Skip to content

fix(analysis): restore differential method integrations #103

fix(analysis): restore differential method integrations

fix(analysis): restore differential method integrations #103

Workflow file for this run

# SPDX-License-Identifier: MPL-2.0
# SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
#
# Fork governance lane. Two reusable lanes from hyperpolymath/standards, each
# pinned to a commit: DEED syntax for the repo deed, and the Hypatia verdict
# grid (Hypatia, panic-attack, pons asinorum and the gitbot-fleet report-backs
# under .gitbot-fleet/). This workflow is the fork's; nothing in it is
# proposed upstream, and upstream's ci.yml is untouched.
#
# The reusable renders the grid; the two jobs below post it on the pull
# request and publish the badges, because a called workflow may not request
# permissions its caller does not grant.
name: Governance (fork)
on:
push:
branches: [main]
pull_request:
workflow_dispatch:
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
deed:
name: DEED syntax
uses: hyperpolymath/standards/.github/workflows/deed-conformance.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
permissions:
contents: read
with:
require-files: true
hypatia:
name: Hypatia verdict grid
uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@01c9b0c9f2646ebea0b30a9588462642ac94aee9
permissions:
actions: read
contents: read
security-events: write
secrets:
HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}
verdict:
name: Post the verdict grid
needs: [deed, hypatia]
if: ${{ always() && github.event_name == 'pull_request' }}
runs-on: ubuntu-latest
timeout-minutes: 5
permissions:
contents: read
actions: read
pull-requests: write
steps:
- name: Download the verdict grid
continue-on-error: true
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with:
name: verdict-grid
path: verdict-grid
- name: Update the compact PR verdict
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
PR_NUMBER: ${{ github.event.pull_request.number }}
DEED_RESULT: ${{ needs.deed.result }}
HYPATIA_RESULT: ${{ needs.hypatia.result }}
HYPATIA_VERDICT: ${{ needs.hypatia.outputs.verdict }}
run: |
set -euo pipefail
# The DEED lane is a conformance row: pass is green, failure red,
# anything else (skipped, cancelled, no result) orange. The grid
# itself comes from the artifact; a missing artifact is orange.
case "$DEED_RESULT" in
success) deed='🟢 conformant' ;;
failure) deed='🔴 failing' ;;
*) deed="🟠 indeterminate ($DEED_RESULT)" ;;
esac
{
echo '<!-- fork-governance-verdict: regenerated on every run -->'
echo '# Fork governance'
echo
echo "| Lane | Status | Run |"
echo "|---|---|---|"
echo "| DEED syntax (repo deed) | $deed | [run $GITHUB_RUN_ID]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID) |"
echo "| Hypatia verdict grid | ${HYPATIA_VERDICT:-orange} (job: $HYPATIA_RESULT) | same run |"
echo
if [ -s verdict-grid/report.md ]; then
cat verdict-grid/report.md
else
echo '🟠 indeterminate · no verdict-grid artifact was produced by the Hypatia lane; see the run.'
fi
} > "$RUNNER_TEMP/body.md"
# One comment per PR, updated in place; newest run wins.
comment_id=$(gh api --paginate --slurp "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
| jq -r '[.[][] | select(.user.login == "github-actions[bot]" and (.body | contains("<!-- fork-governance-verdict:")))] | last | .id // ""')
jq -n --rawfile body "$RUNNER_TEMP/body.md" '{body: $body}' > "$RUNNER_TEMP/comment.json"
if [ -n "$comment_id" ]; then
gh api -X PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$comment_id" --input "$RUNNER_TEMP/comment.json" >/dev/null
else
gh api -X POST "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" --input "$RUNNER_TEMP/comment.json" >/dev/null
fi
echo "published the governance verdict to #$PR_NUMBER"
badges:
name: Publish badges
needs: [deed, hypatia]
if: ${{ always() && github.event_name == 'push' && github.ref == 'refs/heads/main' }}
runs-on: ubuntu-latest
timeout-minutes: 5
permissions:
contents: write
actions: read
steps:
- name: Download the verdict grid
continue-on-error: true
uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
with:
name: verdict-grid
path: verdict-grid
- name: Write the badge endpoints and push the governance-badges branch
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
DEED_RESULT: ${{ needs.deed.result }}
run: |
set -euo pipefail
# shields.io endpoint JSON, one file per lane, on an orphan branch
# that holds nothing else. README badges read them through
# img.shields.io/endpoint. A lane without a result publishes orange.
mkdir -p out
case "$DEED_RESULT" in
success) msg=conformant; colour=brightgreen ;;
failure) msg=failing; colour=red ;;
*) msg=indeterminate; colour=orange ;;
esac
jq -n --arg m "$msg" --arg c "$colour" '{schemaVersion: 1, label: "DEED syntax", message: $m, color: $c}' > out/deed.json
if [ -s verdict-grid/badge.json ]; then
cp verdict-grid/badge.json out/hypatia-grid.json
else
jq -n '{schemaVersion: 1, label: "Hypatia grid", message: "indeterminate", color: "orange"}' > out/hypatia-grid.json
fi
[ -s verdict-grid/report.json ] && cp verdict-grid/report.json out/hypatia-grid.report.json
cd out
git init -q -b governance-badges
git config user.name 'github-actions[bot]'
git config user.email '41898282+github-actions[bot]@users.noreply.github.com'
git add -A
git commit -q -m "badges: $GITHUB_SHA"
git push -q --force "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" governance-badges
echo "published badge endpoints for $GITHUB_SHA"