30 lines
873 B
YAML
30 lines
873 B
YAML
name: quant-os-ci
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
|
|
jobs:
|
|
deterministic-local:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Validate deterministic Quant OS
|
|
run: bash scripts/validate_all.sh
|
|
- name: Reject generated bundle drift
|
|
run: git diff --exit-code -- dist status/status-data.js
|
|
- name: Reject tracked credential paths
|
|
shell: bash
|
|
run: |
|
|
if git ls-files \
|
|
| grep -E '(^|/)(\.env(\.[^/]+)?|secrets|credentials|userdata_mini)(/|$)' \
|
|
| grep -Ev '(^|/)\.env\.example$'; then
|
|
echo "credential-like tracked path detected"
|
|
exit 1
|
|
fi
|
|
- name: Reject credential-like tracked content
|
|
run: python3 tools/check_tracked_secrets.py
|