|
| 1 | +#!/usr/bin/env bash |
| 2 | +# |
| 3 | +# Manual pre-tag audit for GitHub Environment release gates. |
| 4 | +# |
| 5 | +# This is intentionally not a normal CI check: it requires an authenticated |
| 6 | +# gh token that can read repository environment settings. |
| 7 | +set -euo pipefail |
| 8 | + |
| 9 | +REPO="${REPO:-Fieldnote-Echo/ordvec}" |
| 10 | +EXPECTED_REVIEWER="${EXPECTED_REVIEWER:-Fieldnote-Echo}" |
| 11 | +EXPECTED_POLICY="${EXPECTED_POLICY:-v[0-9]*.[0-9]*.[0-9]*}" |
| 12 | +ENVIRONMENTS=(crates-io pypi) |
| 13 | + |
| 14 | +fail() { |
| 15 | + echo "::error::release environment settings audit failed: $*" |
| 16 | + exit 1 |
| 17 | +} |
| 18 | + |
| 19 | +api_jq() { |
| 20 | + local path="$1" |
| 21 | + local filter="$2" |
| 22 | + local err output stderr |
| 23 | + |
| 24 | + if ! err="$(mktemp)"; then |
| 25 | + fail "could not create temporary file for gh api stderr" |
| 26 | + fi |
| 27 | + |
| 28 | + if ! output="$(gh api "$path" --jq "$filter" 2>"$err")"; then |
| 29 | + stderr="$(cat "$err")" |
| 30 | + rm -f "$err" |
| 31 | + fail "cannot read ${path}; authenticate with a token that can read ${REPO} repository environment settings. gh api: ${stderr}" |
| 32 | + fi |
| 33 | + rm -f "$err" |
| 34 | + |
| 35 | + printf '%s\n' "$output" |
| 36 | +} |
| 37 | + |
| 38 | +command -v gh >/dev/null 2>&1 \ |
| 39 | + || fail "gh CLI not found; install GitHub CLI (gh) and authenticate before running this audit" |
| 40 | + |
| 41 | +if ! gh auth status -h github.com; then |
| 42 | + fail "gh auth status failed; run gh auth login with an account/token that can read ${REPO} repository environment settings" |
| 43 | +fi |
| 44 | + |
| 45 | +check_environment() { |
| 46 | + local env="$1" |
| 47 | + local env_path="repos/${REPO}/environments/${env}" |
| 48 | + local policies_path="${env_path}/deployment-branch-policies?per_page=100" |
| 49 | + local env_data policies_data |
| 50 | + local env_name required_rule_count reviewer_count reviewer_summary |
| 51 | + local custom_branch_policies protected_branches |
| 52 | + local policy_total policy_summary policy_type policy_name |
| 53 | + |
| 54 | + echo "Auditing ${REPO} environment ${env}..." |
| 55 | + |
| 56 | + env_data="$(api_jq "$env_path" '[ |
| 57 | + (.name // ""), |
| 58 | + ([.protection_rules[]? | select(.type == "required_reviewers")] | length | tostring), |
| 59 | + ([.protection_rules[]? | select(.type == "required_reviewers") | .reviewers[]?] | length | tostring), |
| 60 | + ([.protection_rules[]? | select(.type == "required_reviewers") | .reviewers[]? | "\(.type):\(.reviewer.login // .reviewer.slug // .reviewer.name // "unknown")"] | join(", ")), |
| 61 | + (.deployment_branch_policy.custom_branch_policies | tostring), |
| 62 | + (.deployment_branch_policy.protected_branches | tostring) |
| 63 | + ] | @tsv')" |
| 64 | + IFS=$'\t' read -r env_name required_rule_count reviewer_count reviewer_summary custom_branch_policies protected_branches <<< "$env_data" |
| 65 | + |
| 66 | + [ "$env_name" = "$env" ] \ |
| 67 | + || fail "${env}: environment not found" |
| 68 | + |
| 69 | + [ "$required_rule_count" = "1" ] \ |
| 70 | + || fail "${env}: expected exactly one required_reviewers protection rule; found ${required_rule_count}" |
| 71 | + |
| 72 | + [ "$reviewer_count" = "1" ] \ |
| 73 | + || fail "${env}: expected exactly one required reviewer User:${EXPECTED_REVIEWER}; found ${reviewer_count} (${reviewer_summary:-none})" |
| 74 | + [ "$reviewer_summary" = "User:${EXPECTED_REVIEWER}" ] \ |
| 75 | + || fail "${env}: expected required reviewer User:${EXPECTED_REVIEWER}; found ${reviewer_summary:-none}" |
| 76 | + |
| 77 | + [ "$custom_branch_policies" = "true" ] \ |
| 78 | + || fail "${env}: expected deployment_branch_policy.custom_branch_policies == true; found ${custom_branch_policies}" |
| 79 | + |
| 80 | + [ "$protected_branches" = "false" ] \ |
| 81 | + || fail "${env}: expected deployment_branch_policy.protected_branches == false; found ${protected_branches}" |
| 82 | + |
| 83 | + policies_data="$(api_jq "$policies_path" '[ |
| 84 | + (.total_count | tostring), |
| 85 | + ([.branch_policies[]? | "\(.type):\(.name)"] | join(", ")), |
| 86 | + (.branch_policies[0].type // ""), |
| 87 | + (.branch_policies[0].name // "") |
| 88 | + ] | @tsv')" |
| 89 | + IFS=$'\t' read -r policy_total policy_summary policy_type policy_name <<< "$policies_data" |
| 90 | + |
| 91 | + [ "$policy_total" = "1" ] \ |
| 92 | + || fail "${env}: expected exactly one deployment branch/tag policy tag:${EXPECTED_POLICY}; found ${policy_total} (${policy_summary:-none})" |
| 93 | + |
| 94 | + [ "$policy_type" = "tag" ] \ |
| 95 | + || fail "${env}: expected deployment policy type tag; found ${policy_type:-none}" |
| 96 | + |
| 97 | + [ "$policy_name" = "$EXPECTED_POLICY" ] \ |
| 98 | + || fail "${env}: expected deployment policy name ${EXPECTED_POLICY}; found ${policy_name:-none}" |
| 99 | + |
| 100 | + echo "OK: ${env} requires User:${EXPECTED_REVIEWER} and only tag:${EXPECTED_POLICY}." |
| 101 | +} |
| 102 | + |
| 103 | +for env in "${ENVIRONMENTS[@]}"; do |
| 104 | + check_environment "$env" |
| 105 | +done |
| 106 | + |
| 107 | +echo "OK: release environment settings match the pre-tag policy." |
0 commit comments