Inputs: languages (comma list of python and shell, default both), working-directory (default .), and one pinned version input per tool: ruff 0.6.9, mypy 1.11.2, shellcheck-py 0.10.0.1, shfmt-py 3.11.0.2.
contents: read only; no secret. Inputs reach the scripts only through the environment.
Steps: validate the inputs, check out the repository, install the tools from PyPI into a venv, run the checks.
Python: ruff check, ruff format --check, mypy --strict on the tracked *.py. Shell: shellcheck and shfmt -d on the tracked *.sh. No file is changed.
Every tool runs, each in its own log group named after the tool; the job fails if any failed and names them. A language with no files is skipped with a notice and passes. An unknown language or a working directory outside the repository is a [configuration] error before anything is installed.
Tests (186 pass, 30 new)
tests/test_quality_workflow.py runs the shell steps with stub tools in a throwaway git repository, so it needs no network and no real linter: the contract inputs and pinned versions, least privilege, validation, all five tools on tracked files, a failure with the others still running, skipping, language selection, working-directory scoping, untracked files and that no file is changed.
Verified live from another organization (throwaway branches in TirSystem-BashScript/RepoFoundry, deleted)
Case
Result
Clean Python and shell files
all five checks PASS, job green
Seeded failure
job red; log shows ruff check (bad.py:1:8: F401), ruff format --check (Would reformat: bad.py), shellcheck (SC2086 in bad.sh) and Quality checks failed: ruff check ruff format --check shellcheck
No Python files
passes with a notice that nothing was checked
This is the evidence for MIL-003 Go/No-Go criterion 3.
Notes
Reported paths are relative to working-directory; the guide (issue #19) should say so.
This proves the workflow from a caller; adopting it in a real repository is issue #18.
Not in this version (ADR-0005): running the project's tests, auto-fixing, other languages, caching the tool install, hash-pinning the packages (RC-038 action item, S05).
Adds the reusable quality-check workflow (MIL-003 task 3, issue #17), built against the accepted contract of ADR-0005.
## What it is
`.gitea/workflows/quality-checks.yml`, called with
```yaml
jobs:
quality:
uses: TirSystem/github-action/.gitea/workflows/quality-checks.yml@main
```
- Inputs: `languages` (comma list of `python` and `shell`, default both), `working-directory` (default `.`), and one pinned version input per tool: ruff 0.6.9, mypy 1.11.2, shellcheck-py 0.10.0.1, shfmt-py 3.11.0.2.
- `contents: read` only; no secret. Inputs reach the scripts only through the environment.
- Steps: validate the inputs, check out the repository, install the tools from PyPI into a venv, run the checks.
- Python: `ruff check`, `ruff format --check`, `mypy --strict` on the tracked `*.py`. Shell: `shellcheck` and `shfmt -d` on the tracked `*.sh`. No file is changed.
- Every tool runs, each in its own log group named after the tool; the job fails if any failed and names them. A language with no files is skipped with a notice and passes. An unknown language or a working directory outside the repository is a `[configuration]` error before anything is installed.
## Tests (186 pass, 30 new)
`tests/test_quality_workflow.py` runs the shell steps with stub tools in a throwaway git repository, so it needs no network and no real linter: the contract inputs and pinned versions, least privilege, validation, all five tools on tracked files, a failure with the others still running, skipping, language selection, working-directory scoping, untracked files and that no file is changed.
## Verified live from another organization (throwaway branches in `TirSystem-BashScript/RepoFoundry`, deleted)
| Case | Result |
| --- | --- |
| Clean Python and shell files | all five checks PASS, job green |
| Seeded failure | job red; log shows `ruff check` (`bad.py:1:8: F401`), `ruff format --check` (`Would reformat: bad.py`), `shellcheck` (SC2086 in `bad.sh`) and `Quality checks failed: ruff check ruff format --check shellcheck` |
| No Python files | passes with a notice that nothing was checked |
This is the evidence for MIL-003 Go/No-Go criterion 3.
## Notes
- Reported paths are relative to `working-directory`; the guide (issue #19) should say so.
- This proves the workflow from a caller; adopting it in a real repository is issue #18.
- Not in this version (ADR-0005): running the project's tests, auto-fixing, other languages, caching the tool install, hash-pinning the packages (RC-038 action item, S05).
- No wiki pages changed.
Closes #17
quality-checks.yml implements the contract of ADR-0005: inputs for the
languages, the working directory and one pinned version per tool; ruff,
mypy --strict, shellcheck and shfmt installed from PyPI into a venv; every
tool runs and any failure fails the job; a language without files is skipped
with a notice. Offline tests run the shell steps with stub tools. Verified
live from another organisation with clean files, a seeded failure and an
empty language.
Task: MIL-003#3
Tirsvad
merged commit 4910a5b3fd into main2026-10-10 10:19:03 +02:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Adds the reusable quality-check workflow (MIL-003 task 3, issue #17), built against the accepted contract of ADR-0005.
What it is
.gitea/workflows/quality-checks.yml, called withlanguages(comma list ofpythonandshell, default both),working-directory(default.), and one pinned version input per tool: ruff 0.6.9, mypy 1.11.2, shellcheck-py 0.10.0.1, shfmt-py 3.11.0.2.contents: readonly; no secret. Inputs reach the scripts only through the environment.ruff check,ruff format --check,mypy --stricton the tracked*.py. Shell:shellcheckandshfmt -don the tracked*.sh. No file is changed.[configuration]error before anything is installed.Tests (186 pass, 30 new)
tests/test_quality_workflow.pyruns the shell steps with stub tools in a throwaway git repository, so it needs no network and no real linter: the contract inputs and pinned versions, least privilege, validation, all five tools on tracked files, a failure with the others still running, skipping, language selection, working-directory scoping, untracked files and that no file is changed.Verified live from another organization (throwaway branches in
TirSystem-BashScript/RepoFoundry, deleted)ruff check(bad.py:1:8: F401),ruff format --check(Would reformat: bad.py),shellcheck(SC2086 inbad.sh) andQuality checks failed: ruff check ruff format --check shellcheckThis is the evidence for MIL-003 Go/No-Go criterion 3.
Notes
working-directory; the guide (issue #19) should say so.Closes #17