add # 新增Nonebot发布工作流

scripts/check_workflows.py

@@ -1,4 +1,4 @@
-"""检查两个生成工作流的YAML及发布权限；依赖仅用于开发检查。"""
+"""检查真寻与 NoneBot 工作流的 YAML 和发布边界。"""
 
 import argparse
 from pathlib import Path
@@ -46,6 +46,46 @@ def main():
         raise ValueError("Generated workflow permissions differ")
     if generated["on"]["push"]["branches"] != ["main"]:
         raise ValueError("Generated branch differs")
+    nonebot = yaml.load((
+        root / ".github/workflows/nonebot-preview.yml"
+    ).read_text(encoding="utf-8"), Loader=yaml.BaseLoader)
+    if nonebot["permissions"] != {"contents": "read"}:
+        raise ValueError("NoneBot source permissions differ")
+    trigger = nonebot["on"]
+    if (set(trigger) != {"push", "pull_request", "workflow_dispatch"}
+            or trigger["push"]["branches"] != ["main"]
+            or set(trigger["workflow_dispatch"]["inputs"]) != {"publish"}
+            or trigger["workflow_dispatch"]["inputs"]["publish"]["default"]
+            != "false"):
+        raise ValueError("NoneBot source triggers differ")
+    sync = nonebot["jobs"]["sync-preview"]
+    if (sync["environment"] != "zhenxun-preview"
+            or " ".join(sync["if"].split()) != expected_condition
+            or nonebot["jobs"]["build"]["needs"] != "test"
+            or sync["needs"] != ["test", "build"]):
+        raise ValueError("NoneBot sync boundary differs")
+    token = sync["steps"][-1]["env"]["FARM_RELEASE_TOKEN"]
+    if token != "${{ secrets.FARM_RELEASE_TOKEN }}":
+        raise ValueError("NoneBot must reuse FARM_RELEASE_TOKEN")
+    generated = yaml.load((
+        root / "release/nonebot/verify.yml"
+    ).read_text(encoding="utf-8"), Loader=yaml.BaseLoader)
+    if (generated["permissions"] != {"contents": "read"}
+            or generated["on"]["push"]["branches"] != ["main"]):
+        raise ValueError("NoneBot generated verification boundary differs")
+    publishing = yaml.load((
+        root / "release/nonebot/publish.yaml"
+    ).read_text(encoding="utf-8"), Loader=yaml.BaseLoader)
+    if (publishing["permissions"] != {"contents": "read"}
+            or publishing["on"] != {"push": {"tags": ["v*"]}}
+            or publishing["jobs"]["publish"]["needs"] != "build"
+            or publishing["jobs"]["publish"]["if"] != (
+                "github.repository == 'Shu-Ying/nonebot_plugin_farm'"
+            )):
+        raise ValueError("NoneBot PyPI boundary differs")
+    steps = publishing["jobs"]["publish"]["steps"]
+    if steps[-1]["with"]["password"] != "${{ secrets.PYPI_TOKEN }}":
+        raise ValueError("Keep the existing PyPI secret")
     print("Workflow YAML and publication guards checked")