Skip to content

3. Shizu Store Audit #7

3. Shizu Store Audit

3. Shizu Store Audit #7

name: 3. Shizu Store Audit
# The store ignores a manifest it cannot validate and silently falls back to
# default GitHub data, so nothing reports a broken listing. This job is the
# only thing that catches rot originating outside the repository.
on:
schedule:
- cron: "0 6 * * 1" # Mondays 06:00 UTC
workflow_dispatch:
permissions:
contents: read
issues: write
concurrency:
group: shizu-store-audit
cancel-in-progress: false
jobs:
audit:
runs-on: ubuntu-latest
# The network tier issues ~16 curls at --max-time 25/40. A hung chain would
# otherwise sit on the 6-hour default before anyone noticed.
timeout-minutes: 15
steps:
# fetch-depth: 0, matching pr-ci.yml's shizu-manifest job. The checker
# derives the expected version from origin/production, and the default
# shallow checkout does not create that remote-tracking ref. The script
# has a `git fetch --depth=1 origin production` fallback, but taking it
# every Monday means a transient fetch failure files a spurious
# shizu-store-audit tracking issue — and an alarm that cries wolf is the
# exact failure this audit exists to prevent.
#
# persist-credentials: false because this job holds `issues: write` and
# then runs pipx, a downloaded schema validator and ~16 network calls.
# The `gh` steps below authenticate through GH_TOKEN, not through the git
# config, and the script's `git fetch --depth=1 origin production` needs
# no credential on a public repo — so nothing here loses anything, and a
# write-scoped token stops sitting in .git/config for the whole run.
- name: Checkout code
uses: actions/checkout@v7
with:
fetch-depth: 0
persist-credentials: false
- name: Install check-jsonschema
run: pipx install check-jsonschema
# The label has to exist before `gh issue create --label` will accept it,
# and a failure here would land at exactly the moment it matters most.
- name: Ensure the tracking label exists
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh label create shizu-store-audit \
--description "Automated Shizu CoreFetch listing audit" \
--color B60205 2>/dev/null || true
- name: Run the audit
id: audit
run: |
set +e
.github/scripts/check-shizu-manifest.sh --network 2>&1 | tee audit.log
echo "status=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
- name: Open or update the tracking issue
if: steps.audit.outputs.status != '0'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
run: |
{
echo "The weekly Shizu CoreFetch audit failed."
echo
echo "A manifest the store rejects is ignored silently — the listing"
echo "falls back to bare GitHub data and loses its banner, screenshots,"
echo "translations and comment thread. Nothing else reports this."
echo
echo "Run: $RUN_URL"
echo
echo '```'
if [ "$(wc -c < audit.log)" -gt 50000 ]; then
# head -c cuts at a byte offset, which can land mid-codepoint —
# the log carries Arabic, Devanagari and Chinese from compare_text
# diffs. iconv -c drops the resulting partial sequence so the
# issue body stays valid UTF-8.
#
# `|| true` is load-bearing: iconv exits 1 on an incomplete
# trailing sequence, which is the exact case this pipe exists to
# handle. Actions runs `run:` under bash -e, so without it the
# step would abort mid-redirect — losing the closing fence and
# the truncation notice, and never filing the issue at all.
head -c 50000 audit.log | iconv -c -f utf-8 -t utf-8 2>/dev/null || true
echo
echo "(truncated — see the full log in the Actions run above)"
else
cat audit.log
fi
echo '```'
} > issue-body.md
existing="$(gh issue list --label shizu-store-audit --state open \
--limit 1 --json number -q '.[0].number')"
if [ -n "$existing" ]; then
gh issue comment "$existing" --body-file issue-body.md
else
gh issue create \
--title "Shizu store listing audit failed" \
--label shizu-store-audit \
--body-file issue-body.md
fi
- name: Close the tracking issue
if: steps.audit.outputs.status == '0'
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
run: |
existing="$(gh issue list --label shizu-store-audit --state open \
--limit 1 --json number -q '.[0].number')"
if [ -n "$existing" ]; then
gh issue close "$existing" --comment "Audit passed. Run: $RUN_URL"
fi
# Covers exit 1 (findings) and exit 2 (missing tooling) — either way
# the run must be red so the Actions history is truthful.
- name: Fail the run if the audit failed
if: steps.audit.outputs.status != '0'
run: exit 1