mirror of
https://github.com/Shu-Ying/main_plugin_farm.git
synced 2026-10-27 20:50:06 +08:00
45 lines
1.8 KiB
Python
45 lines
1.8 KiB
Python
"""检查两个生成工作流的YAML及发布权限；依赖仅用于开发检查。"""
|
|
|
|
import argparse
|
|
from pathlib import Path
|
|
import sys
|
|
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("--dependency-path", type=Path)
|
|
args = parser.parse_args()
|
|
if args.dependency_path:
|
|
sys.path.insert(0, str(args.dependency_path.resolve(strict=True)))
|
|
import yaml
|
|
root = Path(__file__).resolve().parents[1]
|
|
source = yaml.load((
|
|
root / ".github/workflows/zhenxun-preview.yml"
|
|
).read_text(encoding="utf-8"), Loader=yaml.BaseLoader)
|
|
generated = yaml.load((
|
|
root / "release/zhenxun/verify.yml"
|
|
).read_text(encoding="utf-8"), Loader=yaml.BaseLoader)
|
|
if source["permissions"] != {"contents":"read"}:
|
|
raise ValueError("Source workflow permissions differ")
|
|
trigger = source["on"]
|
|
if set(trigger) != {"push", "pull_request", "workflow_dispatch"}:
|
|
raise ValueError("Unsafe or missing workflow trigger")
|
|
inputs = trigger["workflow_dispatch"]["inputs"]
|
|
if inputs["publish"]["default"] != "false":
|
|
raise ValueError("Publish must be opt-in")
|
|
sync = source["jobs"]["sync-preview"]
|
|
if (sync["environment"] != "zhenxun-preview"
|
|
or "refs/heads/main" not in sync["if"]
|
|
or "workflow_dispatch" not in sync["if"]
|
|
or sync["needs"] != ["test", "build"]):
|
|
raise ValueError("Publish boundary differs")
|
|
if generated["permissions"] != {"contents":"read"}:
|
|
raise ValueError("Generated workflow permissions differ")
|
|
if generated["on"]["push"]["branches"] != ["farm-preview"]:
|
|
raise ValueError("Generated branch differs")
|
|
print("Workflow YAML and publication guards checked")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
main()
|