Move the sync script out of the scoped workflow into a file

tools/sync_github_metadata.py holds the 221 lines that were embedded in
sync-github-metadata.yml, unchanged in behaviour and messages. The scoped
workflow now checks out TirSystem/github-action at main and runs the file
(33 lines instead of 230). The tests import the file instead of executing
the YAML. Verified live from TirSystem-BashScript/RepoFoundry with that
organisation's secrets.

Task: MIL-004#6

tests/test_sync_github_metadata.py

@@ -1,4 +1,4 @@
-"""Offline tests for the Python embedded in sync-github-metadata.yml."""
+"""Offline tests for tools/sync_github_metadata.py."""
 
 import io
 import json

tests/test_workflows.py

@@ -5,7 +5,7 @@ import ast
 import pytest
 import yaml
 
-from workflow_source import REPO_ROOT, SYNC_WORKFLOW, embedded_python, workflow_files
+from workflow_source import REPO_ROOT, SYNC_SCRIPT, SYNC_WORKFLOW, embedded_python, workflow_files
 
 WORKFLOWS = workflow_files()
 
@@ -33,8 +33,18 @@ class TestEachWorkflow:
             assert "permissions" in job, f"job {name} has no explicit permissions"
 
 
-def test_sync_workflow_embeds_exactly_one_script():
-    assert len(embedded_python(SYNC_WORKFLOW)) == 1
+def test_sync_workflow_embeds_no_script_and_runs_the_file():
+    assert embedded_python(SYNC_WORKFLOW) == []
+    document = yaml.safe_load(SYNC_WORKFLOW.read_text(encoding="utf-8"))
+    steps = document["jobs"]["sync-metadata"]["steps"]
+    assert steps[0]["with"]["repository"] == "TirSystem/github-action"
+    assert steps[-1]["run"] == "python3 shared-scripts/tools/sync_github_metadata.py"
+
+
+def test_sync_script_compiles_and_is_a_file_of_this_repository():
+    source = SYNC_SCRIPT.read_text(encoding="utf-8")
+    ast.parse(source, filename=str(SYNC_SCRIPT))
+    assert "def main()" in source and 'if __name__ == "__main__":' in source
 
 
 def test_each_workflow_name_has_one_source():

tests/workflow_source.py

@@ -1,5 +1,6 @@
 """Helpers that read workflow files and the Python embedded in them."""
 
+import importlib.util
 import re
 import textwrap
 from pathlib import Path
@@ -11,6 +12,7 @@ WORKFLOW_DIRS = (
     REPO_ROOT / ".gitea" / "workflows",
 )
 SYNC_WORKFLOW = WORKFLOW_DIRS[0] / "sync-github-metadata.yml"
+SYNC_SCRIPT = REPO_ROOT / "tools" / "sync_github_metadata.py"
 PUBLISH_WORKFLOW = WORKFLOW_DIRS[0] / "publish-wiki.yml"
 
 _HEREDOC = re.compile(
@@ -37,12 +39,42 @@ def embedded_python(path: Path) -> list[str]:
     ]
 
 
-def load_sync_module(name: str = "embedded_sync") -> dict[str, Any]:
-    """Execute the embedded sync script without running `main`."""
-    (source,) = embedded_python(SYNC_WORKFLOW)
-    namespace: dict[str, Any] = {"__name__": name}
-    exec(compile(source, str(SYNC_WORKFLOW), "exec"), namespace)
-    return namespace
+class ModuleView:
+    """A script module, readable and writable by item and by attribute.
+
+    Tests write `sync["request_json"] = fake` or `module.request_json = fake`;
+    both set the attribute of the real module, so the functions of the script
+    see the replacement.
+    """
+
+    def __init__(self, module: Any) -> None:
+        object.__setattr__(self, "_module", module)
+
+    def __getitem__(self, name: str) -> Any:
+        return getattr(self._module, name)
+
+    def __setitem__(self, name: str, value: Any) -> None:
+        setattr(self._module, name, value)
+
+    def __getattr__(self, name: str) -> Any:
+        return getattr(self._module, name)
+
+    def __setattr__(self, name: str, value: Any) -> None:
+        setattr(self._module, name, value)
+
+
+def load_script(path: Path, name: str) -> ModuleView:
+    """Import a script file without running its `main` (its name is not `__main__`)."""
+    spec = importlib.util.spec_from_file_location(name, path)
+    assert spec is not None and spec.loader is not None
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return ModuleView(module)
+
+
+def load_sync_module(name: str = "sync_github_metadata") -> ModuleView:
+    """Import tools/sync_github_metadata.py."""
+    return load_script(SYNC_SCRIPT, name)
 
 
 class ScriptNamespace(dict):