settings-configured.yml

# Asks whether Settings -> Secrets and variables -> Actions actually holds what
# the workflows in this directory expect - the one question a checkout cannot
# answer about itself. A GitHub Actions secret is write-only once set: the API
# will not read one back, and neither will the maintainer who set it.
#
# Read-only in the strongest sense available: it resolves the secrets and vars
# contexts, immediately reduces them to the names whose values came back
# non-empty, and passes only those names to pytest. No value reaches the test
# process, so there is nothing for a failure message to leak.
#
# THE WEEKLY RUN IS THE POINT OF THE WHOLE THING. An R2 token can be revoked or
# expire without anyone touching this repository, and the next thing to notice
# would otherwise be a publish failing partway through. Unlike
# check-upstream-freshness.yml, a red X here is always a real break: a missing
# credential is not a normal state to be in.
#
# DELIBERATELY NOT ON `pull_request`, AND THAT IS WHY IT IS ITS OWN FILE (#679).
# GitHub passes no secrets to a fork's pull request run, so this job would fail
# for every outside contributor, for a reason none of them could fix and that
# says nothing about their change. It used to express that as a job-level `if:`
# on a `pull_request` trigger it did not want, because it shared an `on:` block
# with the manifest half, which does want one. Now it simply has no such
# trigger. `.github/expected-protections.yml` keeps `Settings are configured`
# in `never_required` for this reason, which is about what the check can see
# rather than about a missing `merge_group:` trigger.
#
# It also carries no `merge_group:` for the same reason: a check that cannot
# report on a pull request must not be required, and one that cannot report on
# a queue entry hangs it.

name: Settings configured

on:
  schedule:
    # Mondays, 07:35 UTC. Off the hour for the same reason as
    # check-upstream-freshness.yml, and a few minutes clear of it -
    # protections-check.yml follows at 07:45.
    - cron: "35 7 * * 1"
  workflow_dispatch:

# Reads the repository, and resolves the settings contexts GitHub hands every
# job. Nothing here writes anywhere.
permissions:
  contents: read

jobs:
  configured:
    # Unchanged across the split from settings-check.yml, and named in
    # `.github/expected-protections.yml`'s never_required section by this
    # string.
    name: Settings are configured
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: .github/tests
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.14"

      - name: Install dependencies
        run: pip install -r requirements-dev.txt

      # The whole security argument for this workflow lives in this step. The
      # contexts arrive whole, and leave as two JSON arrays of names - `.key`
      # only, never `.value`. Everything downstream sees names, so a test that
      # prints its inputs prints nothing worth masking.
      #
      # Empty values are dropped rather than counted as present: a repository
      # variable set to "" exists as far as the settings page is concerned and
      # is worth exactly as much to a build as one that was never created.
      #
      # Through env, not interpolated into the script body - pages.yml
      # documents the rule, and it matters more here than anywhere.
      - name: Reduce the settings to their names
        id: names
        env:
          SECRETS_JSON: ${{ toJSON(secrets) }}
          VARS_JSON: ${{ toJSON(vars) }}
        run: |
          {
            echo "secrets=$(jq -c '[to_entries[] | select(.value != "") | .key]' <<<"$SECRETS_JSON")"
            echo "variables=$(jq -c '[to_entries[] | select(.value != "") | .key]' <<<"$VARS_JSON")"
          } >> "$GITHUB_OUTPUT"

      - name: Check them against expected-settings.yml
        env:
          # Read by test_the_live_check_is_not_silently_skipping_where_it_is
          # _meant_to_run, so that an empty environment fails this job instead
          # of skipping every test in it and reporting green.
          SETTINGS_CHECK_LIVE: "1"
          CONFIGURED_SECRETS: ${{ steps.names.outputs.secrets }}
          CONFIGURED_VARIABLES: ${{ steps.names.outputs.variables }}
        run: python -m pytest -v