fix(plugin-mssql): establish the required session options and complet… #903
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Repo Hygiene | |
| # Lints the parts of the repo the macOS suite cannot reach. 7,500 lines of shell build, sign, | |
| # notarize and publish this app, and nothing checked any of it: the six findings actionlint reported | |
| # the first time it ran here were all inside `run:` blocks in the release and plugin workflows. | |
| # | |
| # Runs on ubuntu, where minutes are free on a public repo, and finishes in well under a minute. | |
| on: | |
| pull_request: | |
| paths: | |
| - "scripts/**" | |
| - ".github/workflows/**" | |
| - ".github/actions/**" | |
| - ".github/scripts/**" | |
| - ".github/plugin-registry.json" | |
| - ".github/duplicate-contract-baseline.txt" | |
| - "Plugins/**/*.swift" | |
| - "TablePro/**/*.swift" | |
| - "Packages/**/*.swift" | |
| push: | |
| branches: [main] | |
| paths: | |
| - "scripts/**" | |
| - ".github/workflows/**" | |
| - ".github/actions/**" | |
| - ".github/scripts/**" | |
| - ".github/plugin-registry.json" | |
| - ".github/duplicate-contract-baseline.txt" | |
| - "Plugins/**/*.swift" | |
| - "TablePro/**/*.swift" | |
| - "Packages/**/*.swift" | |
| workflow_dispatch: | |
| concurrency: | |
| group: repo-hygiene-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| lint: | |
| name: Lint workflows and scripts | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install shellcheck and actionlint | |
| run: | | |
| sudo apt-get update -qq | |
| sudo apt-get install -y -qq shellcheck | |
| bash <(curl -sSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash) 1.7.12 | |
| ./actionlint --version | |
| # actionlint shells out to shellcheck for every inline `run:` block, which is the only way | |
| # those get checked at all: they are not files, so a plain shellcheck run never sees them. | |
| - name: Lint workflows | |
| run: ./actionlint -color | |
| # --severity=warning is the floor the repo currently holds at zero. The remaining | |
| # informational findings are almost all SC2012 (`ls` where `find` would be sturdier) in | |
| # message strings, and gating on them today would only add noise. | |
| - name: Lint scripts | |
| run: | | |
| set -euo pipefail | |
| mapfile -t SCRIPTS < <(find scripts .claude/skills -name '*.sh' | sort) | |
| echo "checking ${#SCRIPTS[@]} scripts" | |
| shellcheck --severity=warning "${SCRIPTS[@]}" | |
| # shellcheck cannot tell a shell function from a command on PATH, so a script that calls a | |
| # scripts/lib function without sourcing the library reads as correct everywhere and dies at | |
| # run time with exit 127. That is how v0.67.1's DMG job failed: create-dmg.sh called | |
| # notarize_and_staple and never sourced lib/notarize.sh, and a release was the first thing | |
| # to run it. | |
| - name: Check every script sources the libraries it calls into | |
| run: python3 scripts/ci/check-lib-sourcing.py | |
| - name: Check the plugin manifest against the plugin classes | |
| run: python3 scripts/ci/check-plugin-manifest.py | |
| # The iOS app compiles source files that belong to macOS plugin targets, and it alone sets | |
| # SWIFT_DEFAULT_ACTOR_ISOLATION: MainActor, so one unmarked declaration in a shared file is | |
| # @MainActor on iOS and nonisolated in the plugin. The macOS suite cannot see it and the iOS | |
| # job reports it one symbol at a time, which took main red three times over one keyword. | |
| - name: Check shared plugin sources are explicitly isolated for iOS | |
| run: python3 scripts/ci/check-ios-shared-isolation.py | |
| - name: Validate the registry update script | |
| run: python3 .github/scripts/test_update_registry.py | |
| # The macOS suite cannot catch this one: the script runs before any test does, and when it | |
| # gets this wrong no test runs at all. An empty quarantine list made it print a blank line, | |
| # which the caller turned into an empty xcodebuild argument, and main went red for three | |
| # commits with `Unknown build action ''`. | |
| - name: Validate the test quarantine script | |
| run: python3 scripts/ci/test_quarantine_args.py | |
| - name: Validate release note extraction | |
| run: python3 scripts/ci/test_release_notes.py | |
| # Only a real release runs sign-and-appcast.sh, so nothing on a pull request ever exercised | |
| # the code that edits the file every install polls. These two cover the parts that can be | |
| # tested without a signing key: which bytes move, and which releases are refused. | |
| - name: Validate the appcast merge | |
| run: python3 scripts/ci/test_merge_appcast.py | |
| - name: Validate release withdrawal | |
| run: python3 scripts/ci/test_pull_release.py | |
| # A check that guarded a real invariant and ran nowhere. Pure grep over Swift sources, so it | |
| # belongs on the free Linux runner. The MongoDB filter-shape check is the other one that was | |
| # orphaned, but it compiles a C probe against Libs/libbson, so it lives in the macOS build | |
| # job in macos-tests.yml where the toolchain and the libraries already are. | |
| - name: Check the shared-contract drift gates | |
| run: scripts/audit-refactor-health.sh --check |