Skip to content

feat(evidence): publish the Flow 1.32.0 comparison; mark 1.31.0 superseded #48

feat(evidence): publish the Flow 1.32.0 comparison; mark 1.31.0 superseded

feat(evidence): publish the Flow 1.32.0 comparison; mark 1.31.0 superseded #48

name: evidence-freshness
# Published evidence is bound to one exact openadapt-flow wheel. A Flow release
# can therefore invalidate it without any commit landing here, so the check runs
# on a schedule as well as on changes to the evidence itself. It is one small
# job, so it costs a few seconds a day rather than a matrix.
on:
schedule:
- cron: '17 6 * * *'
workflow_dispatch:
pull_request:
paths:
- 'docs/eval_results/**'
- 'scripts/check_published_evidence_freshness.py'
- 'scripts/import_production_acceptance.py'
- '.github/workflows/evidence-freshness.yml'
concurrency:
group: evidence-freshness-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
freshness:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Set up Python
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
with:
python-version: '3.12'
# Standard library only: no dependency install, no lockfile, no cache.
- name: Check published evidence against the current published release
env:
APPROVED_CLOUD_ACCEPTANCE_COMMIT: ${{ vars.APPROVED_CLOUD_ACCEPTANCE_COMMIT }}
QUALIFICATION_ADMISSION_SIGNERS_JSON: ${{ vars.QUALIFICATION_ADMISSION_SIGNERS_JSON }}
REVOKED_QUALIFICATION_ADMISSION_IDS_JSON: ${{ vars.REVOKED_QUALIFICATION_ADMISSION_IDS_JSON }}
REVOKED_QUALIFICATION_SIGNER_KEY_IDS_JSON: ${{ vars.REVOKED_QUALIFICATION_SIGNER_KEY_IDS_JSON }}
run: >-
python scripts/check_published_evidence_freshness.py
--approved-cloud-source-commit "$APPROVED_CLOUD_ACCEPTANCE_COMMIT"
--trusted-admission-signers-json "$QUALIFICATION_ADMISSION_SIGNERS_JSON"
--revoked-admission-ids-json "$REVOKED_QUALIFICATION_ADMISSION_IDS_JSON"
--revoked-admission-signer-key-ids-json "$REVOKED_QUALIFICATION_SIGNER_KEY_IDS_JSON"