3. Shizu Store Audit #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 3. Shizu Store Audit | |
| # The store ignores a manifest it cannot validate and silently falls back to | |
| # default GitHub data, so nothing reports a broken listing. This job is the | |
| # only thing that catches rot originating outside the repository. | |
| on: | |
| schedule: | |
| - cron: "0 6 * * 1" # Mondays 06:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| issues: write | |
| concurrency: | |
| group: shizu-store-audit | |
| cancel-in-progress: false | |
| jobs: | |
| audit: | |
| runs-on: ubuntu-latest | |
| # The network tier issues ~16 curls at --max-time 25/40. A hung chain would | |
| # otherwise sit on the 6-hour default before anyone noticed. | |
| timeout-minutes: 15 | |
| steps: | |
| # fetch-depth: 0, matching pr-ci.yml's shizu-manifest job. The checker | |
| # derives the expected version from origin/production, and the default | |
| # shallow checkout does not create that remote-tracking ref. The script | |
| # has a `git fetch --depth=1 origin production` fallback, but taking it | |
| # every Monday means a transient fetch failure files a spurious | |
| # shizu-store-audit tracking issue — and an alarm that cries wolf is the | |
| # exact failure this audit exists to prevent. | |
| # | |
| # persist-credentials: false because this job holds `issues: write` and | |
| # then runs pipx, a downloaded schema validator and ~16 network calls. | |
| # The `gh` steps below authenticate through GH_TOKEN, not through the git | |
| # config, and the script's `git fetch --depth=1 origin production` needs | |
| # no credential on a public repo — so nothing here loses anything, and a | |
| # write-scoped token stops sitting in .git/config for the whole run. | |
| - name: Checkout code | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Install check-jsonschema | |
| run: pipx install check-jsonschema | |
| # The label has to exist before `gh issue create --label` will accept it, | |
| # and a failure here would land at exactly the moment it matters most. | |
| - name: Ensure the tracking label exists | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| gh label create shizu-store-audit \ | |
| --description "Automated Shizu CoreFetch listing audit" \ | |
| --color B60205 2>/dev/null || true | |
| - name: Run the audit | |
| id: audit | |
| run: | | |
| set +e | |
| .github/scripts/check-shizu-manifest.sh --network 2>&1 | tee audit.log | |
| echo "status=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT" | |
| - name: Open or update the tracking issue | |
| if: steps.audit.outputs.status != '0' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| run: | | |
| { | |
| echo "The weekly Shizu CoreFetch audit failed." | |
| echo | |
| echo "A manifest the store rejects is ignored silently — the listing" | |
| echo "falls back to bare GitHub data and loses its banner, screenshots," | |
| echo "translations and comment thread. Nothing else reports this." | |
| echo | |
| echo "Run: $RUN_URL" | |
| echo | |
| echo '```' | |
| if [ "$(wc -c < audit.log)" -gt 50000 ]; then | |
| # head -c cuts at a byte offset, which can land mid-codepoint — | |
| # the log carries Arabic, Devanagari and Chinese from compare_text | |
| # diffs. iconv -c drops the resulting partial sequence so the | |
| # issue body stays valid UTF-8. | |
| # | |
| # `|| true` is load-bearing: iconv exits 1 on an incomplete | |
| # trailing sequence, which is the exact case this pipe exists to | |
| # handle. Actions runs `run:` under bash -e, so without it the | |
| # step would abort mid-redirect — losing the closing fence and | |
| # the truncation notice, and never filing the issue at all. | |
| head -c 50000 audit.log | iconv -c -f utf-8 -t utf-8 2>/dev/null || true | |
| echo | |
| echo "(truncated — see the full log in the Actions run above)" | |
| else | |
| cat audit.log | |
| fi | |
| echo '```' | |
| } > issue-body.md | |
| existing="$(gh issue list --label shizu-store-audit --state open \ | |
| --limit 1 --json number -q '.[0].number')" | |
| if [ -n "$existing" ]; then | |
| gh issue comment "$existing" --body-file issue-body.md | |
| else | |
| gh issue create \ | |
| --title "Shizu store listing audit failed" \ | |
| --label shizu-store-audit \ | |
| --body-file issue-body.md | |
| fi | |
| - name: Close the tracking issue | |
| if: steps.audit.outputs.status == '0' | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| run: | | |
| existing="$(gh issue list --label shizu-store-audit --state open \ | |
| --limit 1 --json number -q '.[0].number')" | |
| if [ -n "$existing" ]; then | |
| gh issue close "$existing" --comment "Audit passed. Run: $RUN_URL" | |
| fi | |
| # Covers exit 1 (findings) and exit 2 (missing tooling) — either way | |
| # the run must be red so the Actions history is truthful. | |
| - name: Fail the run if the audit failed | |
| if: steps.audit.outputs.status != '0' | |
| run: exit 1 |