se-constitution/.github/workflows/sync-upstream.yml at main · structural-explainability/se-constitution · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
# ============================================================
# .github/workflows/sync-upstream.yml (Sync Upstream Contract)
# ============================================================
# Updated: 2026-05-02 se-constitution REPO SPECIFIC Execution

name: Sync Upstream Contract

on:
  schedule:
    - cron: '0 7 * * 1'   # weekly, Monday 07:00 UTC (1 hour after se-formal-contract sync)
  workflow_dispatch:        # manual trigger anytime

env:
  PYTHONUNBUFFERED: "1"    # WHY: Real-time log output in CI.
  PYTHONIOENCODING: "utf-8" # WHY: Consistent encoding across platforms.
  PYTHON_VERSION: "3.15"

jobs:
  sync:
    name: Sync upstream contract references and update lockfile
    runs-on: ubuntu-latest
    timeout-minutes: 30     # WHY: Fail fast if a step hangs unexpectedly.
    permissions:
      contents: write  # WHY: This job needs to commit changes back to the repo if syncing updates files.

    steps:
      # ============================================================
      # A) ASSEMBLE: Checkout code and set up environment
      # ============================================================

      - name: A1) Checkout repository code
        uses: actions/checkout@v6
        # WHY: Required so all subsequent steps can access repo files.

      - name: A2) Install uv (with caching)
        uses: astral-sh/setup-uv@v7
        with:
          enable-cache: true
          # WHY: Cache the uv tool itself for faster subsequent runs.
          cache-dependency-glob: "uv.lock"
          # WHY: Invalidate cache only when locked dependencies change.

      - name: A3) Install Python ${{ env.PYTHON_VERSION }}
        run: uv python install ${{ env.PYTHON_VERSION }}
        # WHY: Ensures the pinned Python version is available in CI.
        # OBS: Does not modify the repo; uv manages the interpreter locally.

      # ============================================================
      # B) BASIC SYNC: Update reference/upstream/ and reference/upstream.lock
      # ============================================================

      - name: B1) Sync upstream folders (.sh)
        run: bash .github/scripts/sync_upstream.sh

      - name: B2) Compute folder hashes and update lockfile (.py)
        run: uv run python .github/scripts/update_lockfile.py

      - name: B3) Commit if changed
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add upstream/ upstream/upstream.lock
          git diff --cached --quiet && echo "No changes to sync." || (
            git commit -m "chore: sync se-formal-contract contract refs [skip ci]"
            git push
          )