chore: gitignore local ideas/ brainstorm (never track) #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Canonical drift-check workflow — Nix Packaging Standard. | |
| # Source of truth: github:Daaboulex/nix-packaging-standard. Synced into each | |
| # packaging repo by sync.sh — do not edit per-repo copies. | |
| # | |
| # Fails CI if any synced standard file (scripts/update.sh + the two canonical | |
| # workflows) has drifted from the canonical, so a per-repo copy can never | |
| # silently diverge. `custom`-type repos keep a bespoke scripts/update.sh and | |
| # are skipped for that one file only. | |
| name: Drift check | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| drift-check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| - name: Verify synced standard files match the canonical standard | |
| run: | | |
| TYPE=$(jq -r '.upstream.type // "none"' .github/update.json 2>/dev/null || echo none) | |
| BASE="https://raw.githubusercontent.com/Daaboulex/nix-packaging-standard/main" | |
| # canonical file in the standard repo -> path inside this repo | |
| declare -A FILES=( | |
| ["update.sh"]="scripts/update.sh" | |
| ["update.yml"]=".github/workflows/update.yml" | |
| ["drift-check.yml"]=".github/workflows/drift-check.yml" | |
| ) | |
| fail=0 | |
| for canon in "${!FILES[@]}"; do | |
| dst="${FILES[$canon]}" | |
| # custom-type repos keep a bespoke scripts/update.sh. | |
| if [ "$canon" = "update.sh" ] && [ "$TYPE" = "custom" ]; then | |
| echo "skip $dst (custom-type repo — bespoke updater)" | |
| continue | |
| fi | |
| if [ ! -f "$dst" ]; then | |
| echo "::error::$dst is missing — run sync.sh from the standard repo" | |
| fail=1 | |
| continue | |
| fi | |
| if ! curl -sfL "$BASE/$canon" -o "/tmp/canon-$canon"; then | |
| echo "::error::could not fetch canonical $canon from $BASE" | |
| fail=1 | |
| continue | |
| fi | |
| LOCAL=$(sha256sum "$dst" | cut -d' ' -f1) | |
| CANON=$(sha256sum "/tmp/canon-$canon" | cut -d' ' -f1) | |
| if [ "$LOCAL" != "$CANON" ]; then | |
| echo "::error::$dst has drifted from the canonical standard" | |
| echo " local: $LOCAL" | |
| echo " canonical: $CANON" | |
| fail=1 | |
| continue | |
| fi | |
| echo "ok $dst matches the canonical standard ($LOCAL)" | |
| done | |
| if [ "$fail" -ne 0 ]; then | |
| echo "::error::drift detected — re-run sync.sh from the standard repo, then commit" | |
| exit 1 | |
| fi | |
| - name: Validate .github/update.json against the canonical schema | |
| run: | | |
| BASE="https://raw.githubusercontent.com/Daaboulex/nix-packaging-standard/main" | |
| if [ ! -f .github/update.json ]; then | |
| echo "no update.json — nothing to validate" | |
| exit 0 | |
| fi | |
| if ! curl -sfL "$BASE/update.schema.json" -o /tmp/update.schema.json; then | |
| echo "::error::could not fetch canonical update.schema.json" | |
| exit 1 | |
| fi | |
| pipx run check-jsonschema --schemafile /tmp/update.schema.json .github/update.json |