From 974109a4f8224093d46e2157a970dcf5066729df Mon Sep 17 00:00:00 2001 From: Altay Date: Mon, 5 Oct 2026 09:00:09 +0300 Subject: [PATCH 1/4] ci: check links and scan pushes in the change-detection job Detect code changes runs on every event, so it now runs the shared links and scan actions (v1.2.0) after a checkout. The Scan and Links workflows go. --- .github/workflows/ci.yml | 14 +++++++++++++- .github/workflows/links.yml | 21 --------------------- .github/workflows/scan.yml | 19 ------------------- AGENTS.md | 14 +++++++------- 4 files changed, 20 insertions(+), 48 deletions(-) delete mode 100644 .github/workflows/links.yml delete mode 100644 .github/workflows/scan.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 612d3a40..fc530fc5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -28,7 +28,9 @@ jobs: # Pushes and dispatches verify everything. A pull request whose every path # is docs skips verify; unlisted paths count as code. `verify` also checks # Markdown; `markdown` covers pull requests that change Markdown, including - # the docs-only ones that skip verify. + # the docs-only ones that skip verify. This job runs on every event, so it + # also checks Markdown links and scans each pushed range (full history on + # dispatch). outputs: code: ${{ github.event_name != 'pull_request' || steps.filter.outputs.code == 'true' }} markdown: ${{ github.event_name == 'pull_request' && steps.filter.outputs.markdown == 'true' }} @@ -49,6 +51,16 @@ jobs: markdown: - '**/*.md' + - name: Check out repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - uses: putdotio/.github/.github/actions/links@c1830f7938b7dc98f085082e988d3c46437bb15c # v1.2.0 + + - if: ${{ !cancelled() }} + uses: putdotio/.github/.github/actions/scan@c1830f7938b7dc98f085082e988d3c46437bb15c # v1.2.0 + markdown: name: Check Markdown needs: changes diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml deleted file mode 100644 index 8ce2a453..00000000 --- a/.github/workflows/links.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: Links - -on: - pull_request: - push: - branches: - - main - -permissions: {} - -# Same policy as CI: a new pull-request push cancels the stale run; every main -# commit keeps its own verdict. -concurrency: - group: links-${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.ref || github.run_id }} - cancel-in-progress: ${{ github.event_name == 'pull_request' }} - -jobs: - links: - permissions: - contents: read - uses: putdotio/.github/.github/workflows/frontend-links.yml@1ee0d3b473cbc6fada08831f01ff80fe653c434a # v1.1.0 diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml deleted file mode 100644 index 486e0b22..00000000 --- a/.github/workflows/scan.yml +++ /dev/null @@ -1,19 +0,0 @@ -name: Scan - -on: - pull_request: - schedule: - - cron: "41 6 * * 1" - workflow_dispatch: - -permissions: {} - -concurrency: - group: scan-${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - scan: - permissions: - contents: read - uses: putdotio/.github/.github/workflows/frontend-scan.yml@1ee0d3b473cbc6fada08831f01ff80fe653c434a # v1.1.0 diff --git a/AGENTS.md b/AGENTS.md index 76b7b742..d3072d9f 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -138,8 +138,7 @@ names the tests that pin it; a new device lane gets a section in ## Delivery and CI Open pull requests against `main`; the repository squash-merges. A push to -`main` runs [CI](.github/workflows/ci.yml) and -[Links](.github/workflows/links.yml) and nothing else: `verify` compiles +`main` runs [CI](.github/workflows/ci.yml) and nothing else: `verify` compiles the release variants unsigned, and nothing signs, publishes, or uploads to Play. CI runs `./gradlew verify` plus all four debug assembles on every `main` push and on pull requests that change more than @@ -150,8 +149,8 @@ runs `verify` with them excluded plus the debug assembles. When either command changes, compare their `--dry-run` task lists with the full command's; together they must run exactly the same tasks. A pull request that changes Markdown also runs `Check Markdown` (`./gradlew markdownCheck`), so docs-only changes still -get the formatting check. Links checks relative Markdown links and anchors on -every pull request. CI holds no secrets and keeps +get the formatting check. `Detect code changes` runs on every event and +checks relative Markdown links and anchors offline. CI holds no secrets and keeps failed unit-test XML as the `failed-unit-test-reports` artifact. A new push to a pull request cancels its running check; `main` runs never replace each other. @@ -160,9 +159,10 @@ and `StaleOAuthCallbackTest` on a Gradle Managed Device weekly and on dispatch. It is not a pull-request gate because shared-runner emulator boots are too slow and flaky; `scripts/prove.sh` stays the local proof. -[Scan](.github/workflows/scan.yml) runs the shared put.io scan weekly and on -every pull request: Gitleaks and TruffleHog look for secrets, and Actionlint -and Zizmor audit `.github/` when a pull request changes it. +`Detect code changes` also runs the shared put.io scan on each `main` push: +Actionlint and Zizmor audit `.github/` when the pushed range changes it, and a +manual dispatch of CI audits every workflow. GitHub secret scanning and push +protection catch secrets at push time. To reproduce a CI failure, check out the app SHA from the run summary in a detached worktree with `sdk.dir` set and `putioSdkKotlinPath` unset, then run From 1e95e63858590304cde86f09b88585bc2e8a34bd Mon Sep 17 00:00:00 2001 From: Altay Date: Mon, 5 Oct 2026 09:12:37 +0300 Subject: [PATCH 2/4] ci: keep the lanes running when links or scan fail --- .github/workflows/ci.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index fc530fc5..5562f82b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,8 +29,9 @@ jobs: # is docs skips verify; unlisted paths count as code. `verify` also checks # Markdown; `markdown` covers pull requests that change Markdown, including # the docs-only ones that skip verify. This job runs on every event, so it - # also checks Markdown links and scans each pushed range (full history on - # dispatch). + # also checks Markdown links and scans each pushed range. A link or scan + # failure fails this job without skipping the jobs below, which use + # `!cancelled()`. outputs: code: ${{ github.event_name != 'pull_request' || steps.filter.outputs.code == 'true' }} markdown: ${{ github.event_name == 'pull_request' && steps.filter.outputs.markdown == 'true' }} @@ -56,15 +57,17 @@ jobs: with: persist-credentials: false - - uses: putdotio/.github/.github/actions/links@c1830f7938b7dc98f085082e988d3c46437bb15c # v1.2.0 + - name: Check Markdown links + uses: putdotio/.github/.github/actions/links@c1830f7938b7dc98f085082e988d3c46437bb15c # v1.2.0 - - if: ${{ !cancelled() }} + - name: Scan secrets and workflows + if: ${{ !cancelled() }} uses: putdotio/.github/.github/actions/scan@c1830f7938b7dc98f085082e988d3c46437bb15c # v1.2.0 markdown: name: Check Markdown needs: changes - if: needs.changes.outputs.markdown == 'true' + if: ${{ !cancelled() && needs.changes.outputs.markdown == 'true' }} runs-on: ubuntu-24.04 timeout-minutes: 10 @@ -94,7 +97,7 @@ jobs: release: name: Build release needs: changes - if: needs.changes.outputs.code == 'true' + if: ${{ !cancelled() && needs.changes.outputs.code == 'true' }} runs-on: ubuntu-24.04 timeout-minutes: 40 @@ -125,7 +128,7 @@ jobs: verify: name: Verify Android app needs: changes - if: needs.changes.outputs.code == 'true' + if: ${{ !cancelled() && needs.changes.outputs.code == 'true' }} runs-on: ubuntu-24.04 timeout-minutes: 40 From 26e72da3bc9864ca28b9a469dbc626b7422dea9b Mon Sep 17 00:00:00 2001 From: Altay Date: Mon, 5 Oct 2026 09:12:46 +0300 Subject: [PATCH 3/4] test: seed a broken Markdown link --- docs/harness.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/harness.md b/docs/harness.md index c0d937e8..02982fb5 100644 --- a/docs/harness.md +++ b/docs/harness.md @@ -1584,3 +1584,5 @@ adb -s uninstall io.putdotio.android.transfers.test Label results with the device and build; emulator numbers depend on host load. Results live in [Behaviour](./behavior.md#transfers-polling). + +[seeded broken link](does-not-exist.md) From c3f88691e8b2e25619e96e87f57955135df9abcc Mon Sep 17 00:00:00 2001 From: Altay Date: Mon, 5 Oct 2026 09:15:12 +0300 Subject: [PATCH 4/4] Revert "test: seed a broken Markdown link" This reverts commit 26e72da3bc9864ca28b9a469dbc626b7422dea9b. --- docs/harness.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs/harness.md b/docs/harness.md index 02982fb5..c0d937e8 100644 --- a/docs/harness.md +++ b/docs/harness.md @@ -1584,5 +1584,3 @@ adb -s uninstall io.putdotio.android.transfers.test Label results with the device and build; emulator numbers depend on host load. Results live in [Behaviour](./behavior.md#transfers-polling). - -[seeded broken link](does-not-exist.md)