name: Decapod Validate
on:
push:
branches: [ main, master ]
pull_request:
branches: [ main, master ]
jobs:
validate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Install Rust
uses: dtolnay/rust-toolchain@stable
- name: Cache cargo-binstall and Decapod
id: cache_decapod_tools
uses: actions/cache@v4
with:
path: |
~/.cargo/bin/cargo-binstall
~/.cargo/bin/decapod
key: ${{ runner.os }}-decapod-tools-v1-${{ hashFiles('AGENTS.md') }}
- name: Install cargo-binstall
if: steps.cache_decapod_tools.outputs.cache-hit != 'true'
uses: cargo-bins/cargo-binstall@main
- name: Install Decapod
if: steps.cache_decapod_tools.outputs.cache-hit != 'true'
run: cargo binstall --no-confirm decapod@0.98.3
- name: Decapod Validate
env:
DECAPOD_VALIDATE_SKIP_GIT_GATES: 1
DECAPOD_VALIDATE_SKIP_FINGERPRINT_GATES: ${{ (github.event_name == 'push' || contains(github.event.pull_request.labels.*.name, 'release') || startsWith(github.head_ref, 'release-please')) && '1' || '' }}
run: |
if [ ! -d .decapod ]; then
decapod init --proof
fi
decapod validate --refresh-specs
- name: Ensure no spec or entrypoint drift
if: github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'release') && !startsWith(github.head_ref, 'release-please')
run: |
set -euo pipefail
MANIFEST=".decapod/managed/specs/.manifest.json"
if git cat-file -e "HEAD:${MANIFEST}" 2>/dev/null && [ -f "${MANIFEST}" ]; then
OLD=$(git show "HEAD:${MANIFEST}" | sed -n 's/.*"generated_at": "\([^"]*\)".*/\1/p' | head -1)
if [ -n "${OLD}" ]; then
sed -i "s/\"generated_at\": \"[^\"]*\"/\"generated_at\": \"${OLD}\"/" "${MANIFEST}"
fi
fi
if ! git diff --exit-code -- . ':!.decapod/governance/'; then
echo "::error::Release-bound or living-spec drift after validate --refresh-specs."
echo "Commit regenerated entrypoints and .decapod/managed/specs from the evaluating binary."
exit 1
fi