Skip to content

ci: require no-mistakes pipeline step attestation #2710

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
kunchenguid merged 1 commit into from
Aug 21, 2026
Merged

ci: require no-mistakes pipeline step attestation #2710

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
69 changes: 69 additions & 0 deletions .github/workflows/no-mistakes-required.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,75 @@ jobs:
marker='Updates from [git push no-mistakes](https://github.com/kunchenguid/no-mistakes)'
if printf '%s' "${PR_BODY:-}" | grep -qF -- "$marker"; then
echo "Found no-mistakes signature in PR #${PR_NUMBER} body."
if ! command -v jq >/dev/null 2>&1; then
echo "::error::This check requires jq to parse no-mistakes pipeline step attestation, but jq was not found on the runner." >&2
exit 1
fi
prefix='<!-- no-mistakes-pipeline-attestation:v1 '
suffix=' -->'
body="${PR_BODY:-}"
json=''
parse_ok=0
case "$body" in
*"$prefix"*)
rest="${body#*"$prefix"}"
case "$rest" in
*"$suffix"*)
json="${rest%%"$suffix"*}"
if printf '%s' "$json" | jq -e . >/dev/null 2>&1; then
parse_ok=1
fi
;;
esac
;;
esac
if [ "$parse_ok" -ne 1 ]; then
{
echo "::error::This repository requires no-mistakes >= 1.46.0; structured pipeline step attestation is missing or unparseable."
echo
echo "The no-mistakes signature was found, but this check also requires one"
echo "HTML comment in the PR body:"
echo
echo ' <!-- no-mistakes-pipeline-attestation:v1 {"head_sha":"...","steps":[...]} -->'
echo
echo "That comment is emitted by no-mistakes >= 1.46.0 (the release that started"
echo "emitting structured step attestation; see https://github.com/kunchenguid/no-mistakes/pull/670)."
echo "An older no-mistakes that writes only the signature line is not enough."
echo
echo "Re-run the pipeline with 'git push no-mistakes' using no-mistakes >= 1.46.0."
echo "See CONTRIBUTING.md for setup and the full workflow."
echo
echo "PR author: ${PR_AUTHOR}"
} >&2
exit 1
fi
incomplete=''
for required in review test document; do
status=$(printf '%s' "$json" | jq -r --arg step "$required" \
'([(.steps | arrays | .[]) | select(.step == $step) | .status] | first // empty | select(. != "")) // "missing"')
if [ "$status" != "completed" ]; then
if [ -n "$incomplete" ]; then
incomplete="${incomplete}, "
fi
incomplete="${incomplete}${required}=${status}"
fi
done
if [ -n "$incomplete" ]; then
{
echo "::error::Required no-mistakes pipeline steps are not completed: ${incomplete}."
echo
echo "This repository requires review, test, and document to each have status"
echo "exactly 'completed'. Quota skips and agent skips are not compliant."
echo
echo "Re-run the pipeline with 'git push no-mistakes' using no-mistakes >= 1.46.0"
echo "so those required steps complete rather than skip."
echo "See CONTRIBUTING.md for setup and the full workflow."
echo
echo "PR author: ${PR_AUTHOR}"
} >&2
exit 1
fi
echo "Pipeline step attestation is valid: review, test, and document are completed."
exit 0
fi
{
Expand Down
Loading