Path
|
|
import re
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
actionlint = sys.argv[1] if len(sys.argv) > 1 else "actionlint"
|
|
base = Path("/tmp/opencode") if Path("/tmp/opencode").exists() else None
|
|
with tempfile.TemporaryDirectory(prefix="yuvomi-workflow-lint-", dir=base) as temporary:
|
|
config = Path(temporary) / "actionlint.yaml"
|
|
config.write_text("self-hosted-runner:\n labels: [macos-arm64]\n")
|
|
workflows = sorted((ROOT / ".gitea/workflows").glob("*.yml"))
|
|
if not workflows:
|
|
raise SystemExit("No Gitea workflows found")
|
|
for path in workflows:
|
|
normalized = re.sub(r"(uses:\s*)https://(?:github.com|gitea.com)/", r"\1", path.read_text())
|
|
subprocess.run([actionlint, "-config-file", str(config), "-stdin-filename", str(path), "-"],
|
|
input=normalized, text=True, check=True, cwd=ROOT)
|
|
print(f"actionlint: {len(workflows)} Gitea workflows passed (action URL syntax normalized).")
|