[sync] add org ADR sync manifest #65

Workflow file for this run

.github/workflows/repo-ci.yml at c931191

	name: Repo CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	permissions:
	contents: read

	jobs:
	actionlint:
	name: Lint workflows
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- uses: reviewdog/action-actionlint@6fb7acc99f4a1008869fa8a0f09cfca740837d9d # v1.72.0
	with:
	reporter: local
	filter_mode: nofilter
	fail_level: error

	markdownlint:
	name: Lint Markdown
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- uses: DavidAnson/markdownlint-cli2-action@ce4853d43830c74c1753b39f3cf40f71c2031eb9 # v23.0.0
	with:
	globs: "*/.md"

	baseline-manifest:
	name: Validate baseline manifest
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- run: python tools/check_baseline_manifest.py

	docs-layout:
	name: Validate docs layout
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false
	- run: python tools/check_docs_layout.py

	attribution-residue:
	name: Validate attribution residue
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	fetch-depth: 0
	persist-credentials: false
	- name: Fetch pull request base
	if: github.event_name == 'pull_request'
	env:
	BASE_REF: ${{ github.base_ref }}
	run: git fetch --no-tags origin "+refs/heads/${BASE_REF}:refs/remotes/origin/${BASE_REF}"
	- run: python tools/check_ai_residue.py
	env:
	AI_RESIDUE_BASE_REF: origin/${{ github.base_ref }}

	adr-schema:
	name: Validate ADR schema
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	fetch-depth: 0
	persist-credentials: false
	- name: Fetch pull request base
	if: github.event_name == 'pull_request'
	env:
	BASE_REF: ${{ github.base_ref }}
	run: git fetch --no-tags origin "+refs/heads/${BASE_REF}:refs/remotes/origin/${BASE_REF}"
	- run: python tools/check_adr_schema.py
	env:
	ADR_SCHEMA_BASE_REF: origin/${{ github.base_ref }}

	# Smoke-test the repo-hygiene reusable by calling it against this repo itself.
	# actionlint (above) only checks syntax; this exercises the real runtime path
	# (OPA download/install, build_opa_input, opa eval) and proves .github passes
	# its own universal policy before any consumer pins this reusable.
	# Every universal reusable is smoke-tested by calling it against .github
	# itself. actionlint (above) is syntax-only; these jobs exercise each
	# reusable's real runtime path so a runtime bug is caught here before any
	# consumer pins the reusable (the rationale of AGENTS.md Phase A.0).
	repo-hygiene-smoke:
	name: Smoke-test reusable-repo-hygiene (self)
	permissions:
	contents: read
	uses: ./.github/workflows/reusable-repo-hygiene.yaml
	with:
	source_ref: ${{ github.event.pull_request.head.sha \|\| github.sha }}

	codeql-smoke:
	name: Smoke-test reusable-codeql (self)
	permissions:
	contents: read
	security-events: write
	actions: read
	uses: ./.github/workflows/reusable-codeql.yaml
	# Default matrix is the `actions` language — analyzes .github's own
	# workflows, which is exactly the runtime path this repo must prove.

	iac-security-smoke:
	name: Smoke-test reusable-iac-security (self)
	permissions:
	contents: read
	security-events: write
	actions: read
	uses: ./.github/workflows/reusable-iac-security.yaml
	# All inputs optional; defaults run trivy + gitleaks + zizmor (the
	# fragile pip-install / docker-digest / inline-SARIF runtime paths).

	scorecard-smoke:
	name: Smoke-test reusable-scorecard (self)
	permissions:
	contents: read
	security-events: write
	id-token: write
	actions: read
	uses: ./.github/workflows/reusable-scorecard.yaml
	# publish_results defaults to false: runs the scorecard analysis + SARIF
	# upload without publishing to the public API.

	auto-merge-smoke:
	name: Smoke-test reusable-auto-merge (self)
	# Must grant the scopes the reusable's jobs declare (GitHub validates
	# reusable permissions at startup, before the smoke `if`-skips). The
	# enable-auto-merge job is skipped in smoke mode, so the write token is
	# never used to merge anything.
	permissions:
	contents: write
	pull-requests: write
	uses: ./.github/workflows/reusable-auto-merge.yaml
	with:
	# Exercises the trust-check authorize bash; enable-auto-merge is
	# suppressed in smoke mode, so no PR is ever merged.
	smoke: true

	release-please-smoke:
	name: Smoke-test reusable-release-please (self)
	# Must grant the scopes the reusable's release-please job declares (GitHub
	# validates reusable permissions at startup). In smoke mode the action and
	# the evidence dispatch are skipped, so the write token is never used.
	permissions:
	contents: write
	pull-requests: write
	issues: write
	actions: write
	uses: ./.github/workflows/reusable-release-please.yaml
	with:
	# Validates the reusable's wiring/inputs; the release-please action and
	# evidence dispatch are skipped (side effects), so no release is made.
	smoke: true

	org-adr-auto-sync-smoke:
	name: Smoke-test reusable-org-adr-auto-sync (self)
	permissions:
	contents: read
	pull-requests: read
	uses: ./.github/workflows/reusable-org-adr-auto-sync.yaml
	with:
	source_repo: NWarila/.github
	source_ref: main
	smoke: true

Navigation Menu

[sync] add org ADR sync manifest #65

Workflow file

[sync] add org ADR sync manifest #65

Uh oh!

Workflow file for this run