feat(action): Marketplace-readiness pipeline for the composite action

.github/workflows/action-marketplace-readiness.yml

@@ -0,0 +1,213 @@
+name: Action Marketplace readiness
+
+# Marketplace-readiness pipeline for the composite action (action.yml) —
+# separate from ci.yml's own dog-fooding (`own-check-codescan`, which uses
+# `uses: ./` against Own.NET's own sample tree on every push/PR). This
+# workflow proves the CONSUMER-facing surface against a small dedicated
+# fixture that looks like an ordinary user's repo (not the precision-test
+# corpus), plus the immutable-tag / moving-major-tag release handling. Also
+# uses `uses: ./` — GitHub Actions does not evaluate expressions in
+# `steps.uses`, so a genuinely dynamic remote `owner/repo@<this commit>`
+# reference isn't achievable pre-tag; see docs/notes/action-marketplace-readiness.md
+# for the full account of what that leaves unproven and why.
+
+permissions:
+ contents: read
+
+on:
+ push:
+ branches: ["**"]
+ paths:
+ - "action.yml"
+ - "scripts/own-check.sh"
+ - "scripts/own-check.ps1"
+ - "fixtures/marketplace-consumer-demo/**"
+ - ".github/workflows/action-marketplace-readiness.yml"
+ tags:
+ - "v*.*.*"
+ pull_request:
+ paths:
+ - "action.yml"
+ - "scripts/own-check.sh"
+ - "scripts/own-check.ps1"
+ - "fixtures/marketplace-consumer-demo/**"
+ - ".github/workflows/action-marketplace-readiness.yml"
+ workflow_dispatch:
+ inputs:
+ move_major_tag_to:
+ description: >-
+ Release tag (e.g. v0.1.0) to point the moving major tag at. Leave
+ empty to just run the consumer-simulation checks.
+ required: false
+ default: ""
+
+jobs:
+ # The consumer-facing proof, against a small dedicated fixture instead of
+ # Own.NET's own precision-test corpus (ci.yml's `own-check-codescan` dog-food
+ # job already covers that against frontend/roslyn/samples).
+ #
+ # Uses `uses: ./`, NOT a dynamic `uses: PhysShell/Own.NET@${{ github.sha }}`
+ # (Codex review, PR #245): `jobs.<job_id>.steps.uses` does not evaluate
+ # expressions — GitHub's own context-availability docs don't list it as a
+ # field expressions may appear in (unlike `with`/`env`/`if`/`run`), so that
+ # ref would have been treated as a literal (and-broken) string and the job
+ # would never have run at all. There is no way to parameterize `uses:` with
+ # "the commit currently under test" — a genuinely dynamic remote-ref proof
+ # isn't automatable pre-tag. `uses: ./` is the correct, honest mechanism
+ # here (same one ci.yml's dog-food job already relies on); the meaningful
+ # difference from that job is the fixture, not the resolution mechanism.
+ # See docs/notes/action-marketplace-readiness.md for the full account,
+ # including what a genuinely separate consumer repo would additionally
+ # prove and why one wasn't created here.
+ consumer-simulation:
+ name: consumer simulation — dedicated fixture, real findings
+ runs-on: ubuntu-latest
+ # security-events:write is required by upload-sarif (Codex review, PR
+ # #245: `security-events: write` is REQUIRED for every workflow that
+ # calls it, not just push events) — every other step only needs the
+ # default contents:read.
+ permissions:
+ contents: read
+ security-events: write
+ steps:
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+ with:
+ persist-credentials: false
+
+ - name: Own.NET check on the leak sample (fails as configured)
+ id: leak
+ uses: ./
+ continue-on-error: true # expected to fail — asserted on explicitly below, not swallowed
+ with:
+ path: fixtures/marketplace-consumer-demo/Leaky.cs
+ format: github
+ fail-on-finding: "true"
+ - name: Assert the leak step actually failed (not silently green)
+ run: |
+ [ "${{ steps.leak.outcome }}" = "failure" ] \
+ || { echo "FAIL: expected the leak-sample step to fail (fail-on-finding), got '${{ steps.leak.outcome }}'"; exit 1; }
+ echo "OK: consumer-style invocation found the leak and failed the step as configured"
+
+ - name: Own.NET check on the clean sample (must NOT fail)
+ uses: ./
+ with:
+ path: fixtures/marketplace-consumer-demo/Clean.cs
+ format: github
+ fail-on-finding: "true"
+
+ # Fork PRs get a read-only GITHUB_TOKEN (GitHub's fork-PR token policy),
+ # so security-events:write is never actually granted no matter what
+ # this job requests — skip the SARIF/upload steps there instead of
+ # failing red for external contributors through no fault of their own
+ # (Codex review, PR #245; mirrors ci.yml's own-check-codescan guard).
+ # Same-repo pushes/PRs and tag pushes still run it.
+ - name: Own.NET check, SARIF surface + upload-sarif wiring
+ id: sarif
+ if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+ uses: ./
+ with:
+ path: fixtures/marketplace-consumer-demo
+ format: sarif
+ severity: warning
+ fail-on-finding: "false"
+ - name: The action exposes a non-empty sarif-file output
+ if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+ run: |
