323 lines
10 KiB
YAML
323 lines
10 KiB
YAML
name: Update Star History
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '17 3 1,16 * *'
|
|
timezone: 'UTC'
|
|
workflow_dispatch:
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: repository-star-history-${{ github.repository_id }}
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
update-default-branch:
|
|
if: >-
|
|
${{
|
|
github.repository == '666ghj/MiroFish' &&
|
|
github.ref_name == github.event.repository.default_branch &&
|
|
(
|
|
github.event_name == 'schedule' ||
|
|
(
|
|
github.event_name == 'workflow_dispatch' &&
|
|
github.actor_id == '110395318' &&
|
|
github.triggering_actor == '666ghj'
|
|
)
|
|
)
|
|
}}
|
|
runs-on: ubuntu-24.04
|
|
timeout-minutes: 10
|
|
permissions:
|
|
contents: write
|
|
env:
|
|
GIT_TERMINAL_PROMPT: '0'
|
|
EXPECTED_REPOSITORY: '666ghj/MiroFish'
|
|
EXPECTED_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
|
|
steps:
|
|
- name: Fetch triggering public commit without credentials
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ''
|
|
GH_TOKEN: ''
|
|
run: |
|
|
set -euo pipefail
|
|
[[ "${GITHUB_REPOSITORY,,}" == "${EXPECTED_REPOSITORY,,}" ]]
|
|
[[ "$GITHUB_REF" == "refs/heads/$EXPECTED_DEFAULT_BRANCH" ]]
|
|
git init .
|
|
git remote add origin 'https://github.com/666ghj/MiroFish.git'
|
|
git \
|
|
-c credential.helper= \
|
|
-c http.followRedirects=false \
|
|
fetch \
|
|
--no-tags \
|
|
--depth=1 \
|
|
origin \
|
|
"$GITHUB_REF"
|
|
[[ "$(git rev-parse FETCH_HEAD)" == "$GITHUB_SHA" ]]
|
|
git -c core.hooksPath=/dev/null checkout --detach "$GITHUB_SHA"
|
|
[[ -z "$(git status --porcelain --untracked-files=all)" ]]
|
|
|
|
- name: Run Star History tests without tokens
|
|
env:
|
|
GITHUB_TOKEN: ''
|
|
GH_TOKEN: ''
|
|
run: >-
|
|
python3 -m unittest
|
|
tests.test_local_star_history
|
|
tests.test_local_star_count_fetch
|
|
-v
|
|
|
|
- name: Fetch aggregate Star count only
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
run: |
|
|
set -euo pipefail
|
|
umask 077
|
|
printf '%s %s\n' \
|
|
'dfe9e0060d9abb0b3e1cda61bd73bba77fe878815adcbea14601666dce30e927' \
|
|
'scripts/fetch_star_count.py' |
|
|
sha256sum --check --strict -
|
|
output="$RUNNER_TEMP/repository-star-count.txt"
|
|
[[ ! -e "$output" && ! -L "$output" ]]
|
|
python3 scripts/fetch_star_count.py > "$output"
|
|
[[ -f "$output" && ! -L "$output" ]]
|
|
(( $(wc -c < "$output") <= 32 ))
|
|
mapfile -t lines < "$output"
|
|
(( ${#lines[@]} == 1 ))
|
|
[[ "${lines[0]}" =~ ^[0-9]+$ ]]
|
|
|
|
- name: Record scheduled aggregate Star snapshot offline without tokens
|
|
shell: bash
|
|
env:
|
|
STAR_COUNT_FILE: ${{ runner.temp }}/repository-star-count.txt
|
|
GITHUB_TOKEN: ''
|
|
GH_TOKEN: ''
|
|
run: |
|
|
set -euo pipefail
|
|
trap 'rm -f -- "$STAR_COUNT_FILE"' EXIT
|
|
[[ -z "${GITHUB_TOKEN:-}" && -z "${GH_TOKEN:-}" ]]
|
|
python3 scripts/star_history.py record \
|
|
--count-file "$STAR_COUNT_FILE" \
|
|
--force
|
|
|
|
- name: Verify generated outputs without tokens
|
|
