verify-onboarding.yml

# Lives in the Redline source repo. Re-verifies every onboarded repo on a schedule and
# opens one tracking issue when any of them has drifted — a ruleset edited by hand, a
# renamed caller job, push protection switched off, artifacts left stale by an ignored
# sync pull request.
#
# Drift is silent by nature: a repository whose gate stopped publishing looks exactly
# like one whose gate is green and quiet. This loop is what makes the difference visible
# without anyone going to look.
#
# Targets come from registry.json — the same derived register sync uses. A check that
# genuinely needs a working tree reports `??` rather than passing, so a repository is
# never reported healthy on the strength of a check that did not run.
name: Redline Verify Onboarding

on:
  schedule:
    - cron: '0 6 * * 2'
  workflow_dispatch:
    inputs:
      only:
        description: Verify a single repo, as owner/name
        type: string
        required: false

permissions:
  contents: read
  issues: write

concurrency:
  group: redline-verify-onboarding
  cancel-in-progress: false

jobs:
  verify:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22

      - name: Install
        run: npm ci

      - name: Build CLI
        run: npm run build

      - name: Verify every registered repository
        id: verify
        env:
          GH_TOKEN: ${{ secrets.REDLINE_ORG_READ_TOKEN }}
          ONLY: ${{ inputs.only }}
        run: |
          set -uo pipefail
          if [ ! -f registry.json ]; then
            echo "::error::registry.json is missing — the register has not been derived yet."
            exit 1
          fi

          if [ -n "$ONLY" ]; then
            repos="$ONLY"
          else
            # String concatenation rather than a template literal: `${...}` inside
            # single quotes is ambiguous to a reader and to shellcheck, which
            # cannot know the braces are JavaScript's. Avoiding the construct
            # beats suppressing the warning about it.
            repos=$(node -e 'const r=require("./registry.json");for(const e of r.entries)if(e.host==="github")console.log(e.org+"/"+e.repo)')
          fi

          : > drift.txt
          # `set -e` is deliberately NOT on for this loop: a drifted repository
          # exits non-zero by design, and aborting on the first one would leave
          # the rest of the estate unverified every week.
          while read -r repo; do
            [ -z "$repo" ] && continue
            echo "--- $repo"
            if ! node dist/bin/redline.js verify --repo "$repo" 2>&1 | tee /tmp/out.txt; then
              {
                echo "### $repo"
                echo '```'
                grep -E '^(FAIL|  \?\?)' /tmp/out.txt || cat /tmp/out.txt
                echo '```'
              } >> drift.txt
            fi
          done <<< "$repos"

          if [ -s drift.txt ]; then
            echo "drift=true" >> "$GITHUB_OUTPUT"
          else
            echo "drift=false" >> "$GITHUB_OUTPUT"
          fi

      - name: Open or update the drift issue
        if: steps.verify.outputs.drift == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
          TITLE: 'Redline: onboarded repositories have drifted'
        run: |
          set -euo pipefail
          # One issue, updated in place. A new issue per run turns a standing
          # problem into a backlog nobody reads.
          body=$(cat drift.txt)
          existing=$(gh issue list --state open --search "$TITLE in:title" --json number --jq '.[0].number // empty')
          if [ -n "$existing" ]; then
            gh issue comment "$existing" --body "$body"
          else
            gh issue create --title "$TITLE" --body "$body"
          fi

      - name: Summarise
        if: always()
        run: |
          if [ -s drift.txt ]; then cat drift.txt >> "$GITHUB_STEP_SUMMARY";
          else echo "No drift detected." >> "$GITHUB_STEP_SUMMARY"; fi