+ f="${{ steps.sarif.outputs.sarif-file }}"
+ test -n "$f" || { echo "FAIL: sarif-file output not set"; exit 1; }
+ test -s "$f" || { echo "FAIL: sarif-file '$f' missing or empty"; exit 1; }
+ echo "OK: $(wc -c < "$f") bytes of SARIF"
+ - name: Upload to GitHub code scanning (the real consumer path)
+ if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+ uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+ with:
+ sarif_file: ${{ steps.sarif.outputs.sarif-file }}
+ category: action-marketplace-consumer-demo
+
+ # Immutable version tag: a pushed vX.Y.Z is never mutated once pushed —
+ # this job only VALIDATES it (re-runs the consumer-simulation checks
+ # implicitly via `needs`, plus a metadata sanity pass). It never moves any
+ # tag itself.
+ validate-release-tag:
+ name: validate the pushed release tag
+ # event_name == 'push' required alongside the ref check (same class of
+ # gap Codex flagged on ownsharp-cli-release.yml, PR #244): github.ref
+ # alone doesn't prove the run was actually caused by a tag push, since a
+ # workflow_dispatch run can be pointed `--ref` at an existing tag too.
+ # This job only validates (never mutates/publishes), so the stakes are
+ # lower than the CLI's publish gate, but the fix is the same and free.
+ if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+ needs: consumer-simulation
+ runs-on: ubuntu-latest
+ steps:
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+ with:
+ persist-credentials: false
+ - name: action.yml has the fields Marketplace publishing requires
+ run: |
+ python3 - <<'PY'
+ import sys, re
+ text = open("action.yml", encoding="utf-8").read()
+ # Cheap structural checks (no YAML+schema dependency in this repo's
+ # zero-dependency Python core) - enough to catch an accidental
+ # metadata regression before it reaches a real tag/publish.
+ for field in ("name:", "description:", "author:", "branding:", "icon:", "color:"):
+ assert field in text, f"action.yml missing '{field}'"
+ m = re.search(r'icon:\s*"([^"]+)"', text)
+ c = re.search(r'color:\s*"([^"]+)"', text)
+ assert m, "branding.icon not found"
+ assert c, "branding.color not found"
+ allowed_colors = {"white", "yellow", "blue", "green", "orange", "red", "purple", "gray-dark"}
+ assert c.group(1) in allowed_colors, f"branding.color '{c.group(1)}' not in Marketplace's allowed set {allowed_colors}"
+ print(f"OK: action.yml metadata present; icon={m.group(1)!r} color={c.group(1)!r}")
+ PY
+ - name: Tag is immutable from here — this job only validates, never mutates
+ run: echo "Tag ${{ github.ref_name }} at ${{ github.sha }} validated. Moving the major tag is a SEPARATE, explicit workflow_dispatch step — see move-major-tag."
+
+ # The ONLY place a major tag (e.g. v0) is ever moved. Deliberately
+ # `workflow_dispatch`-only with an explicit target — never runs from a
+ # plain tag push, so pushing v0.1.1 can never silently repoint v0 as a
+ # side effect. Force-moving a tag is a hard-to-reverse, externally-visible
+ # action (equivalent to a force-push), so it is gated behind the
+ # `action-major-tag-move` GitHub Environment, which a repo admin must
+ # configure with required reviewers before this can run unattended.
+ move-major-tag:
+ name: move the major tag (protected, manual only)
+ if: github.event_name == 'workflow_dispatch' && inputs.move_major_tag_to != ''
+ runs-on: ubuntu-latest
+ environment: action-major-tag-move
+ permissions:
+ contents: write
+ steps:
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+ with:
+ persist-credentials: true
+ fetch-depth: 0
+ # Inputs flow through the environment (data), not template-interpolated
+ # into the script body (code) — same pattern action.yml itself already
+ # follows (its own CodeRabbit #10 fix) and CodeRabbit flagged here too
+ # (PR #245): a `move_major_tag_to` containing shell metacharacters would
+ # otherwise expand before bash parses the script. The SemVer format
+ # check below is a second, independent guard, not a substitute for it.
+ - name: Resolve and validate the target release tag
+ id: target
+ env:
+ MOVE_MAJOR_TAG_TO: ${{ inputs.move_major_tag_to }}
+ run: |
+ target="$MOVE_MAJOR_TAG_TO"
+ echo "$target" | grep -qE '^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$' \
+ || { echo "FAIL: '$target' is not a valid vX.Y.Z tag"; exit 1; }
+ git rev-parse "refs/tags/$target" >/dev/null 2>&1 \
+ || { echo "FAIL: tag '$target' does not exist — push it first, this job never creates release tags"; exit 1; }
+ major="${target%%.*}" # "v0.1.0" -> "v0"
+ echo "target=$target" >> "$GITHUB_OUTPUT"
+ echo "major=$major" >> "$GITHUB_OUTPUT"
+ - name: Force-move the major tag to the target release commit
+ env:
+ TARGET: ${{ steps.target.outputs.target }}
+ MAJOR: ${{ steps.target.outputs.major }}
+ run: |
+ sha=$(git rev-parse "refs/tags/$TARGET")
+ echo "Moving $MAJOR -> $TARGET ($sha)"
+ git tag -f "$MAJOR" "$sha"
+ git push origin "$MAJOR" --force