env:
|
|
GITHUB_TOKEN: ''
|
|
GH_TOKEN: ''
|
|
run: |
|
|
python3 scripts/star_history.py check
|
|
python3 -m unittest \
|
|
tests.test_local_star_history \
|
|
tests.test_local_star_count_fetch \
|
|
-v
|
|
|
|
- name: Commit exact output allowlist
|
|
id: commit
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ''
|
|
GH_TOKEN: ''
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
allowed() {
|
|
case "$1" in
|
|
.github/star-history/history.json|\
|
|
static/image/star-history-light.svg|\
|
|
static/image/star-history-dark.svg) return 0 ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
bad=0
|
|
while IFS= read -r -d '' path; do
|
|
if ! allowed "$path"; then
|
|
printf '::error::Unexpected changed path: %q\n' "$path"
|
|
bad=1
|
|
fi
|
|
done < <(
|
|
git diff --name-only -z
|
|
git diff --cached --name-only -z
|
|
git ls-files --others --exclude-standard -z
|
|
)
|
|
(( bad == 0 )) || exit 1
|
|
|
|
for path in \
|
|
.github/star-history/history.json \
|
|
static/image/star-history-light.svg \
|
|
static/image/star-history-dark.svg
|
|
do
|
|
[[ -f "$path" && ! -L "$path" && -s "$path" ]] || {
|
|
printf '::error::Invalid output file: %s\n' "$path"
|
|
exit 1
|
|
}
|
|
[[ "$(realpath -e -- "$path")" == "$GITHUB_WORKSPACE/$path" ]] || {
|
|
printf '::error::Output escaped workspace: %s\n' "$path"
|
|
exit 1
|
|
}
|
|
done
|
|
|
|
git add -- \
|
|
.github/star-history/history.json \
|
|
static/image/star-history-light.svg \
|
|
static/image/star-history-dark.svg
|
|
|
|
if git diff --cached --quiet; then
|
|
printf 'created=false\n' >> "$GITHUB_OUTPUT"
|
|
exit 0
|
|
fi
|
|
|
|
count=0
|
|
while IFS= read -r -d '' path; do
|
|
allowed "$path" || exit 1
|
|
((count += 1))
|
|
done < <(git diff --cached --name-only -z)
|
|
(( count > 0 )) || exit 1
|
|
|
|
git config user.name 'github-actions[bot]'
|
|
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
|
|
git \
|
|
-c commit.gpgsign=false \
|
|
-c core.hooksPath=/dev/null \
|
|
commit \
|
|
-m 'chore: update star history [skip ci]'
|
|
printf 'created=true\n' >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Verify one allowlisted commit and unchanged main target
|
|
if: ${{ steps.commit.outputs.created == 'true' }}
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ''
|
|
GH_TOKEN: ''
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
allowed() {
|
|
case "$1" in
|
|
.github/star-history/history.json|\
|
|
static/image/star-history-light.svg|\
|
|
static/image/star-history-dark.svg) return 0 ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
base="$GITHUB_SHA"
|
|
target_ref="$GITHUB_REF"
|
|
[[ "${GITHUB_REPOSITORY,,}" == "${EXPECTED_REPOSITORY,,}" ]]
|
|
[[ "$GITHUB_REF" == "refs/heads/$EXPECTED_DEFAULT_BRANCH" ]]
|
|
[[ "$(git rev-parse HEAD^)" == "$base" ]]
|
|
[[ "$(git rev-list --count "${base}..HEAD")" == 1 ]]
|
|
[[ -z "$(git status --porcelain --untracked-files=all)" ]]
|
|
|
|
origin="$(git remote get-url origin)"
|
|
case "$origin" in
|
|
