|
| 1 | +// SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. |
| 2 | +// SPDX-License-Identifier: Apache-2.0 |
| 3 | + |
| 4 | +import { readFileSync } from "node:fs"; |
| 5 | +import { dirname, join } from "node:path"; |
| 6 | +import { fileURLToPath } from "node:url"; |
| 7 | +import { isDeepStrictEqual } from "node:util"; |
| 8 | + |
| 9 | +import YAML from "yaml"; |
| 10 | + |
| 11 | +const ROOT = join(dirname(fileURLToPath(import.meta.url)), "..", ".."); |
| 12 | +const WORKFLOW_PATH = join(ROOT, ".github", "workflows", "codebase-growth-guardrails.yaml"); |
| 13 | +const STATIC_ACTION_PATH = join(ROOT, ".github", "actions", "ci-static-checks", "action.yaml"); |
| 14 | +const CHECKOUT = "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"; |
| 15 | +const TEST_COMMAND = |
| 16 | + "set -euo pipefail\nnpx vitest run --project integration test/growth-guardrails.test.ts"; |
| 17 | +const STATIC_COMMAND = |
| 18 | + "npx prek run --all-files --stage pre-commit \\\n --skip source-shape-test-budget \\\n --skip test-skills-yaml"; |
| 19 | + |
| 20 | +type Value = Record<string, unknown>; |
| 21 | + |
| 22 | +function object(value: unknown): Value { |
| 23 | + return value && typeof value === "object" && !Array.isArray(value) ? (value as Value) : {}; |
| 24 | +} |
| 25 | + |
| 26 | +function array(value: unknown): unknown[] { |
| 27 | + return Array.isArray(value) ? value : []; |
| 28 | +} |
| 29 | + |
| 30 | +function same(value: unknown, expected: unknown): boolean { |
| 31 | + return isDeepStrictEqual(value, expected); |
| 32 | +} |
| 33 | + |
| 34 | +export function validateGrowthGuardrailsWorkflowBoundary( |
| 35 | + workflowSource = readFileSync(WORKFLOW_PATH, "utf8"), |
| 36 | + staticActionSource = readFileSync(STATIC_ACTION_PATH, "utf8"), |
| 37 | +): string[] { |
| 38 | + let workflow: Value; |
| 39 | + let action: Value; |
| 40 | + try { |
| 41 | + workflow = object(YAML.parse(workflowSource)); |
| 42 | + action = object(YAML.parse(staticActionSource)); |
| 43 | + } catch { |
| 44 | + return ["growth guardrail workflow configuration must be valid YAML"]; |
| 45 | + } |
| 46 | + |
| 47 | + const expectedWorkflow = { |
| 48 | + name: "Governance / Enforce Codebase Growth Limits", |
| 49 | + on: { |
| 50 | + pull_request_target: { types: ["opened", "reopened", "synchronize", "ready_for_review"] }, |
| 51 | + }, |
| 52 | + permissions: { contents: "read", "pull-requests": "read" }, |
| 53 | + jobs: { |
| 54 | + "codebase-growth-guardrails": { |
| 55 | + name: "codebase-growth-guardrails", |
| 56 | + "runs-on": "ubuntu-latest", |
| 57 | + "timeout-minutes": 5, |
| 58 | + steps: [ |
| 59 | + { |
| 60 | + name: "Check out the trusted base revision", |
| 61 | + uses: CHECKOUT, |
| 62 | + with: { |
| 63 | + ref: "${{ github.event.pull_request.base.sha }}", |
| 64 | + "persist-credentials": false, |
| 65 | + }, |
| 66 | + }, |
| 67 | + { |
| 68 | + name: "Install trusted dependencies", |
| 69 | + run: "npm ci --ignore-scripts --no-audit --no-fund", |
| 70 | + }, |
| 71 | + { |
| 72 | + name: "Test codebase growth guardrails", |
| 73 | + env: { |
| 74 | + NEMOCLAW_GROWTH_PR: "1", |
| 75 | + GH_TOKEN: "${{ github.token }}", |
| 76 | + PR_NUMBER: "${{ github.event.pull_request.number }}", |
| 77 | + REPO: "${{ github.repository }}", |
| 78 | + BASE_SHA: "${{ github.event.pull_request.base.sha }}", |
| 79 | + HEAD_REPO: "${{ github.event.pull_request.head.repo.full_name }}", |
| 80 | + HEAD_SHA: "${{ github.event.pull_request.head.sha }}", |
| 81 | + }, |
| 82 | + run: TEST_COMMAND + "\n", |
| 83 | + }, |
| 84 | + ], |
| 85 | + }, |
| 86 | + }, |
| 87 | + }; |
| 88 | + const normalizedWorkflow: Value = { ...workflow, on: workflow.on ?? workflow.true }; |
| 89 | + delete normalizedWorkflow.true; |
| 90 | + const errors: string[] = []; |
| 91 | + if (!same(normalizedWorkflow, expectedWorkflow)) { |
| 92 | + errors.push("growth guardrail workflow must match the reviewed trust boundary"); |
| 93 | + } |
| 94 | + |
| 95 | + const staticSteps = array(object(action.runs).steps).map(object); |
| 96 | + const namedStaticSteps = staticSteps.filter((step) => step.name === "Run static hook checks"); |
| 97 | + if ( |
| 98 | + namedStaticSteps.length !== 1 || |
| 99 | + !same(namedStaticSteps[0], { |
| 100 | + name: "Run static hook checks", |
| 101 | + shell: "bash", |
| 102 | + run: STATIC_COMMAND + "\n", |
| 103 | + }) |
| 104 | + ) { |
| 105 | + errors.push("static action must retain the reviewed hook-check step"); |
| 106 | + } |
| 107 | + if (JSON.stringify(action).includes("test-size:check")) { |
| 108 | + errors.push("static checks must not recursively invoke test-size:check"); |
| 109 | + } |
| 110 | + return errors; |
| 111 | +} |
| 112 | + |
| 113 | +const currentModule = fileURLToPath(import.meta.url); |
| 114 | +if (process.argv[1] === currentModule) { |
| 115 | + const errors = validateGrowthGuardrailsWorkflowBoundary(); |
| 116 | + if (errors.length > 0) { |
| 117 | + errors.forEach((error) => console.error(error)); |
| 118 | + process.exit(1); |
| 119 | + } |
| 120 | + console.log("Codebase growth guardrail workflow boundary passed."); |
| 121 | +} |
0 commit comments