@svp-labs/talos 0.0.0 → 0.1.0

package/assets/workflows/talos.yml

@@ -0,0 +1,420 @@
+# Generated by Talos. Do not edit: `talos govern` writes it and the drift report checks it.
+# Talos's caller: every job but the PR gate, run as `talos job <event>` at the Talos release this
+# repository's rulesets enforce, found the way the gate finds it. It never changes between
+# releases. `analyze` runs the default branch's code and holds no secret. `act`, on every event,
+# and `scheduled`, after `analyze`, hold the reviewer's token and never check out or run the PR's
+# code: they read the diff and the files through the API, and what `analyze` found as data.
+name: talos
+
+on:
+  # `edited` beyond the gate's types: fixing a PR's body reruns talos/review.
+  pull_request_target: # zizmor: ignore[dangerous-triggers] the act job never checks out or runs the PR
+    types: [opened, synchronize, reopened, ready_for_review, edited]
+  merge_group:
+  issues:
+  issue_comment:
+  pull_request_review:
+  schedule:
+    - cron: '17 3 * * *'
+  workflow_dispatch:
+
+permissions: {}
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  analyze:
+    name: analyze
+    if: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    concurrency: # one analysis at a time, each run to its end
+      group: talos-analyze
+      cancel-in-progress: false
+    permissions:
+      contents: read # the rulesets, and the default branch's checkout
+    steps:
+      - name: Find the enforced Talos release
+        id: find
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TALOS_LOOKUP: ${{ vars.TALOS_LOOKUP }}
+        run: |
+          # bootstrap/find-pin.sh, inlined (Talos isn't checked out yet); a test keeps them equal.
+          find_pin() {
+            set -euo pipefail
+
+            repo="${GITHUB_REPOSITORY:-}"
+            talos="${TALOS_REPO:-SVP-Labs/Talos}"
+            mode="${TALOS_LOOKUP:-rulesets}"
+            sha_pattern='^[0-9a-f]{40}$'
+
+            fail() {
+              echo "find-pin: $1" >&2
+              exit 1
+            }
+
+            by_rulesets() {
+              local talos_id ids id detail shas count=0 pin=""
+              talos_id="$(gh api "repos/$talos" 2>/dev/null | jq -r '.id')" ||
+                fail "cannot read the Talos repository"
+              ids="$(gh api --paginate "repos/$repo/rulesets?includes_parents=true" 2>/dev/null |
+                jq -s -r 'add // [] | .[] | select(.enforcement != "disabled") | .id')" ||
+                fail "cannot list the repository's rulesets"
+              for id in $ids; do
+                detail="$(gh api "repos/$repo/rulesets/$id?includes_parents=true" 2>/dev/null)" ||
+                  fail "cannot read a ruleset"
+                shas="$(jq -r --argjson talos "$talos_id" '
+                  [.rules[]? | select(.type == "workflows") | .parameters.workflows[]?
+                    | select(.repository_id == $talos) | (.sha // "none")] | unique | .[]' <<<"$detail")" ||
+                  fail "cannot read a ruleset"
+                [[ -z "$shas" ]] && continue
+                count=$((count + 1))
+                [[ "$shas" == *$'\n'* ]] && fail "a ruleset pins Talos at several commits"
+                [[ "$shas" =~ $sha_pattern ]] || fail "a ruleset runs Talos at a ref, not a commit SHA"
+                pin="$shas"
+              done
+              [[ "$count" -eq 0 ]] && fail "no ruleset that applies to this repository runs the Talos gate"
+              [[ "$count" -gt 1 ]] && fail "$count Talos rulesets apply; exactly one must"
+              printf '%s\n' "$pin"
+            }
+
+            by_channels() {
+              local channel sha
+              channel="$(gh api "repos/$repo" 2>/dev/null | jq -r '.custom_properties.talos // empty')" ||
+                fail "cannot read the repository"
+              case "$channel" in
+                evaluate | canary | stable) ;;
+                *) fail "the talos property names no channel" ;;
+              esac
+              sha="$(gh api "repos/$talos/contents/channels.json?ref=channels" 2>/dev/null |
+                jq -r --arg channel "$channel" '.content | @base64d | fromjson | .[$channel] // empty')" ||
+                fail "cannot read channels.json"
+              [[ "$sha" =~ $sha_pattern ]] || fail "channels.json has no commit for the channel"
+              printf '%s\n' "$sha"
+            }
+
+            [[ -n "$repo" ]] || fail "GITHUB_REPOSITORY is not set"
+            case "$mode" in
+              rulesets) by_rulesets ;;
+              channels) by_channels ;;
+              *) fail "TALOS_LOOKUP must be rulesets or channels" ;;
+            esac
+          }
+          pin="$(find_pin)"
+          printf 'sha=%s\n' "$pin" >> "$GITHUB_OUTPUT"
+      - name: Check out Talos at the pin
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: SVP-Labs/Talos
