1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
###############################################################################
# Copyright (c) 2026 Eclipse ThreadX contributors
#
# This program and the accompanying materials are made available under the
# terms of the MIT License which is available at
# https://opensource.org/licenses/MIT.
#
# AI Disclosure: This file was largely AI-generated by Claude Code (Opus 5).
# The AI-generated portions may be considered public domain (CC0-1.0)
# and not subject to the project's licence. The human contributor has
# reviewed and verified that the code is correct.
#
# SPDX-License-Identifier: MIT and CC0-1.0
###############################################################################
name: repo_checks
# Repository-wide text checks.
#
# THIS LIVES IN ITS OWN WORKFLOW BECAUSE IT MUST NOT BE PATH-FILTERED, and a
# path filter is a property of a workflow rather than of a job. The check
# selects its input with `git ls-files` and scans every tracked file, so any
# file at all can carry a finding.
#
# That is not hypothetical here. The pass that introduced the fixed
# disclosure line covered source files only, and the drift it was meant to end
# survived for months afterwards in CMake files, toolchain files, shell and
# PowerShell scripts, a GDB script and a Visual Studio manifest -- precisely
# the files a source-path filter would have skipped. A workflow that gates no
# pull request anybody opens is worse than no workflow, because it looks like
# coverage.
#
# Cheap enough that running it on everything costs nothing worth measuring: it
# is grep over a repository this size, with no toolchain, no build and no
# cache.
on:
# No `paths:` on either trigger, deliberately. See above.
push:
branches: [ dev, master ]
pull_request:
branches: [ dev, master ]
# A second push to the same branch makes the first answer irrelevant.
concurrency:
group: repo-checks-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
checks:
runs-on: ubuntu-24.04
steps:
# Actions are pinned to a commit SHA with the version in the trailing
# comment. A tag can be moved; a SHA cannot, which is what makes "which
# code ran in our CI" answerable from the repository.
- name: Check out the repository
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Check the AI disclosure comments
run: scripts/check_ai_disclosure.sh
|
