check.yml

name: check

on:
  push:
  pull_request:
  # The digests are checked once a week rather than on every push. Hashing the catalogue means
  # downloading several gigabytes — the two MiLMMT builds alone are 3.3 GB — and the answer changes
  # only when somebody republishes a file. Every push still asks the cheap question: is it there,
  # and is it the size the manifest claims.
  schedule:
    - cron: "17 4 * * 1"

jobs:
  compile:
    name: python -m compileall
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      # No ruff here: nothing in this repo depends on it, and adding a linter nobody configured or
      # runs locally is worse than no linter. compileall at least catches a script that cannot be
      # imported at all — a real failure mode for export.py, which only ever gets exercised
      # manually or on workflow_dispatch.
      - run: python -m compileall -q scripts models

  readme:
    name: the READMEs still match the registry
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          repository: Techainer/summo-registry
          path: registry
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      # The numbers in each model's README are generated from that model's manifest. This is what
      # makes "the README says 611 MB and the manifest says 640 MB" a failed build rather than
      # something a reader finds in six months.
      - run: python scripts/readme.py --registry registry --check

  verify-digests:
    name: full sha256 of every redistributable file (weekly)
    if: github.event_name == 'schedule'
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/checkout@v4
        with:
          repository: Techainer/summo-registry
          path: registry
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Download and hash
        run: |
          status=0
          for manifest in registry/models/*.json; do
            if [ "$(python -c "import json,sys; print(json.load(open('$manifest')).get('redistributable', False))")" = "True" ]; then
              python scripts/verify.py "$manifest" --digest || status=1
            fi
          done
          exit $status

  verify-published:
    name: verify redistributable manifests in summo-registry
    runs-on: ubuntu-latest
    steps:
      - name: Checkout summo-models
        uses: actions/checkout@v4

      - name: Checkout summo-registry
        uses: actions/checkout@v4
        with:
          repository: Techainer/summo-registry
          path: registry

      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      # Only manifests marked redistributable point at files we are responsible for (our own
      # Releases, or a mirror we chose). The non-redistributable ones point upstream by design —
      # summo-registry's own CI already checks those stay reachable; re-checking them here would
      # just make this workflow fail for a third party's downtime, which is not this repo's job.
      - name: Verify every redistributable manifest
        run: |
          python3 - <<'PY'
          import glob
          import json
          import subprocess
          import sys

          failures = []
          for path in sorted(glob.glob("registry/models/*.json")):
              manifest = json.load(open(path))
              if not manifest.get("redistributable", True):
                  print(f"skip {manifest['id']} (redistributable: false)")
                  continue

              result = subprocess.run([sys.executable, "scripts/verify.py", path], check=False)
              if result.returncode != 0:
                  failures.append(manifest["id"])

          if failures:
              print("FAIL manifests that did not verify:", ", ".join(failures))
              sys.exit(1)
          PY