verify-catalog.yml

name: verify-catalog

on:
  schedule:
    # Off the hour deliberately. :00 is the most contended slot on GitHub's scheduler and runs
    # there are silently DROPPED under load — this portfolio lost every scheduled run for a full
    # week that way (2026-08-24 -> 2026-08-31) with every workflow still reporting state:active.
    # The minute is allocated portfolio-wide in PORTFOLIO.json -> tooling.cron_minute_map.
    # Do not "tidy" this back to :00.
    - cron: '17 8 * * 1' # Mondays 08:17 UTC, ahead of the weekly maintenance pass
  workflow_dispatch:

permissions:
  contents: write

# One walk at a time, per repo. Every scheduled workflow here walks the same catalog through the
# same installation-wide 5,000 REST calls/hour, so two overlapping walks drain each other
# mid-walk regardless of the budget either one started with (AK evidence, 2026-08-27). The group
# is shared by name across this repo's scheduled workflows, so the overlap is STRUCTURALLY
# impossible rather than merely unlikely. QUEUE, never cancel: a catalog walk that gets killed
# half-way publishes a partial catalog, which is the exact failure the shrink guard exists to
# catch. pr-validate is deliberately NOT in this group — contributor PRs must never queue behind
# a catalog walk.
concurrency:
  group: catalog-walk
  cancel-in-progress: false

jobs:
  rebuild:
    runs-on: ubuntu-latest
    timeout-minutes: 45
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '22'

      - name: Re-resolve every entry against its canonical name
        # SECURITY, not hygiene. When a repository is renamed or transferred, the old path keeps
        # redirecting until somebody claims the vacated name; from that moment every link we
        # publish points at whoever took it, and nothing looks broken in the meantime because the
        # redirect returns 200 the whole time. Keyed by IMMUTABLE repository id: resolving the
        # slug follows the redirect, so once a squatter holds the old name a slug-keyed lookup
        # returns the squatter and confirms our stale link as canonical.
        # Runs FIRST so a rename found today is already fixed on the page every step below reads.
        # continue-on-error, not `if: always()` on everything downstream: a walk that could not
        # establish 95% of its facts exits non-zero on purpose, and that must show as a failed
        # step. It must not also cancel the catalog rebuild underneath it — the two read
        # different sources and a REST hiccup in one is not a reason to publish nothing.
        continue-on-error: true
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: node .github/scripts/resolve-names.mjs README.md CONTRIBUTING.md

      - name: Add the canonical-name result to the run summary
        # A silent clean run and a silent broken run look identical. The report always says how
        # many were resolved by immutable id, how many by slug, and how many were not established.
        if: always()
        run: cat canonical-names-report.md >> "$GITHUB_STEP_SUMMARY" || true

      - name: Rebuild the catalog, the portability matrix, and the sign-in column
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          CATALOG_RANK_UNKNOWN_IDS: ${{ secrets.CATALOG_RANK_UNKNOWN_IDS }}
        run: node .github/scripts/build-catalog.mjs .

      - name: Append a dated star snapshot to the ledger
        # Append-only, keyed by immutable repo id. Rides this walk instead of taking a cron of
        # its own: the ceiling here is one catalog walk at a time, and the numbers this needs
        # were already fetched two steps up. `if: always()` because the ledger is a record of
        # what was observed, and an upstream step finding drift is not a reason to skip
        # recording the week.
        if: always()
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: node .github/scripts/snapshot-stars.mjs CATALOG.md .github/data/star-history.json

      - name: Commit whatever changed
        run: |
          git config user.name  "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add CATALOG.md catalog.csv plugins.json badges .github/data/first-seen.json .github/data/star-history.json .github/data/repo-ids.json README.md
          if git diff --cached --quiet; then
            echo "Nothing changed this week."
            exit 0
          fi
          git commit -m "Weekly rebuild: catalog, portability matrix, sign-in column [skip ci]"
          git push