From addf59190e96dd4b1ba1cacfd26002cf0dc56aaf Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Sun, 25 Oct 2026 00:11:42 +0200 Subject: [PATCH] feat(retired-links): check retired repository links by default The retired-link guard now runs unless a caller passes enabled: false. All twelve repositories that call it already pass enabled: true, so no caller changes behaviour; the input stays as a supported off switch. Fixes #269 Co-Authored-By: Claude Opus 5.5 --- .github/agent-guides/validation.md | 9 +++---- .github/workflows/ci.yaml | 24 ++++++++++++++----- actions/validate-retired-repo-links/README.md | 23 ++++++++---------- .../validate-retired-repo-links/action.yaml | 8 +++---- 4 files changed, 37 insertions(+), 27 deletions(-) diff --git a/.github/agent-guides/validation.md b/.github/agent-guides/validation.md index 65452e16..a64d5473 100644 --- a/.github/agent-guides/validation.md +++ b/.github/agent-guides/validation.md @@ -70,8 +70,9 @@ before searching captured output; do not blanket-exempt the repository's scripts Every shared-action call validates. Linux/macOS fixtures cover clean, unsafe and malformed scans. An invalid scope must fail without a `validated` output. -**Retired repository links:** `validate-retired-repo-links` is a default-off, -read-only Go validator with no module dependencies. Keep both flag states, real +**Retired repository links:** `validate-retired-repo-links` is a default-on, +read-only Go validator with no module dependencies; `enabled: "false"` switches it +off without removing the step. Keep the default, both explicit states, real good/bad action fixtures on Linux/macOS, and the required-check wiring covered. Successful calls expose their exact action module directory for same-job consumer refusal controls; disabled and failed calls expose neither validation nor source @@ -79,6 +80,6 @@ outputs. Keep the native usable-source assertions and `.github/tests/test-retired-repo-links-source.sh` passing when changing this boundary. Configuration belongs to each consumer; never hard-code retired portfolio names or blanket historical exemptions in the action. Exceptions require an exact -file, repository and reason. Consumer adoption and flag retirement are in -[#269](https://github.com/devantler-tech/.github/issues/269). +file, repository and reason. The `enabled` input is a supported off switch, not a +temporary rollout flag ([#269](https://github.com/devantler-tech/.github/issues/269)). diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index cb385990..c8a5c27f 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -169,7 +169,7 @@ jobs: test-validate-retired-repo-links-disabled: needs: [select-ci-tests] if: "${{ github.event_name != 'merge_group' && !startsWith(github.event.head_commit.message, 'chore(main): release ') && contains(fromJSON(needs.select-ci-tests.outputs.selected), 'test-validate-retired-repo-links-disabled') }}" - name: "[Test] Retired Repository Links - Disabled" + name: "[Test] Retired Repository Links - Default and Disabled" runs-on: ubuntu-latest permissions: contents: read @@ -182,12 +182,19 @@ jobs: uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - name: Omitted opt-in skips a missing consumer + - name: Omitted input validates by default id: omitted # actionlint rejects $/ syntax (#1234); this tests the checked-out candidate. uses: ./actions/validate-retired-repo-links # zizmor: ignore[self-repository] with: - working-directory: missing-directory + working-directory: .github/fixtures/retired-repo-links + - name: Omitted input rejects the seeded violation + id: omitted_violation + continue-on-error: true + uses: ./actions/validate-retired-repo-links # zizmor: ignore[self-repository] + with: + working-directory: .github/fixtures/retired-repo-links + config-file: invalid.json - name: Explicit false skips the seeded violation id: disabled uses: ./actions/validate-retired-repo-links # zizmor: ignore[self-repository] @@ -201,10 +208,12 @@ jobs: uses: ./actions/validate-retired-repo-links # zizmor: ignore[self-repository] with: enabled: "yes" - - name: Assert disabled and invalid calls do not validate + - name: Assert default calls validate and disabled or invalid calls do not shell: bash env: OMITTED: ${{ steps.omitted.outputs.validated }} + OMITTED_VIOLATION: ${{ steps.omitted_violation.outcome }} + OMITTED_VIOLATION_VALIDATED: ${{ steps.omitted_violation.outputs.validated }} DISABLED: ${{ steps.disabled.outputs.validated }} INVALID: ${{ steps.invalid.outcome }} OMITTED_SOURCE: ${{ steps.omitted.outputs.source-directory }} @@ -212,10 +221,13 @@ jobs: INVALID_SOURCE: ${{ steps.invalid.outputs.source-directory }} INVALID_VALIDATED: ${{ steps.invalid.outputs.validated }} run: | - test -z "$OMITTED" + test "$OMITTED" = true + test -n "$OMITTED_SOURCE" + test "$(cd "$OMITTED_SOURCE" && pwd -P)" = "$(cd actions/validate-retired-repo-links && pwd -P)" + test "$OMITTED_VIOLATION" = failure + test -z "$OMITTED_VIOLATION_VALIDATED" test -z "$DISABLED" test "$INVALID" = failure - test -z "$OMITTED_SOURCE" test -z "$DISABLED_SOURCE" test -z "$INVALID_SOURCE" test -z "$INVALID_VALIDATED" diff --git a/actions/validate-retired-repo-links/README.md b/actions/validate-retired-repo-links/README.md index ea3489f7..7122dff2 100644 --- a/actions/validate-retired-repo-links/README.md +++ b/actions/validate-retired-repo-links/README.md @@ -9,7 +9,7 @@ does not call GitHub, follow links, or infer retirement from a repository name. | Name | Description | Required | Default | |------|-------------|----------|---------| -| `enabled` | Opt in to validation; exactly `true` or `false`. | No | `false` | +| `enabled` | Run validation; exactly `true` or `false`. Set `false` to switch the check off without removing the step. | No | `true` | | `config-file` | JSON configuration relative to `working-directory`. | No | `.github/retired-repo-links.json` | | `working-directory` | Consumer directory, relative to `GITHUB_WORKSPACE` or absolute. | No | `.` | @@ -38,19 +38,16 @@ steps: with: persist-credentials: false - uses: devantler-tech/.github/actions/validate-retired-repo-links@ # vX.Y.Z - with: - enabled: "true" ``` -Omitted or false `enabled` inputs do not install Go, read configuration or scan -files. Enabled runs install the Go version from this action's module and build a -standard-library-only validator from the pinned action revision. The caller's Go -module and workspace are not used. That Go stays on `PATH` for later steps in the -same job, so run the action in its own job, or set up your own Go version again -after it. Linux and macOS runners are supported. - -Consumer adoption and removal of the temporary `enabled` flag are tracked in -[#269](https://github.com/devantler-tech/.github/issues/269). +The check runs by default. An `enabled: "false"` input switches it off without +removing the step: it then does not install Go, read configuration or scan files. +Callers that already pass `enabled: "true"` keep working unchanged. Enabled runs +install the Go version from this action's module and build a standard-library-only +validator from the pinned action revision. The caller's Go module and workspace are +not used. That Go stays on `PATH` for later steps in the same job, so run the action +in its own job, or set up your own Go version again after it. Linux and macOS +runners are supported. ## Configuration @@ -110,7 +107,7 @@ GOWORK=off go -C /path/to/actions/validate-retired-repo-links run -mod=readonly --root /path/to/consumer --config .github/retired-repo-links.json ``` -The CLI always validates; the opt-in belongs to the composite action. Exit codes +The CLI always validates; the `enabled` switch belongs to the composite action. Exit codes are `0` for a complete clean scan, `1` for retired links, and `2` for configuration, argument or filesystem errors. diff --git a/actions/validate-retired-repo-links/action.yaml b/actions/validate-retired-repo-links/action.yaml index 97d23e68..c1d00376 100644 --- a/actions/validate-retired-repo-links/action.yaml +++ b/actions/validate-retired-repo-links/action.yaml @@ -3,9 +3,9 @@ description: Reject links to configured retired GitHub repositories with documen author: devantler-tech inputs: enabled: - description: Opt in to checking retired repository links. + description: Check retired repository links; set to false to switch the check off without removing the step. required: false - default: "false" + default: "true" config-file: description: JSON configuration path relative to working-directory. required: false @@ -24,14 +24,14 @@ outputs: runs: using: composite steps: - - name: Check opt-in input + - name: Check enabled input shell: bash env: ENABLED: ${{ inputs.enabled }} run: | case "$ENABLED" in true) ;; - false) echo "Retired repository link validation is disabled; set enabled to true to opt in." ;; + false) echo "Retired repository link validation is switched off by enabled: false." ;; *) echo "::error::enabled must be exactly true or false"; exit 1 ;; esac