mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-29 16:17:20 +09:00
Aleksei Sviridkin
8aa30472b6
The comment above the top-level `permissions` block claimed that jobs request the minimum extra scopes on top of it. A job-level block does not add to the workflow-level one: it replaces it, and every scope the job does not name is set to none. A job needing one extra scope has to restate `contents: read` alongside it or lose read access to the repository. The corrected wording states the replace semantics, so the next job block written against this comment grants the whole set it needs rather than only the delta. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Aleksei Sviridkin <f@lex.la>
69 lines
2.2 KiB
YAML
69 lines
2.2 KiB
YAML
name: Codegen Drift Check
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize, reopened]
|
|
paths:
|
|
- 'api/**'
|
|
- 'pkg/apis/**'
|
|
- 'pkg/generated/**'
|
|
- 'internal/crdinstall/manifests/**'
|
|
- 'packages/system/cozystack-controller/definitions/**'
|
|
- 'packages/system/application-definition-crd/definition/**'
|
|
- 'packages/system/backup-controller/definitions/**'
|
|
- 'packages/system/backupstrategy-controller/definitions/**'
|
|
- 'hack/update-codegen.sh'
|
|
- 'hack/boilerplate.go.txt'
|
|
- 'Makefile'
|
|
- 'go.mod'
|
|
- 'go.sum'
|
|
- '.github/workflows/codegen-drift.yml'
|
|
|
|
concurrency:
|
|
group: codegen-drift-${{ github.workflow }}-${{ github.event.pull_request.number }}
|
|
cancel-in-progress: true
|
|
|
|
# Top-level token defaults to read-only. A job-level block replaces this one
|
|
# rather than adding to it, so each job restates every scope it needs.
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
codegen-drift:
|
|
name: Verify generated code is up to date
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
|
|
|
|
- name: Set up Go
|
|
uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
|
|
with:
|
|
go-version-file: go.mod
|
|
cache: true
|
|
|
|
- name: Pre-fetch k8s.io/code-generator module
|
|
# hack/update-codegen.sh sources kube_codegen.sh from the Go module cache.
|
|
# The module is not declared in go.mod, so fetch it explicitly at the
|
|
# version pinned in the script.
|
|
run: |
|
|
version=$(grep -oP 'code-generator@\Kv[0-9.]+' hack/update-codegen.sh)
|
|
tmpdir=$(mktemp -d)
|
|
cd "$tmpdir"
|
|
go mod init codegen-fetch
|
|
go get "k8s.io/code-generator@${version}"
|
|
|
|
- name: Run make generate
|
|
run: make generate
|
|
|
|
- name: Fail on drift
|
|
run: |
|
|
if [ -n "$(git status --porcelain)" ]; then
|
|
echo "::error::'make generate' produced changes. Run 'make generate' locally and commit the result."
|
|
git status --short
|
|
git diff --color=always
|
|
exit 1
|
|
fi
|