add # 新增对zhenxun的工作流

scripts/check_workflows.py

@@ -0,0 +1,44 @@
+"""检查两个生成工作流的YAML及发布权限；依赖仅用于开发检查。"""
+
+import argparse
+from pathlib import Path
+import sys
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--dependency-path", type=Path)
+    args = parser.parse_args()
+    if args.dependency_path:
+        sys.path.insert(0, str(args.dependency_path.resolve(strict=True)))
+    import yaml
+    root = Path(__file__).resolve().parents[1]
+    source = yaml.load((
+        root / ".github/workflows/zhenxun-preview.yml"
+    ).read_text(encoding="utf-8"), Loader=yaml.BaseLoader)
+    generated = yaml.load((
+        root / "release/zhenxun/verify.yml"
+    ).read_text(encoding="utf-8"), Loader=yaml.BaseLoader)
+    if source["permissions"] != {"contents":"read"}:
+        raise ValueError("Source workflow permissions differ")
+    trigger = source["on"]
+    if set(trigger) != {"push", "pull_request", "workflow_dispatch"}:
+        raise ValueError("Unsafe or missing workflow trigger")
+    inputs = trigger["workflow_dispatch"]["inputs"]
+    if inputs["publish"]["default"] != "false":
+        raise ValueError("Publish must be opt-in")
+    sync = source["jobs"]["sync-preview"]
+    if (sync["environment"] != "zhenxun-preview"
+            or "refs/heads/main" not in sync["if"]
+            or "workflow_dispatch" not in sync["if"]
+            or sync["needs"] != ["test", "build"]):
+        raise ValueError("Publish boundary differs")
+    if generated["permissions"] != {"contents":"read"}:
+        raise ValueError("Generated workflow permissions differ")
+    if generated["on"]["push"]["branches"] != ["farm-preview"]:
+        raise ValueError("Generated branch differs")
+    print("Workflow YAML and publication guards checked")
+
+
+if __name__ == "__main__":
+    main()