3. Shizu Store Audit #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 3. Shizu Store Audit | |
| # The store ignores a manifest it cannot validate and silently falls back to | |
| # default GitHub data, so nothing reports a broken listing. This job is the | |
| # only thing that catches rot originating outside the repository. | |
| on: | |
| schedule: | |
| - cron: "0 6 * * 1" # Mondays 06:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| issues: write | |
| concurrency: | |
| group: shizu-store-audit | |
| cancel-in-progress: false | |
| jobs: | |
| audit: | |
| runs-on: ubuntu-latest | |
| # The network tier issues ~16 curls at --max-time 25/40. A hung chain would | |
| # otherwise sit on the 6-hour default before anyone noticed. | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| - name: Install check-jsonschema | |
| run: pipx install check-jsonschema | |
| # The label has to exist before `gh issue create --label` will accept it, | |
| # and a failure here would land at exactly the moment it matters most. | |
| - name: Ensure the tracking label exists | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh label create shizu-store-audit \ | |
| --description "Automated Shizu CoreFetch listing audit" \ | |
| --color B60205 2>/dev/null || true | |
| - name: Run the audit | |
| id: audit | |
| run: | | |
| set +e | |
| .github/scripts/check-shizu-manifest.sh --network 2>&1 | tee audit.log | |
| echo "status=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT" | |
| - name: Open or update the tracking issue | |
| if: steps.audit.outputs.status != '0' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| run: | | |
| { | |
| echo "The weekly Shizu CoreFetch audit failed." | |
| echo | |
| echo "A manifest the store rejects is ignored silently — the listing" | |
| echo "falls back to bare GitHub data and loses its banner, screenshots," | |
| echo "translations and comment thread. Nothing else reports this." | |
| echo | |
| echo "Run: $RUN_URL" | |
| echo | |
| echo '```' | |
| if [ "$(wc -c < audit.log)" -gt 50000 ]; then | |
| # head -c cuts at a byte offset, which can land mid-codepoint — | |
| # the log carries Arabic, Devanagari and Chinese from compare_text | |
| # diffs. iconv -c drops the resulting partial sequence so the | |
| # issue body stays valid UTF-8. | |
| # | |
| # `|| true` is load-bearing: iconv exits 1 on an incomplete | |
| # trailing sequence, which is the exact case this pipe exists to | |
| # handle. Actions runs `run:` under bash -e, so without it the | |
| # step would abort mid-redirect — losing the closing fence and | |
| # the truncation notice, and never filing the issue at all. | |
| head -c 50000 audit.log | iconv -c -f utf-8 -t utf-8 2>/dev/null || true | |
| echo | |
| echo "(truncated — see the full log in the Actions run above)" | |
| else | |
| cat audit.log | |
| fi | |
| echo '```' | |
| } > issue-body.md | |
| existing="$(gh issue list --label shizu-store-audit --state open \ | |
| --limit 1 --json number -q '.[0].number')" | |
| if [ -n "$existing" ]; then | |
| gh issue comment "$existing" --body-file issue-body.md | |
| else | |
| gh issue create \ | |
| --title "Shizu store listing audit failed" \ | |
| --label shizu-store-audit \ | |
| --body-file issue-body.md | |
| fi | |
| - name: Close the tracking issue | |
| if: steps.audit.outputs.status == '0' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| run: | | |
| existing="$(gh issue list --label shizu-store-audit --state open \ | |
| --limit 1 --json number -q '.[0].number')" | |
| if [ -n "$existing" ]; then | |
| gh issue close "$existing" --comment "Audit passed. Run: $RUN_URL" | |
| fi | |
| # Covers exit 1 (findings) and exit 2 (missing tooling) — either way | |
| # the run must be red so the Actions history is truthful. | |
| - name: Fail the run if the audit failed | |
| if: steps.audit.outputs.status != '0' | |
| run: exit 1 |