Repository navigation
usd-core: update packages #9589
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: 2026 The RISE Project | |
| # SPDX-License-Identifier: MIT | |
| name: PR verification checks | |
| on: | |
| # 'edited' (title/body changes alone) is added so that stripping an | |
| # auto-injected AI-attribution footer from a PR body re-runs the check | |
| # against the fixed body. Without it, editing the body doesn't retrigger | |
| # the workflow, and re-running the same job replays the original event | |
| # payload, so the check just fails again against the stale text — this | |
| # cost two ports a close-and-reopen of their own PR to get a fresh event. | |
| pull_request: | |
| types: [opened, synchronize, reopened, edited] | |
| jobs: | |
| check_commit_messages: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| # The checks below only read commit messages, so fetch the history of the | |
| # base and the PR head without any trees or blobs. | |
| - name: Fetch the commits of the PR | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: git fetch --quiet --no-tags --filter=tree:0 origin "$BASE_SHA" "$HEAD_SHA" | |
| # The loops below swallow a failing `git rev-list`/`git log`, so a missing | |
| # head would check nothing and pass. Fail unless the range holds exactly | |
| # the commits GitHub counts in the PR. | |
| - name: Check that the whole PR is covered | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| EXPECTED: ${{ github.event.pull_request.commits }} | |
| run: | | |
| set -euo pipefail | |
| actual=$(git rev-list --count "$BASE_SHA..$HEAD_SHA") | |
| if [ "$actual" -eq 0 ] || [ "$actual" -ne "$EXPECTED" ]; then | |
| echo "::error::Expected $EXPECTED commits in the PR but found $actual; the checks below would not cover all of them." | |
| exit 1 | |
| fi | |
| - name: Reject revertme / DO NOT MERGE commits | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| range="$BASE_SHA..$HEAD_SHA" | |
| if git log --pretty=format:%s "$range" | grep -i -e '^revertme' -e '^revert me'; then | |
| echo "::error::Merge request contains at least a commit starting with a 'revert me' tag. Fix it before merging." | |
| exit 1 | |
| fi | |
| if git log --pretty=format:%s "$range" | grep -i -e '^DO NOT MERGE'; then | |
| echo "::error::Merge request contains at least a commit starting with a 'DO NOT MERGE' tag. Review it." | |
| exit 1 | |
| fi | |
| - name: Reject AI-attributed commits | |
| # Catches what the local commit-msg/pre-push hooks | |
| # (ci_scripts/git-hooks/, ci_scripts/check_no_ai_attribution.sh) exist to | |
| # prevent, for a clone that never installed them. | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| set -euo pipefail | |
| status=0 | |
| for commit in $(git rev-list "$BASE_SHA..$HEAD_SHA"); do | |
| if ! git log --format=%B -1 "$commit" | ci_scripts/check_no_ai_attribution.sh -; then | |
| echo "::error::Commit $commit attributes work to an AI tool; see the message above." | |
| status=1 | |
| fi | |
| done | |
| exit $status | |
| - name: Reject an AI-attributed PR title or body | |
| # A different leak vector from the commit-message one above: a PR-creation | |
| # tool can silently append its own "Generated by ..." footer to the PR | |
| # description (or title) without touching any commit message, so the | |
| # commit-scanning check above never sees it. Pass title/body through env, | |
| # never interpolated into the script text, since both are attacker- | |
| # (or tool-) controlled. | |
| env: | |
| PR_TITLE: ${{ github.event.pull_request.title }} | |
| PR_BODY: ${{ github.event.pull_request.body }} | |
| run: | | |
| set -euo pipefail | |
| status=0 | |
| if ! printf '%s' "$PR_TITLE" | ci_scripts/check_no_ai_attribution.sh -; then | |
| echo "::error::The PR title attributes work to an AI tool; see the message above." | |
| status=1 | |
| fi | |
| if ! printf '%s' "$PR_BODY" | ci_scripts/check_no_ai_attribution.sh -; then | |
| echo "::error::The PR description attributes work to an AI tool; see the message above." | |
| status=1 | |
| fi | |
| exit $status | |
| check_patches: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| - uses: actions/setup-python@v7 | |
| with: | |
| python-version: '3' | |
| - name: Validate Upstream-Status in added/modified patches | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| # The checkout is the PR merged into its base: diffing the base commit | |
| # against it lists exactly what the PR changes, with no history needed. | |
| run: | | |
| git fetch --quiet --depth=1 origin "$BASE_SHA" | |
| python ci_scripts/check_patch.py "$BASE_SHA" HEAD | |
| check_packages_yaml: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 1 | |
| - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 | |
| with: | |
| enable-cache: false | |
| - name: Validate changed docs/packages/*.yaml and their build workflows | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| run: | | |
| set -euo pipefail | |
| # The checkout is the PR merged into its base: diffing the base commit | |
| # against it lists exactly what the PR changes, with no history needed. | |
| git fetch --quiet --depth=1 origin "$BASE_SHA" | |
| ret=0 | |
| for path in $(git diff --name-only --diff-filter=ACMR "$BASE_SHA" HEAD -- 'docs/packages/*.yaml'); do | |
| uv run --quiet ci_scripts/pending_versions.py --check "$(basename "$path" .yaml)" || ret=1 | |
| done | |
| for path in $(git diff --name-only --diff-filter=ACMR "$BASE_SHA" HEAD -- '.github/workflows/build-*.yml' '.github/workflows/test-*.yml'); do | |
| package=$(sed -En 's/^[[:space:]]+package:[[:space:]]*([^ #]+).*/\1/p' "$path" | head -n1) | |
| if [[ -z "$package" ]]; then | |
| echo "::error file=$path::the setup job must call _setup.yml with a package: input" | |
| ret=1 | |
| elif [[ ! -f "docs/packages/$package.yaml" ]]; then | |
| echo "::error file=$path::docs/packages/$package.yaml does not exist; add it with the versions to build" | |
| ret=1 | |
| fi | |
| done | |
| exit $ret |