CodenameOne/.github/workflows/check-workflows.yml at master · codenameone/CodenameOne · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: Check workflows

# A workflow file GitHub rejects is not a broken job, it is a broken BRANCH: an invalid
# file produces a failed check run on every push to every branch that contains it,
# regardless of that workflow's own triggers and regardless of what the push touched. The
# only symptom is "This run likely failed because of a workflow file issue" with no log,
# which reads like infrastructure noise rather than a file someone has to fix.
#
# That happened here. A job-level `if:` referencing the `matrix` context took two unrelated
# pull requests red for hours. Nothing local objected, because the file is valid YAML --
# yaml.safe_load parses it, an editor shows nothing, and the error exists only in GitHub's
# own expression parser. actionlint reimplements that parser.
#
# Runs on pull_request as well as push, because the point is to catch the file BEFORE it
# reaches a branch other people build on. It is cheap: one ubuntu minute, no build.

permissions:
  contents: read

on:
  workflow_dispatch:
  pull_request:
    branches:
      - master
  push:
    branches:
      - master

concurrency:
  # Only the latest revision needs validation. PR numbers keep forks isolated;
  # event names keep a manual/scheduled run from cancelling a push or PR run.
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  check-workflows:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v6

      # Deliberately NOT filtered by paths. A workflow file is only one of the ways this
      # check goes stale: actionlint's own rules move, and a run over an unchanged tree
      # that starts failing is information rather than noise.
      - name: Validate every workflow file
        run: scripts/check-workflows.sh

      - name: Check CI selection and obsolete-run cancellation
        run: |
          python3 scripts/ci/test_select_cn1lib_checks.py
          python3 scripts/ci/test_select_apple_checks.py
          node --test scripts/ci/test-cancel-stale-pr-runs.js

      # Same reasoning one level up: build-ios-metal-27 and fidelity-ios-metal-27
      # are COPIES of the jobs beside them, and a copy nobody checks drifts. Both
      # legs of a pair stay green while diverging, because each passes on its own
      # terms and nothing compares them. Also unfiltered by paths -- a pair can
      # drift through an edit to either side.
      - name: Duplicated CI legs must stay identical
        run: scripts/check-duplicated-ci-legs.py

      # This workflow is unfiltered, so changes to the spec, its validator, or any
      # native reference table are checked before they reach master.
      - name: Validate fidelity spec and native reference tables
        run: |
          python3 scripts/test_check_fidelity_spec.py
          python3 scripts/check-fidelity-spec.py

      - name: Check desktop hover queues under saturation
        run: python3 scripts/test_native_hover_queue.py

      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '21'

      - name: Check fidelity baseline coverage enforcement
        run: |
          python3 scripts/test_fidelity_gate.py
          python3 scripts/test_fidelity_geometry.py