+          ref: ${{ steps.find.outputs.sha }}
+          path: talos-kit
+          persist-credentials: false
+      - name: Check out the default branch
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.repository.default_branch }}
+          path: repo
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Set up Node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: '22'
+          package-manager-cache: false
+      - name: Find whether the default branch needs PHP
+        id: php
+        working-directory: repo
+        run: bash ../talos-kit/bootstrap/php.sh HEAD >> "$GITHUB_OUTPUT"
+      - name: Set up PHP
+        if: ${{ contains(fromJSON(steps.php.outputs.oses), 'linux') }}
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
+        with:
+          php-version: ${{ steps.php.outputs.version }}
+          coverage: pcov
+          tools: composer
+        env:
+          fail-fast: true
+          update: true # the newest patch of the cycle, which the PHP pack insists on
+      - name: Analyze
+        working-directory: repo
+        env:
+          EVENT: ${{ github.event_name }}
+        run: |
+          node ../talos-kit/bootstrap/launch.ts job "$EVENT" --phase analyze \
+            --workdir "$RUNNER_TEMP/talos-job"
+      - name: Hand the results to act
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: talos-analyze
+          path: ${{ runner.temp }}/talos-job
+          retention-days: 1
+          if-no-files-found: ignore
+
+  act:
+    name: act
+    # Strangers can comment and review on a public repository: such an event stops here, before
+    # the reviewer's key is used (`talos job` checks the same again). The logins come from the
+    # organisation's variables; one left unset admits nobody.
+    if: >-
+      ${{ github.event_name != 'schedule' && github.event_name != 'workflow_dispatch' && (
+        (github.event_name != 'issue_comment' && github.event_name != 'pull_request_review') ||
+        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'),
+          github.event.comment.author_association || github.event.review.author_association) ||
+        (github.event.comment.user.login || github.event.review.user.login) == vars.TALOS_OWNER ||
+        (github.event.comment.user.login || github.event.review.user.login) ==
+          format('{0}[bot]', vars.TALOS_THEA_APP) ||
+        (github.event.comment.user.login || github.event.review.user.login) ==
+          format('{0}[bot]', vars.TALOS_RELEASE_APP)
+      ) }}
+    # One event at a time per PR or issue, never cancelled, so two events can't review one head
+    # twice. GitHub keeps one waiting run per group and drops an older waiting one, which loses
+    # nothing: each run decides from the PR's or the issue's state as it is then. A comment, which
+    # starts no job, never waits in the group, so it can't push out a push's review.
+    concurrency:
+      group: >-
+        talos-${{ github.event_name == 'issue_comment' && github.run_id ||
+        github.event.pull_request.number || github.event.issue.number || github.run_id }}
+      cancel-in-progress: false
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    # The workflow token reads the rulesets that name the release, and reaches nothing else: the
+    # jobs an event starts work through the reviewer's token alone.
+    permissions:
+      contents: read # the repository's rulesets
+    steps:
+      - name: Find the enforced Talos release
+        id: find
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TALOS_LOOKUP: ${{ vars.TALOS_LOOKUP }}
+        run: |
+          # bootstrap/find-pin.sh, inlined (Talos isn't checked out yet); a test keeps them equal.
+          find_pin() {
+            set -euo pipefail
+
+            repo="${GITHUB_REPOSITORY:-}"
+            talos="${TALOS_REPO:-SVP-Labs/Talos}"
+            mode="${TALOS_LOOKUP:-rulesets}"
+            sha_pattern='^[0-9a-f]{40}$'
+
+            fail() {
+              echo "find-pin: $1" >&2
+              exit 1
+            }
+
+            by_rulesets() {
+              local talos_id ids id detail shas count=0 pin=""
+              talos_id="$(gh api "repos/$talos" 2>/dev/null | jq -r '.id')" ||
+                fail "cannot read the Talos repository"
+              ids="$(gh api --paginate "repos/$repo/rulesets?includes_parents=true" 2>/dev/null |
+                jq -s -r 'add // [] | .[] | select(.enforcement != "disabled") | .id')" ||
+                fail "cannot list the repository's rulesets"
+              for id in $ids; do
+                detail="$(gh api "repos/$repo/rulesets/$id?includes_parents=true" 2>/dev/null)" ||
+                  fail "cannot read a ruleset"
+                shas="$(jq -r --argjson talos "$talos_id" '
+                  [.rules[]? | select(.type == "workflows") | .parameters.workflows[]?
