TEST: do not merge — proving the libs/ guard fires #160
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Check toolchain | |
| # Fails a pull request that drifts off the standard plugin toolchain | |
| # (ADFA-4907). The standard itself lives in scripts/check-toolchain.sh — it is | |
| # deliberately not restated here, so there is only one copy of the numbers. | |
| # | |
| # This is the only workflow here that runs automatically on pull requests. | |
| # "Build plugin artifacts" and "Update libs from CodeOnTheGo" are both | |
| # workflow_dispatch-only, which is why toolchain drift previously reached | |
| # main with no CI signal at all. | |
| # | |
| # It is pure text inspection — no JDK, no Gradle, no network — so it costs a | |
| # few seconds and is safe to make a required check. | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| # the libs/ guard below reads the pull request's changed file list | |
| pull-requests: read | |
| jobs: | |
| check-toolchain: | |
| name: Toolchain versions | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| # libs/ holds build outputs, not source. Only the "Update libs from | |
| # CodeOnTheGo" workflow may change them. It builds the jars on JDK 17, | |
| # which is the JDK every runner here uses, so what it commits always | |
| # loads. A laptop on JDK 21 emits class file version 65 instead, and a | |
| # JDK 17 runner reads only up to 61 -- that is what broke "Publish | |
| # addons" after #87 shipped hand-built jars. That workflow pushes | |
| # straight to main with an admin PAT and bypasses the main ruleset, so | |
| # this check never sees it. | |
| - name: Refuse hand-built libs/ jars | |
| if: github.event_name == 'pull_request' | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| PR: ${{ github.event.pull_request.number }} | |
| run: | | |
| set -euo pipefail | |
| changed="$(gh api --paginate \ | |
| "repos/${GITHUB_REPOSITORY}/pulls/${PR}/files" \ | |
| -q '.[].filename' | grep '^libs/' || true)" | |
| if [ -n "$changed" ]; then | |
| printf '%s\n' "$changed" | |
| echo "::error::A pull request must not change libs/. Run the 'Update libs from CodeOnTheGo' workflow instead -- it builds the jars on the JDK the runners use." | |
| exit 1 | |
| fi | |
| - name: Check toolchain versions | |
| run: ./scripts/check-toolchain.sh | |
| - name: Report declared versions | |
| # Runs even when the check above fails, so the run summary shows what | |
| # every module actually declares next to the failure list. | |
| if: always() | |
| run: | | |
| { | |
| echo '### Declared toolchain versions' | |
| echo | |
| echo '```' | |
| ./scripts/check-toolchain.sh --list | |
| echo '```' | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| - name: Install uv | |
| uses: astral-sh/setup-uv@v5 | |
| - name: Test the addons tool | |
| run: uv run --directory tools/addons pytest -q | |
| - name: Check addon names and metadata | |
| run: uv run --directory tools/addons addons --root "$GITHUB_WORKSPACE" check |