strict repograph boundary wiring #9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: custodian-audit | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| audit: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install Custodian | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install "custodian[tools] @ git+https://github.com/ProtocolWarden/Custodian.git@main" | |
| pip install ruff vulture ty | |
| - name: Install repo (best-effort, for adapter passes) | |
| run: | | |
| if [ -f pyproject.toml ]; then | |
| pip install -e . || true | |
| fi | |
| - name: Materialize boundary artifact file | |
| env: | |
| REPOGRAPH_BOUNDARY_ARTIFACT_SOURCE: ${{ secrets.REPOGRAPH_BOUNDARY_ARTIFACT_FILE }} | |
| run: | | |
| if [ -z "${REPOGRAPH_BOUNDARY_ARTIFACT_SOURCE:-}" ]; then | |
| echo "Missing REPOGRAPH_BOUNDARY_ARTIFACT_FILE secret" >&2 | |
| exit 1 | |
| fi | |
| tmp_file="$(mktemp "${RUNNER_TEMP:-/tmp}/repograph-boundary-XXXXXX.json")" | |
| python - "$REPOGRAPH_BOUNDARY_ARTIFACT_SOURCE" "$tmp_file" <<'PY' | |
| import json | |
| import shutil | |
| import sys | |
| import urllib.request | |
| from pathlib import Path | |
| source = sys.argv[1] | |
| dest = Path(sys.argv[2]) | |
| src_path = Path(source) | |
| if src_path.is_file(): | |
| shutil.copyfile(src_path, dest) | |
| elif source.startswith(("http://", "https://")): | |
| with urllib.request.urlopen(source) as response, dest.open("wb") as fh: | |
| shutil.copyfileobj(response, fh) | |
| else: | |
| raise SystemExit(f"Unsupported boundary artifact source: {source}") | |
| data = json.loads(dest.read_text(encoding="utf-8")) | |
| print(f"boundary_provenance={data.get('source_graph_id')}@{data.get('source_ref_or_commit')}") | |
| PY | |
| echo "REPOGRAPH_BOUNDARY_ARTIFACT_FILE=$tmp_file" >> "$GITHUB_ENV" | |
| - name: Run Custodian audit | |
| run: | | |
| custodian-multi --repos . --fail-on-findings --no-color |