Move the publish script out of the scoped workflow into a file

tools/publish_wiki.py holds the 296 lines that were embedded in
publish-wiki.yml, unchanged in behaviour and messages. The scoped workflow
now checks out the repository that owns the wiki and TirSystem/github-action
at main, and runs the file (42 lines instead of 313). The tests import the
file, and a new test asserts that no workflow embeds Python. README and the
Home wiki page with its translations no longer mention embedded Python.
Verified live from TirSystem-BashScript/RepoFoundry.

Task: MIL-004#6

tests/test_publish_wiki.py

@@ -1,4 +1,4 @@
-"""Offline tests for the scoped publish-wiki workflow and its embedded script."""
+"""Offline tests for tools/publish_wiki.py and the scoped publish-wiki workflow."""
 
 import base64
 import io
@@ -461,11 +461,18 @@ class TestWorkflow:
         assert publish_step["env"]["WIKI_CREDENTIALS"] == "${{ secrets.TOKEN_FOR_GITEA_WIKI }}"
         assert "secrets" not in publish_step["run"]
 
-    def test_the_workflow_has_one_source_and_needs_nothing_from_tools(self):
+    def test_the_workflow_has_one_source_and_runs_the_script_file(self, document):
         assert not (REPO_ROOT / ".gitea" / "workflows" / "publish-wiki.yml").exists()
-        assert not (REPO_ROOT / "tools" / "publish_wiki.py").exists()
-        script = PUBLISH_WORKFLOW.read_text(encoding="utf-8").split("python3 - <<'PY'", 1)[1]
-        assert "tools/" not in script
+        assert (REPO_ROOT / "tools" / "publish_wiki.py").is_file()
+        steps = document["jobs"]["publish-wiki"]["steps"]
+        assert "python3 - <<" not in PUBLISH_WORKFLOW.read_text(encoding="utf-8")
+        assert steps[0]["uses"].startswith("actions/checkout@")
+        assert steps[1]["with"] == {
+            "repository": "TirSystem/github-action",
+            "ref": "main",
+            "path": "shared-scripts",
+        }
+        assert steps[-1]["run"] == "python3 shared-scripts/tools/publish_wiki.py"
 
 
 def test_this_repository_opts_in_and_prunes():

tests/test_workflows.py

@@ -41,6 +41,17 @@ def test_sync_workflow_embeds_no_script_and_runs_the_file():
     assert steps[-1]["run"] == "python3 shared-scripts/tools/sync_github_metadata.py"
 
 
+def test_no_workflow_of_this_repository_embeds_python():
+    """MIL-004 Go/No-Go criterion 5: every script is a file under tools/."""
+    embedded = {path.name: len(embedded_python(path)) for path in WORKFLOWS}
+    assert {name: count for name, count in embedded.items() if count} == {}
+
+
+@pytest.mark.parametrize("script", sorted((REPO_ROOT / "tools").glob("*.py")), ids=lambda p: p.name)
+def test_every_tool_script_compiles(script):
+    ast.parse(script.read_text(encoding="utf-8"), filename=str(script))
+
+
 def test_sync_script_compiles_and_is_a_file_of_this_repository():
     source = SYNC_SCRIPT.read_text(encoding="utf-8")
     ast.parse(source, filename=str(SYNC_SCRIPT))

tests/workflow_source.py

@@ -14,6 +14,7 @@ WORKFLOW_DIRS = (
 SYNC_WORKFLOW = WORKFLOW_DIRS[0] / "sync-github-metadata.yml"
 SYNC_SCRIPT = REPO_ROOT / "tools" / "sync_github_metadata.py"
 PUBLISH_WORKFLOW = WORKFLOW_DIRS[0] / "publish-wiki.yml"
+PUBLISH_SCRIPT = REPO_ROOT / "tools" / "publish_wiki.py"
 
 _HEREDOC = re.compile(
     r"^[ \t]*python3 - <<'PY'\r?\n(?P<code>.*?)^[ \t]*PY[ \t]*\r?$",
@@ -77,26 +78,6 @@ def load_sync_module(name: str = "sync_github_metadata") -> ModuleView:
     return load_script(SYNC_SCRIPT, name)
 
 
-class ScriptNamespace(dict):
-    """The globals of an embedded script, readable and writable as attributes.
-
-    Functions of the script look names up in this dict, so a test that sets
-    `namespace.request_json = fake` changes what the script calls.
-    """
-
-    def __getattr__(self, name: str) -> Any:
-        try:
-            return self[name]
-        except KeyError:
-            raise AttributeError(name) from None
-
-    def __setattr__(self, name: str, value: Any) -> None:
-        self[name] = value
-
-
-def load_publish_module(name: str = "embedded_publish") -> ScriptNamespace:
-    """Execute the embedded publish script without running `main`."""
-    (source,) = embedded_python(PUBLISH_WORKFLOW)
-    namespace = ScriptNamespace({"__name__": name})
-    exec(compile(source, str(PUBLISH_WORKFLOW), "exec"), namespace)
-    return namespace
+def load_publish_module(name: str = "publish_wiki") -> ModuleView:
+    """Import tools/publish_wiki.py."""
+    return load_script(PUBLISH_SCRIPT, name)