Repository navigation
ci(badges): draw the README status badges in one design #3393
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
Merged
Changes from all commits
Commits
Show all changes
8 commits
Select commit
Hold shift + click to select a range
cd2911f
ci(badges): draw the README status badges in one design
lusoris 3b3a567
fix(ci): fetch over an https-only opener and hash blobs with git
lusoris 0bc84f4
fix(ci): close the badge review findings on run choice, time and scope
lusoris 457532b
chore: merge master into the fix branch
lusoris 42f91a4
docs(ci): document the badge code and link the badges branch follow-up
lusoris f796981
fix(ci): stop a broken answer escaping the badge refresh
lusoris 470bfaa
fix(ci): commit a recovered badge's new read time
lusoris 409bfd7
docs(ci): name the never-read badge case in the publish rule
lusoris File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| --- | ||
| paths: | ||
| - .github/workflows/readme-badges.yml | ||
| invariant: Render job on master only; both checkouts at github.sha; publish job contents: write only; no workflow_run trigger. | ||
| --- | ||
| # README badges workflow (ADR-3519) | ||
|
|
||
| `.github/workflows/readme-badges.yml` renders + publishes README status | ||
| badges onto `badges` branch. Script rules, design check, carry: | ||
| [scripts/ci/AGENTS.d/readme-badges.md](../../scripts/ci/AGENTS.d/readme-badges.md). | ||
| Human guide: `docs/development/readme-badges.md`. | ||
|
|
||
| - Guard: render job `if:` = policy repository + `https://github.com` + | ||
| `github.ref == 'refs/heads/master'`. Publish job `needs: render`, so | ||
| skipped render skips publish. Manual run on other branch -> nothing runs; | ||
| publish token never meets branch copy of workflow. Names come from | ||
| `.github/repository-security-policy.json`; `test_readme_badges.py` keeps | ||
| them equal. | ||
| - Checkout: both jobs `ref: ${{ github.sha }}`, `persist-credentials: false`. | ||
| Never `ref: master`: master push between jobs hands publisher other code | ||
| than renderer ran. | ||
| - Rights: top level `permissions: {}`; render job `actions: read` + | ||
| `contents: read`; publish job `contents: write` only. No other write scope. | ||
| - Trigger: `schedule` (minutes 7, 22, 37, 52) + `workflow_dispatch`. No | ||
| `workflow_run` (zizmor dangerous trigger; fork branch named `master` | ||
| matches `branches` filter). | ||
| - Ref: publish writes `refs/heads/badges` only, `force: false`; | ||
| GitHub-signed commit required. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,122 @@ | ||
| name: README Badges | ||
|
|
||
| # Render the README status badges in one style (docs/development/readme-badges.md). | ||
| # scripts/ci/readme_badges.py reads the latest decisive push run of every badged | ||
| # workflow on master plus the OpenSSF Scorecard, OpenSSF Best Practices and | ||
| # Codacy public APIs; tools/badges/render.mjs draws the SVGs with the pinned | ||
| # shields.io renderer; the publish job commits them to the badges branch the | ||
| # README links. A source that fails keeps its last value for six hours, then | ||
| # reads "stale", and this run turns red so the failure is seen. | ||
|
|
||
| on: | ||
| # Every 15 minutes: a badge lags a master run by at most that. A | ||
| # workflow_run trigger would be faster, but zizmor rates it a dangerous | ||
| # trigger, and its branch filter would also match a fork's branch named | ||
| # master. | ||
| schedule: | ||
| - cron: "7,22,37,52 * * * *" | ||
| workflow_dispatch: | ||
|
sourcery-ai[bot] marked this conversation as resolved.