+                    | select(.repository_id == $talos) | (.sha // "none")] | unique | .[]' <<<"$detail")" ||
+                  fail "cannot read a ruleset"
+                [[ -z "$shas" ]] && continue
+                count=$((count + 1))
+                [[ "$shas" == *$'\n'* ]] && fail "a ruleset pins Talos at several commits"
+                [[ "$shas" =~ $sha_pattern ]] || fail "a ruleset runs Talos at a ref, not a commit SHA"
+                pin="$shas"
+              done
+              [[ "$count" -eq 0 ]] && fail "no ruleset that applies to this repository runs the Talos gate"
+              [[ "$count" -gt 1 ]] && fail "$count Talos rulesets apply; exactly one must"
+              printf '%s\n' "$pin"
+            }
+
+            by_channels() {
+              local channel sha
+              channel="$(gh api "repos/$repo" 2>/dev/null | jq -r '.custom_properties.talos // empty')" ||
+                fail "cannot read the repository"
+              case "$channel" in
+                evaluate | canary | stable) ;;
+                *) fail "the talos property names no channel" ;;
+              esac
+              sha="$(gh api "repos/$talos/contents/channels.json?ref=channels" 2>/dev/null |
+                jq -r --arg channel "$channel" '.content | @base64d | fromjson | .[$channel] // empty')" ||
+                fail "cannot read channels.json"
+              [[ "$sha" =~ $sha_pattern ]] || fail "channels.json has no commit for the channel"
+              printf '%s\n' "$sha"
+            }
+
+            [[ -n "$repo" ]] || fail "GITHUB_REPOSITORY is not set"
+            case "$mode" in
+              rulesets) by_rulesets ;;
+              channels) by_channels ;;
+              *) fail "TALOS_LOOKUP must be rulesets or channels" ;;
+            esac
+          }
+          pin="$(find_pin)"
+          printf 'sha=%s\n' "$pin" >> "$GITHUB_OUTPUT"
+      - name: Check out Talos at the pin
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: SVP-Labs/Talos
+          ref: ${{ steps.find.outputs.sha }}
+          path: talos-kit
+          persist-credentials: false
+      - name: Set up Node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: '22'
+          package-manager-cache: false
+      # Without `owner` or `repositories`, the token reaches this repository alone.
+      - name: Mint the reviewer's token for this repository
+        id: token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          app-id: ${{ vars.TALOS_REVIEWER_APP_ID }}
+          private-key: ${{ secrets.TALOS_REVIEWER_KEY }}
+          permission-contents: read
+          permission-pull-requests: write
+          permission-issues: write
+          permission-checks: write
+      - name: Act
+        env:
+          EVENT: ${{ github.event_name }}
+          TALOS_REVIEWER_TOKEN: ${{ steps.token.outputs.token }}
+          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
+          # The reviewer's model; left unset, it reaches Talos empty and Talos takes its own.
+          TALOS_REVIEW_MODEL: ${{ vars.TALOS_REVIEW_MODEL }}
+          TALOS_ORG: ${{ github.repository_owner }}
+          TALOS_OWNER: ${{ vars.TALOS_OWNER }}
+          TALOS_THEA_APP: ${{ vars.TALOS_THEA_APP }}
+          TALOS_REVIEWER_APP: ${{ vars.TALOS_REVIEWER_APP }}
+          TALOS_RELEASE_APP: ${{ vars.TALOS_RELEASE_APP }}
+          TALOS_LOOKUP: ${{ vars.TALOS_LOOKUP }}
+        run: |
+          node talos-kit/bootstrap/launch.ts job "$EVENT" --phase act --workdir "$RUNNER_TEMP/talos-job"
+
+  scheduled:
+    name: scheduled
+    needs: analyze
+    if: ${{ !cancelled() && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') }}
+    concurrency: # one sweep at a time, each run to its end
+      group: talos-scheduled
+      cancel-in-progress: false
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      actions: read # the gate's runs and its talos-verdict artifacts
+      # The stale-claim sweep deletes idle ticket branches with this token, since the reviewer App
+      # may only read contents. Nothing is checked out from this repository or pushed.