README.md

@@ -13,12 +13,17 @@ release.
 
 ```yaml
 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-- uses: PhysShell/own.net@main # pre-release: no tagged release yet — pin a commit SHA for reproducibility
+- uses: PhysShell/Own.NET@main # pre-release: no tagged release yet — pin a commit SHA for reproducibility
  with:
  format: github # inline PR annotations; use "sarif" for the Security tab
  fail-on-finding: "true"
 ```
 
+Once a release ships, prefer a pinned tag (`@v0.1.0`) or the moving major tag
+(`@v0`) over `@main` — see
+[`docs/notes/action-marketplace-readiness.md`](docs/notes/action-marketplace-readiness.md)
+for the versioning policy.
+
 ## Or point it at a repo you already have
 
 ```bash

README.ru.md

@@ -14,12 +14,16 @@
 
 ```yaml
 - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-- uses: PhysShell/own.net@main # пре-релиз: тегов ещё нет — для воспроизводимости пиньте commit SHA
+- uses: PhysShell/Own.NET@main # пре-релиз: тегов ещё нет — для воспроизводимости пиньте commit SHA
  with:
  format: github # инлайн-аннотации в PR; "sarif" — для вкладки Security
  fail-on-finding: "true"
 ```
 
+После первого релиза предпочитайте закреплённый тег (`@v0.1.0`) или
+подвижный major-тег (`@v0`) вместо `@main` — политика версионирования в
+[`docs/notes/action-marketplace-readiness.md`](docs/notes/action-marketplace-readiness.md).
+
 ## Или локально, на репозитории, который уже есть
 
 ```bash

action.yml

@@ -55,12 +55,12 @@ runs:
  using: "composite"
  steps:
  - name: Set up Python (Own.NET core)
- uses: actions/setup-python@v5
+ uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
  with:
  python-version: ${{ inputs.python-version }}
 
  - name: Set up .NET (Roslyn extractor)
- uses: actions/setup-dotnet@v4
+ uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
  with:
  dotnet-version: ${{ inputs.dotnet-version }}