qctl 0.5.4

Control in-repo YAML work queues
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

env:
  GIT_CONFIG_COUNT: "1"
  GIT_CONFIG_KEY_0: init.defaultBranch
  GIT_CONFIG_VALUE_0: main
  CARGO_TERM_COLOR: always
  MISE_ENV: ci

concurrency:
  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref_name }}-${{ github.event.pull_request.base.sha || github.sha }}
  cancel-in-progress: true

jobs:
  verify:
    name: Verify
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install locked toolchain
        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
        with:
          version: 2026.10.3
          cache: true
      - name: Cache builds with mbx
        uses: jdx/mr-boxington-action@9df1d4b18b2147788a7ee7a2c7b84ecf62fd89d3 # v1.5.0
      - name: Verify
        run: mise run verify
      - name: Advisories
        run: mise run deny:advisories
      - name: Semver
        run: mise run semver
      - name: Package
        run: mise x -- cargo package --locked --all-features

  template:
    name: Template
    # A pull request from a fork gets no secrets and cannot read the private
    # template, so the check is skipped there instead of failing.
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
    runs-on: ubuntu-latest
    steps:
      - name: Check out repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      # Mints a token from the vsh-templates-reader App, installs only uv and
      # python, and fails when the newest template tag would change a file.
      - name: Check the template version
        uses: victor-software-house/ctl-core/.github/actions/copier-check@6db8b6422ea7b1fca93304407800d984d4fae0c7 # main, 2026-10-12
        with:
          client-id: ${{ secrets.TEMPLATES_APP_CLIENT_ID }}
          private-key: ${{ secrets.TEMPLATES_APP_PRIVATE_KEY }}