From 5c76ab4a64166f07e9c7383c7444884f22c713d5 Mon Sep 17 00:00:00 2001 From: Fabio Date: Mon, 6 Jul 2026 09:52:38 -0400 Subject: [PATCH] CI: run the full gate on every push make build + make validate on GitHub Actions, plus a determinism check: the committed tree must be byte-identical to the build output, or the push fails. The mirror now guards itself. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/check.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/workflows/check.yml diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml new file mode 100644 index 0000000000..b7b148b39f --- /dev/null +++ b/.github/workflows/check.yml @@ -0,0 +1,26 @@ +name: check + +on: + push: + pull_request: + +jobs: + check: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-python@v5 + with: + python-version: "3.12" + # Standard library only — no dependencies to install. + - name: Build (deterministic regeneration) + run: make build + - name: Verify the build changed nothing + run: | + if ! git diff --quiet; then + echo "::error::make build produced a diff — committed tree is not the deterministic build output" + git diff --stat + exit 1 + fi + - name: Validate (OKF + schema + link integrity) + run: make validate