+      contents: write # deleting idle ticket branches
+    steps:
+      - name: Find the enforced Talos release
+        id: find
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TALOS_LOOKUP: ${{ vars.TALOS_LOOKUP }}
+        run: |
+          # bootstrap/find-pin.sh, inlined (Talos isn't checked out yet); a test keeps them equal.
+          find_pin() {
+            set -euo pipefail
+
+            repo="${GITHUB_REPOSITORY:-}"
+            talos="${TALOS_REPO:-SVP-Labs/Talos}"
+            mode="${TALOS_LOOKUP:-rulesets}"
+            sha_pattern='^[0-9a-f]{40}$'
+
+            fail() {
+              echo "find-pin: $1" >&2
+              exit 1
+            }
+
+            by_rulesets() {
+              local talos_id ids id detail shas count=0 pin=""
+              talos_id="$(gh api "repos/$talos" 2>/dev/null | jq -r '.id')" ||
+                fail "cannot read the Talos repository"
+              ids="$(gh api --paginate "repos/$repo/rulesets?includes_parents=true" 2>/dev/null |
+                jq -s -r 'add // [] | .[] | select(.enforcement != "disabled") | .id')" ||
+                fail "cannot list the repository's rulesets"
+              for id in $ids; do
+                detail="$(gh api "repos/$repo/rulesets/$id?includes_parents=true" 2>/dev/null)" ||
+                  fail "cannot read a ruleset"
+                shas="$(jq -r --argjson talos "$talos_id" '
+                  [.rules[]? | select(.type == "workflows") | .parameters.workflows[]?
+                    | select(.repository_id == $talos) | (.sha // "none")] | unique | .[]' <<<"$detail")" ||
+                  fail "cannot read a ruleset"
+                [[ -z "$shas" ]] && continue
+                count=$((count + 1))
+                [[ "$shas" == *$'\n'* ]] && fail "a ruleset pins Talos at several commits"
+                [[ "$shas" =~ $sha_pattern ]] || fail "a ruleset runs Talos at a ref, not a commit SHA"
+                pin="$shas"
+              done
+              [[ "$count" -eq 0 ]] && fail "no ruleset that applies to this repository runs the Talos gate"
+              [[ "$count" -gt 1 ]] && fail "$count Talos rulesets apply; exactly one must"
+              printf '%s\n' "$pin"
+            }
+
+            by_channels() {
+              local channel sha
+              channel="$(gh api "repos/$repo" 2>/dev/null | jq -r '.custom_properties.talos // empty')" ||
+                fail "cannot read the repository"
+              case "$channel" in
+                evaluate | canary | stable) ;;
+                *) fail "the talos property names no channel" ;;
+              esac
+              sha="$(gh api "repos/$talos/contents/channels.json?ref=channels" 2>/dev/null |
+                jq -r --arg channel "$channel" '.content | @base64d | fromjson | .[$channel] // empty')" ||
+                fail "cannot read channels.json"
+              [[ "$sha" =~ $sha_pattern ]] || fail "channels.json has no commit for the channel"
+              printf '%s\n' "$sha"
+            }
+
+            [[ -n "$repo" ]] || fail "GITHUB_REPOSITORY is not set"
+            case "$mode" in
+              rulesets) by_rulesets ;;
+              channels) by_channels ;;
+              *) fail "TALOS_LOOKUP must be rulesets or channels" ;;
+            esac
+          }
+          pin="$(find_pin)"
+          printf 'sha=%s\n' "$pin" >> "$GITHUB_OUTPUT"
+      - name: Check out Talos at the pin
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: SVP-Labs/Talos
+          ref: ${{ steps.find.outputs.sha }}
+          path: talos-kit
+          persist-credentials: false
+      - name: Set up Node
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: '22'
+          package-manager-cache: false
+      - name: Collect what analyze left
+        continue-on-error: true
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: talos-analyze
+          path: ${{ runner.temp }}/talos-job
+      # Without `owner` or `repositories`, the token reaches this repository alone.