https://github.com/666ghj/MiroFish|\
|
|
https://github.com/666ghj/MiroFish.git) ;;
|
|
*)
|
|
echo "::error::Unexpected origin"
|
|
exit 1
|
|
;;
|
|
esac
|
|
mapfile -t push_urls < <(git remote get-url --push --all origin)
|
|
(( ${#push_urls[@]} == 1 ))
|
|
[[ "${push_urls[0]}" == "$origin" ]]
|
|
|
|
count=0
|
|
while IFS= read -r -d '' path; do
|
|
allowed "$path" || {
|
|
printf '::error::Unexpected committed path: %q\n' "$path"
|
|
exit 1
|
|
}
|
|
((count += 1))
|
|
done < <(git diff-tree --no-commit-id --name-only -r -z HEAD)
|
|
(( count > 0 )) || exit 1
|
|
|
|
git \
|
|
-c credential.helper= \
|
|
-c http.followRedirects=false \
|
|
fetch \
|
|
--no-tags \
|
|
--depth=1 \
|
|
origin \
|
|
"$target_ref"
|
|
[[ "$(git rev-parse FETCH_HEAD)" == "$base" ]] || {
|
|
echo "::error::Target advanced; refusing to rebase or overwrite"
|
|
exit 1
|
|
}
|
|
|
|
- name: Push one allowlisted commit with an ephemeral credential
|
|
if: ${{ steps.commit.outputs.created == 'true' }}
|
|
shell: bash
|
|
env:
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
GIT_TERMINAL_PROMPT: '0'
|
|
GIT_TRACE: '0'
|
|
GIT_TRACE_CURL: '0'
|
|
GIT_TRACE_PACKET: '0'
|
|
GIT_CURL_VERBOSE: '0'
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
allowed() {
|
|
case "$1" in
|
|
.github/star-history/history.json|\
|
|
static/image/star-history-light.svg|\
|
|
static/image/star-history-dark.svg) return 0 ;;
|
|
*) return 1 ;;
|
|
esac
|
|
}
|
|
|
|
base="$GITHUB_SHA"
|
|
[[ "${GITHUB_REPOSITORY,,}" == "${EXPECTED_REPOSITORY,,}" ]]
|
|
[[ "$GITHUB_REF" == "refs/heads/$EXPECTED_DEFAULT_BRANCH" ]]
|
|
[[ "$(git rev-parse HEAD^)" == "$base" ]]
|
|
[[ "$(git rev-list --count "${base}..HEAD")" == 1 ]]
|
|
[[ -z "$(git status --porcelain --untracked-files=all)" ]]
|
|
|
|
origin="$(git remote get-url origin)"
|
|
case "$origin" in
|
|
https://github.com/666ghj/MiroFish|\
|
|
https://github.com/666ghj/MiroFish.git) ;;
|
|
*)
|
|
echo "::error::Unexpected origin"
|
|
exit 1
|
|
;;
|
|
esac
|
|
mapfile -t push_urls < <(git remote get-url --push --all origin)
|
|
(( ${#push_urls[@]} == 1 ))
|
|
[[ "${push_urls[0]}" == "$origin" ]]
|
|
|
|
count=0
|
|
while IFS= read -r -d '' path; do
|
|
allowed "$path" || {
|
|
printf '::error::Unexpected committed path: %q\n' "$path"
|
|
exit 1
|
|
}
|
|
((count += 1))
|
|
done < <(git diff-tree --no-commit-id --name-only -r -z HEAD)
|
|
(( count > 0 )) || exit 1
|
|
|
|
[[ -n "$GITHUB_TOKEN" ]]
|
|
[[ "$GITHUB_TOKEN" != *$'\n'* && "$GITHUB_TOKEN" != *$'\r'* ]]
|
|
encoded="$(
|
|
printf 'x-access-token:%s' "$GITHUB_TOKEN" |
|
|
base64 |
|
|
tr -d '\n'
|
|
)"
|
|
export GIT_CONFIG_COUNT=1
|
|
export GIT_CONFIG_KEY_0="http.${origin}.extraheader"
|
|
export GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $encoded"
|
|
unset encoded GITHUB_TOKEN
|
|
trap 'unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0' EXIT
|
|
|
|
git \
|
|
-c core.hooksPath=/dev/null \
|
|
-c credential.helper= \
|
|
push \
|
|
--porcelain \
|
|
origin \
|
|
"HEAD:$GITHUB_REF"
|