developer-meta-files/.github/workflows/test-github-org-tools.yml at master · Kicksecure/developer-meta-files · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
## Copyright (C) 2026 - 2026 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## AI-Assisted

## Mock-API tests for the github-org-* tools and the dm-* policy
## wrappers. Runs the suite in ci/ against canned fixtures from
## ci/fixtures/ - no real GitHub access. Intended to catch regressions
## in arg parsing, validator behavior, mock-dispatch routing,
## rate-limit retry math, and the audit / dry-run output shape.

name: github-org tools (mock-API tests)

on:
  ## Run on the relaxed schedule for now while the suite is still
  ## evolving. Tighten to "tags only + workflow_dispatch" once the
  ## suite is considered stable - see the commented `tags-only` block
  ## below for the eventual default.
  push:
    branches:
      - master
      - 'claude/**'
    paths:
      ## Only run when github-related code or CI assets change.
      - 'usr/bin/github-org-*'
      - 'usr/bin/dm-github-policy'
      - 'usr/bin/dm-github-personal-policy'
      - 'usr/bin/dm-github-fork-sync'
      - 'usr/libexec/developer-meta-files/github-org-lib.bsh'
      - 'usr/libexec/developer-meta-files/github-policy-lib.bsh'
      - 'ci/**'
      - '.github/workflows/test-github-org-tools.yml'
  pull_request:
    paths:
      - 'usr/bin/github-org-*'
      - 'usr/bin/dm-github-policy'
      - 'usr/bin/dm-github-personal-policy'
      - 'usr/bin/dm-github-fork-sync'
      - 'usr/libexec/developer-meta-files/github-org-lib.bsh'
      - 'usr/libexec/developer-meta-files/github-policy-lib.bsh'
      - 'ci/**'
      - '.github/workflows/test-github-org-tools.yml'
  workflow_dispatch:

  ## Eventual default - run only on tag pushes (release candidates) +
  ## manual dispatch above. Uncomment and remove the push/pull_request
  ## blocks above once the suite is stable.
  # push:
  #   tags:
  #     - '*'

## Defensive minimum-permissions block. This workflow only reads the
## checked-out source and runs tests against local fixtures - it never
## reaches the real GitHub API.
permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  mock-tests:
    name: mock-API tests
    runs-on: ubuntu-latest
    container:
      image: debian:trixie
    steps:
      - name: Install apt pre-reqs
        run: |
          set -o errexit
          set -o nounset
          set -o pipefail
          export DEBIAN_FRONTEND=noninteractive
          apt-get update
          apt-get install --yes --no-install-recommends -- \
            ca-certificates curl jq git sudo build-essential dctrl-tools \
            python3 shellcheck safe-rm

      - name: Checkout developer-meta-files
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - name: Install genmkfile
        run: ./ci/install-genmkfile.sh

      - name: Install helper-scripts (provides sanitize-string)
        run: ./ci/install-helper-scripts.sh

      - name: Install developer-meta-files
        run: genmkfile install

      - name: Smoke test sanitize-string
        run: sanitize-string -- nolimit "smoke test"

      - name: Run mock-API test suite
        run: ./ci/test-github-org-tools.sh

      ## The live unauth smoke probe used to live here. It moved to
      ## .github/workflows/live.yml because it is a real-API call,
      ## logically distinct from the mock-API test suite this
      ## workflow runs. See agents/bash-style-guide.md "workflow YAML
      ## and ci scripts share a prefix".