From ca14209ab67cc8cc77db3ed50295addaadddeff0 Mon Sep 17 00:00:00 2001 From: Mathih13 Date: Wed, 7 Oct 2026 23:56:15 +0200 Subject: [PATCH] ci: refuse a Package API exemption in an official Package Co-Authored-By: Claude Opus 5.5 (1M context) --- .github/workflows/core-tip.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.github/workflows/core-tip.yml b/.github/workflows/core-tip.yml index 364fddd..0fa3a6e 100644 --- a/.github/workflows/core-tip.yml +++ b/.github/workflows/core-tip.yml @@ -30,6 +30,26 @@ jobs: ./.github/test-artifact-firewall.sh ./.github/check-artifact-firewall.sh + package-api-exemptions: + runs-on: ubuntu-latest + timeout-minutes: 5 + + steps: + - name: Check out Packages + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + # git grep exits 1 when it finds nothing. A match or an error fails the job. + - name: Refuse a Package API exemption in an official Package + run: | + status=0 + git grep -n -F 'package-api: exempt' -- '*/*' ':!.*' || status=$? + if [ "$status" -ne 1 ]; then + echo "An official Package calls only the Package API. Remove each exemption above." >&2 + exit 1 + fi + module: needs: firewall runs-on: ubuntu-latest