Resolved
|
||
|
|
||
| permissions: {} | ||
|
|
||
| concurrency: | ||
| group: readme-badges | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| render: | ||
| name: Read the sources and render | ||
| # github.com only: the job reads and the publish job writes through the | ||
| # GitHub API, which a mirror's token cannot reach (as in supply-chain.yml). | ||
| # Default branch only: a manual run picked on another branch runs nothing, | ||
| # so the publish token never meets a branch's own copy of this file. | ||
| # .github/repository-security-policy.json holds both names; a test keeps | ||
| # these in step with it. | ||
| if: >- | ||
| github.repository == 'VMAFx/vmafx' | ||
| && github.server_url == 'https://github.com' | ||
| && github.ref == 'refs/heads/master' | ||
| runs-on: ubuntu-26.04 | ||
| timeout-minutes: 10 | ||
| permissions: | ||
| actions: read | ||
| contents: read | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| # The commit this run started from, in both jobs: a master push | ||
| # between them cannot hand the publisher other code than the | ||
| # renderer ran. | ||
| ref: ${{ github.sha }} | ||
| persist-credentials: false | ||
| - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 | ||
| with: | ||
| python-version: "3.14.10" | ||
| - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 | ||
| with: | ||
| node-version: "26.12.1" | ||
| - name: Install the pinned badge renderer | ||
| working-directory: tools/badges | ||
| run: npm ci --ignore-scripts --no-audit --no-fund | ||
| - name: Read the badge sources | ||
| env: | ||
| GITHUB_TOKEN: ${{ github.token }} | ||
| run: >- | ||
| python3 scripts/ci/readme_badges.py spec | ||
| --spec build/badges-spec.json --state build/badges/state.json | ||
| - name: Render the SVGs | ||
| run: node tools/badges/render.mjs build/badges-spec.json build/badges | ||
| - if: ${{ env.GITEA_ACTIONS != 'true' }} | ||
| uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 | ||
| with: | ||
| name: readme-badges | ||
| path: build/badges/ | ||
| retention-days: 1 | ||
| if-no-files-found: error | ||
| - name: Upload artifact (Gitea) | ||
| if: ${{ env.GITEA_ACTIONS == 'true' }} | ||
| uses: actions/upload-artifact@c6a366c94c3e0affe28c06c8df20a878f24da3cf # v3.2.2 | ||
| with: | ||
| name: readme-badges | ||
| path: build/badges/ | ||
| retention-days: 1 | ||
| if-no-files-found: error | ||
|
|
||
| publish: | ||
| name: Publish to the badges branch | ||
| needs: render | ||
| runs-on: ubuntu-26.04 | ||
| timeout-minutes: 5 | ||
| # contents: write is the narrowest token right that can create a commit; | ||
| # the job writes refs/heads/badges only, and the master ruleset refuses | ||
| # this token on master. | ||
| permissions: | ||
| contents: write | ||
|
sourcery-ai[bot] marked this conversation as resolved.
Resolved
|
||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | ||
| with: | ||
| # The commit this run started from, in both jobs: a master push | ||
| # between them cannot hand the publisher other code than the | ||
| # renderer ran. | ||
| ref: ${{ github.sha }} | ||
| persist-credentials: false | ||
| - if: ${{ env.GITEA_ACTIONS != 'true' }} | ||
| uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 | ||
| with: | ||
| name: readme-badges | ||
| path: build/badges | ||
| - name: Download artifact (Gitea) | ||
| if: ${{ env.GITEA_ACTIONS == 'true' }} | ||
| uses: actions/download-artifact@a9bc5e6ef2cb54c177f32aa5726adaa15e7e2d59 # v3.1.0 | ||
| with: | ||
| name: readme-badges | ||
| path: build/badges | ||
| - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0 | ||
| with: | ||
| python-version: "3.14.10" | ||
| - name: Commit the badges | ||
| env: | ||
| GITHUB_TOKEN: ${{ github.token }} | ||
| run: python3 scripts/ci/readme_badges.py publish --dir build/badges | ||
| - name: Fail the run when a source failed | ||
| run: python3 scripts/ci/readme_badges.py verdict --state build/badges/state.json | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| - **Every README badge but the Praetor-managed governance badge now has the same `for-the-badge` design, and the status badges come from this project's own render.** | ||
| `.github/workflows/readme-badges.yml` draws the seven workflow badges and the OpenSSF Scorecard, | ||
| OpenSSF Best Practices and Codacy badges every 15 minutes onto the `badges` branch: a workflow badge | ||
| shows the newest finished master push run, so a run in progress never hides a red one, and the | ||
| Scorecard badge now shows the score. See `docs/development/readme-badges.md` (ADR-3519). |
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.