Batch Processor #369
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Batch Processor | |
| on: | |
| schedule: | |
| - cron: '0 */6 * * *' # Every 6 hours | |
| workflow_dispatch: | |
| inputs: | |
| batch_size: | |
| description: 'Max repos to audit per batch' | |
| required: false | |
| default: '5' | |
| dry_run: | |
| description: 'Dry run (log actions but do not label)' | |
| required: false | |
| default: 'false' | |
| permissions: | |
| contents: read | |
| issues: write | |
| actions: write | |
| concurrency: | |
| group: nlpm-batch-processor | |
| cancel-in-progress: false | |
| jobs: | |
| process: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 | |
| with: | |
| persist-credentials: false | |
| - name: Ensure pipeline labels exist | |
| # `gh issue edit --add-label` fails silently if the label doesn't | |
| # exist on the repo. The 2026-05-13 v0.8.18 deploy hit this: 48 | |
| # exemplar candidates got "WARNING: failed to label" because | |
| # case-study-clean had never been created. Each label is created | |
| # idempotently — `|| true` on the create call swallows the "label | |
| # already exists" error so this step is a no-op on subsequent runs. | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| for entry in \ | |
| "case-study-clean:0e8a16:Audit clean (score >=90, security != BLOCKED) — fires auditor-exemplar.yml" \ | |
| "exemplar-published:1d76db:Exemplar artifact written to auditor/exemplars/<slug>.md"; do | |
| name="${entry%%:*}" | |
| rest="${entry#*:}" | |
| color="${rest%%:*}" | |
| desc="${rest#*:}" | |
| gh label create "$name" --color "$color" --description "$desc" 2>/dev/null || true | |
| done | |
| - name: Batch processor | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| BATCH_SIZE: ${{ inputs.batch_size || '5' }} | |
| DRY_RUN: ${{ inputs.dry_run || 'false' }} | |
| # Logic extracted to auditor/scripts/batch-process.py in v0.8.12 | |
| # (was a 240-line inline bash block with 5 phases). The script | |
| # validates BATCH_SIZE, runs each phase as its own function, and | |
| # is directly invokable for testing via subprocess of gh CLI. | |
| run: python3 auditor/scripts/batch-process.py |