From be2e1db12d9a991d4f42d9b1d0417270cd4d9e53 Mon Sep 17 00:00:00 2001 From: Yusuke Hayashi Date: Sun, 9 Aug 2026 02:42:08 +0900 Subject: [PATCH] Make CI enforce two things it only claimed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes #11. Closes #12. Two of this repository's stated policies were not actually checked. The README and the comparison page both rest on the claim that ordinary GNU tooling catches a broken `python-brace-format` translation — the msgfmt transcript is printed verbatim. Three tests in test_toolchain.py reproduce it, and on CI all three skipped, because gettext is not on the Ubuntu image. The entire external-tool boundary went unexercised while the log said "287 passed, 3 skipped" and nobody read the s's. Install gettext on the Ubuntu 3.14 entry, which is the one that owns those assertions and also runs the lower-bound resolution; the other entries keep skipping rather than pay the install, and the tests keep their skipif so a contributor without gettext can still run the suite. The release policy is that no local state ships — .gitignore excludes .wrangler/ and check_sdist.py rejects it from the archive. One file was tracked anyway: $ git ls-files --cached --ignored --exclude-standard .wrangler/cache/wrangler-account.json Ignoring a path does not untrack a copy already committed, so it rode along in every clone. Untrack it, and add the same one-line query to the actions job so the next one fails the build instead of shipping. The file stays on disk, ignored, where wrangler expects it. Co-Authored-By: Claude Opus 5 --- .github/workflows/ci.yml | 22 ++++++++++++++++++++++ .wrangler/cache/wrangler-account.json | 6 ------ 2 files changed, 22 insertions(+), 6 deletions(-) delete mode 100644 .wrangler/cache/wrangler-account.json diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b3a8c01..f8fdef4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -40,6 +40,15 @@ jobs: enable-cache: true python-version: ${{ matrix.python-version }} - run: uv sync --locked + # This is the entry that owns the GNU-toolchain assertions: three tests in + # test_toolchain.py run `msgfmt --check-format` to prove the claim that + # ordinary gettext tooling catches a broken python-brace-format + # translation. Without gettext installed they skip, and the whole + # external-tool boundary goes unexercised. The other entries keep skipping + # rather than pay the install. + - name: Install GNU gettext, for the msgfmt tests + if: matrix.os == 'ubuntu-latest' && matrix.python-version == '3.14' + run: sudo apt-get update && sudo apt-get install --yes gettext - run: uv run ruff format --check . - run: uv run ruff check . - run: uv run mypy @@ -118,6 +127,19 @@ jobs: persist-credentials: false - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 - run: uvx zizmor .github/workflows/ + # .gitignore does not untrack what is already tracked, so a local cache + # file committed once stays in every clone and every archive. The release + # policy is that no local state ships; this is the check that says so. + - name: Fail if an ignored file is tracked + shell: bash + run: | + tracked=$(git ls-files --cached --ignored --exclude-standard) + if [ -n "$tracked" ]; then + echo "Tracked although .gitignore excludes them:" + echo "$tracked" + echo "Remove with: git rm --cached " + exit 1 + fi all-green: # One stable name for the branch ruleset to require. Matrix legs come and diff --git a/.wrangler/cache/wrangler-account.json b/.wrangler/cache/wrangler-account.json deleted file mode 100644 index bd3f4aa..0000000 --- a/.wrangler/cache/wrangler-account.json +++ /dev/null @@ -1,6 +0,0 @@ -{ - "account": { - "id": "c1726c5d74c8231cab2f762ed8adb0c1", - "name": "Yusuke8h@gmail.com's Account" - } -} \ No newline at end of file