+      - name: Mint the reviewer's token for this repository
+        id: token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          app-id: ${{ vars.TALOS_REVIEWER_APP_ID }}
+          private-key: ${{ secrets.TALOS_REVIEWER_KEY }}
+          permission-contents: read
+          permission-issues: write
+      - name: Act
+        env:
+          EVENT: ${{ github.event_name }}
+          GITHUB_TOKEN: ${{ github.token }}
+          TALOS_REVIEWER_TOKEN: ${{ steps.token.outputs.token }}
+          TALOS_ORG: ${{ github.repository_owner }}
+          TALOS_OWNER: ${{ vars.TALOS_OWNER }}
+          TALOS_THEA_APP: ${{ vars.TALOS_THEA_APP }}
+          TALOS_REVIEWER_APP: ${{ vars.TALOS_REVIEWER_APP }}
+          TALOS_RELEASE_APP: ${{ vars.TALOS_RELEASE_APP }}
+          TALOS_LOOKUP: ${{ vars.TALOS_LOOKUP }}
+        run: |
+          node talos-kit/bootstrap/launch.ts job "$EVENT" --phase act --workdir "$RUNNER_TEMP/talos-job"

package/bootstrap/find-pin.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# Prints the Talos commit that $GITHUB_REPOSITORY's rulesets pin, for workflows that have no
+# Talos yet: the lookup src/version/pin.ts does, in bash with gh and jq.
+#
+#   GITHUB_REPOSITORY  owner/name of the repository (set by Actions)
+#   GH_TOKEN           a token that can read its rulesets (metadata: read)
+#   TALOS_REPO         the Talos repository, SVP-Labs/Talos by default
+#   TALOS_LOOKUP       rulesets (default) or channels
+#
+# rulesets: the repository's rulesets, the organisation's included (includes_parents=true),
+# skipping disabled ones; exactly one may require a workflow from the Talos repository, matched
+# by repository id, and its pinned sha is printed.
+# channels: the repository's `talos` custom property names a channel, and channels.json on the
+# Talos repository's `channels` branch maps it to a commit.
+#
+# Prints only the SHA. On failure it prints one generic line on stderr and exits 1: messages
+# from gh name repositories, which a public log must not show.
+set -euo pipefail
+
+repo="${GITHUB_REPOSITORY:-}"
+talos="${TALOS_REPO:-SVP-Labs/Talos}"
+mode="${TALOS_LOOKUP:-rulesets}"
+sha_pattern='^[0-9a-f]{40}$'
+
+fail() {
+  echo "find-pin: $1" >&2
+  exit 1
+}
+
+by_rulesets() {
+  local talos_id ids id detail shas count=0 pin=""
+  talos_id="$(gh api "repos/$talos" 2>/dev/null | jq -r '.id')" ||
+    fail "cannot read the Talos repository"
+  ids="$(gh api --paginate "repos/$repo/rulesets?includes_parents=true" 2>/dev/null |
+    jq -s -r 'add // [] | .[] | select(.enforcement != "disabled") | .id')" ||
+    fail "cannot list the repository's rulesets"
+  for id in $ids; do
+    detail="$(gh api "repos/$repo/rulesets/$id?includes_parents=true" 2>/dev/null)" ||
+      fail "cannot read a ruleset"
+    shas="$(jq -r --argjson talos "$talos_id" '
+      [.rules[]? | select(.type == "workflows") | .parameters.workflows[]?
+        | select(.repository_id == $talos) | (.sha // "none")] | unique | .[]' <<<"$detail")" ||
+      fail "cannot read a ruleset"
+    [[ -z "$shas" ]] && continue
+    count=$((count + 1))
+    [[ "$shas" == *$'\n'* ]] && fail "a ruleset pins Talos at several commits"
+    [[ "$shas" =~ $sha_pattern ]] || fail "a ruleset runs Talos at a ref, not a commit SHA"
+    pin="$shas"
+  done
+  [[ "$count" -eq 0 ]] && fail "no ruleset that applies to this repository runs the Talos gate"
+  [[ "$count" -gt 1 ]] && fail "$count Talos rulesets apply; exactly one must"
+  printf '%s\n' "$pin"
+}
+
+by_channels() {
+  local channel sha
+  channel="$(gh api "repos/$repo" 2>/dev/null | jq -r '.custom_properties.talos // empty')" ||
+    fail "cannot read the repository"
+  case "$channel" in
+    evaluate | canary | stable) ;;
+    *) fail "the talos property names no channel" ;;
+  esac
+  sha="$(gh api "repos/$talos/contents/channels.json?ref=channels" 2>/dev/null |
+    jq -r --arg channel "$channel" '.content | @base64d | fromjson | .[$channel] // empty')" ||
+    fail "cannot read channels.json"
+  [[ "$sha" =~ $sha_pattern ]] || fail "channels.json has no commit for the channel"
+  printf '%s\n' "$sha"
+}
+
+[[ -n "$repo" ]] || fail "GITHUB_REPOSITORY is not set"
+case "$mode" in
+  rulesets) by_rulesets ;;
+  channels) by_channels ;;
+  *) fail "TALOS_LOOKUP must be rulesets or channels" ;;
+esac