Repository navigation
docs(saml): document User Identifier Source and Match Users By #2439
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Migration Graph | |
| # Its own workflow rather than a job inside the lint workflow: this check goes | |
| # red for a reason that has nothing to do with code style, and it goes red on a | |
| # branch whose own commits are usually fine, so the name on the PR rollup needs | |
| # to say what actually broke. | |
| # | |
| # Both triggers are load-bearing, because there are two ways to fork the graph | |
| # and each trigger catches only one of them: | |
| # | |
| # pull_request - actions/checkout resolves a pull_request event to the merge | |
| # commit, so this sees the branch *combined with* its base. That is the only | |
| # way to catch a migration written against a base branch that had already | |
| # moved on: the branch on its own has a single leaf and looks fine. | |
| # | |
| # push - catches the mirror case, where two PRs each add a migration on the | |
| # same parent. Both are internally consistent so both go green pre-merge, | |
| # and the fork exists only in their union. Nothing else re-derives the graph | |
| # after a merge, since the test suite is per-PR. | |
| # | |
| # Without this check the failure mode is every container-based job dying at boot | |
| # with ~120 red checks, none of which says "migration graph" in its name. | |
| on: | |
| workflow_dispatch: | |
| # The push trigger exists for the post-merge case described above, and that | |
| # case only happens on the release lines -- so it is scoped to them. Unfiltered | |
| # it also fired on every push to every PR branch, where it duplicated the | |
| # pull_request run of the same commit (and the pull_request run is the better | |
| # of the two there: it sees the branch merged with its base). | |
| push: | |
| branches: | |
| - master | |
| - dev | |
| - release/** | |
| - hotfix/** | |
| pull_request: | |
| jobs: | |
| migration-graph: | |
| # Release PRs and merge-backs are merged without waiting for CI. PR: a | |
| # release/merge-* head AND the release-management label. | |
| # Push: such a branch, or GitHub's merge commit for such a PR (a push has | |
| # no labels, so the branch name is the only signal). | |
| if: >- | |
| ${{ !( | |
| (startsWith(github.event_name, 'pull_request') && startsWith(github.head_ref, 'release/merge-') && contains(github.event.pull_request.labels.*.name, 'release-management')) | |
| || (github.event_name == 'push' && (startsWith(github.ref_name, 'release/merge-') || (startsWith(github.event.head_commit.message, 'Merge pull request') && contains(github.event.head_commit.message, '/release/merge-')))) | |
| ) }} | |
| name: Migration Graph Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # The script is stdlib-only (ast, no Django, no database, no settings), so | |
| # it needs no setup beyond the checkout and finishes in well under a second. | |
| - name: Check for multiple migration leaf nodes | |
| run: python3 scripts/check_migration_leaves.py |