mirror of
https://github.com/hanzoai/insights.git
synced 2026-10-30 16:15:31 +00:00
zeekay
e2f4c4cbd7
The forge reads the first WORKFLOW_DIRS entry that exists. .hanzo/workflows has existed here for a while, so the 121 files under .github/workflows ran nowhere — including ci-security.yaml, which is the whole semgrep suite. The repo stayed green because the checks that would have gone red were the ones not running; the forge's own API listed 7 workflows against 121 files on disk. security.yml runs the 46 rules in .semgrep/rules/security, which are the ones worth keeping: they encode this fork's tenancy model (idor-team-scoped-models, cross-org-bypass-user-organization, celery-team-scope, datastore-sql-injection) rather than generic lint, and they need no registry, account or network. ERROR fails and WARNING prints, the split the devex job already used. 32 ERROR rules over 23819 files in 154s. Not carried over: the eight-way path filter (read the GitHub compare API under a GH App token, to save minutes this does not need), the nine-job rollup, the Docker Hub login (no such org secret), and the registry packs (measured: 170 rules, +322s, one finding). A verbatim move would have run nothing anyway — every job hung off a `changes` job guarded on github.repository == 'Insights/insights'. The other 120 files are upstream's CI: PR labelers, reviewer assignment, stale bots, Depot-runner builds, macOS/Windows release trains, and publishes to the upstream org's registries. Running those here would point someone else's automation at our fleet, so they are deleted rather than moved. The directory goes with them — a dead file cannot accumulate where there is no directory — and hanzo.yml now refuses its return.
53 lines
2.8 KiB
YAML
53 lines
2.8 KiB
YAML
# hanzoai/insights — the product analytics platform (Django + pnpm front end +
|
|
# Rust services).
|
|
#
|
|
# Gate only, no `images:`. ghcr.io/hanzoai/insights is cut by
|
|
# .hanzo/workflows/deploy.yml, which derives the next patch from what the
|
|
# registry already publishes and refuses to re-push a live tag. Declaring
|
|
# `images:` here would put a second producer behind that name and break exactly
|
|
# the immutability that lane exists to enforce.
|
|
#
|
|
# The gate is the repo's own `lint` — oxlint over the JS/TS tree, then stylelint
|
|
# over frontend/ and products/ — run against a lockfile-pinned install. That
|
|
# combination fails on the defects a push actually introduces: an undefined
|
|
# reference, an unused import that means a rename was left half-done, a stylesheet
|
|
# that no longer parses.
|
|
#
|
|
# --ignore-scripts because this gate reads source. The scripts here build the
|
|
# WASM and native artifacts (emsdk, ninja, node-gyp) that the IMAGE needs; the
|
|
# linters need none of them, and pulling an Emscripten toolchain to run oxlint
|
|
# is how a gate becomes slow enough that people start skipping it.
|
|
#
|
|
# Not the pytest or jest suites: those need Postgres, Datastore and Kafka
|
|
# (see ci-backend.yml standing them up as services). That is an integration
|
|
# lane. A gate that is red for a missing database says nothing about the commit.
|
|
# The second gate is cheap and catches a failure lint cannot see. An upstream
|
|
# rebase removes a file we invented without raising a conflict — upstream never
|
|
# had it, so "take upstream's version" is a clean delete — and a deleted module
|
|
# takes its own tests with it, so nothing goes red. e443a4dab removed three that
|
|
# way on 08-01 and it was found on 08-08, two rebases later. Runs first because
|
|
# it needs no install.
|
|
test:
|
|
- name: one plane
|
|
# This forge collects workflows from the FIRST entry of WORKFLOW_DIRS that
|
|
# exists. .hanzo/workflows/ exists, so a file under .github/workflows/ is
|
|
# not a second lane — it is a file that runs nowhere, and it fails by being
|
|
# silent: the checks that would go red are the ones no longer running. That
|
|
# is how 121 of them accumulated here, under a green repo, taking the
|
|
# semgrep suite with them.
|
|
#
|
|
# Nothing runs on github.com, so there is no case for the directory. The
|
|
# same assertion guards hanzoai/ci as `one-definition`.
|
|
run: |
|
|
set -e
|
|
[ -d .github/workflows ] && {
|
|
echo "::error::.github/workflows is back — this forge reads .hanzo/workflows, so those files run nowhere and go green by not running"; exit 1; } || true
|
|
echo "OK: one plane ($(ls .hanzo/workflows | wc -l) workflows, all of them live)"
|
|
- name: fork inventory
|
|
run: python3 scripts/fork-inventory.py
|
|
- name: lint
|
|
run: |
|
|
set -e
|
|
pnpm install --frozen-lockfile --ignore-scripts
|
|
pnpm run lint
|