Files
open-design/.github/workflows/dsh-upstream-drift.yml
T

55 lines
1.9 KiB
YAML

name: dsh-upstream-drift
# Watch upstream DeepSeek Harness releases and say something when we fall behind.
#
# `@deepseek-ai/dsh` has twice published a new release line while this repo kept
# pinning the old one, and both times a person reporting a broken install was the
# detection mechanism. The in-repo check compares our installers against our
# agent def — both halves of our own config — so it stays green while both are
# equally stale. This compares them against the registry instead.
#
# Standalone and outside the merge gate, like docker-image.yml: an
# upstream release is not a reason to fail a PR.
on:
schedule:
# 01:30 UTC = 09:30 Asia/Shanghai, after the landing summary so the two
# morning cards do not arrive at the same minute.
- cron: "30 1 * * *"
workflow_dispatch:
permissions:
contents: read
concurrency:
group: dsh-upstream-drift
cancel-in-progress: false
jobs:
check:
name: Compare pinned DeepSeek Harness against the registry
if: github.repository == 'nexu-io/open-design' && github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
timeout-minutes: 10
steps:
- name: Checkout main
uses: actions/checkout@v6.0.2
with:
ref: main
- name: Setup Node.js
uses: actions/setup-node@v6
with:
node-version: 24
# Fails on a logic regression before anything reaches the registry or a
# webhook, so a broken checker is loud rather than silently in-sync.
- name: Check drift script
run: node --experimental-strip-types .github/scripts/dsh-upstream-drift.ts self-check
- name: Compare against the npm registry
env:
FEISHU_SIGN_SECRET: ${{ secrets.FEISHU_LANDING_SIGN_SECRET || secrets.FEISHU_RELEASE_SIGN_SECRET }}
FEISHU_WEBHOOK: ${{ secrets.FEISHU_LANDING_WEBHOOK || secrets.FEISHU_RELEASE_WEBHOOK }}
run: node --experimental-strip-types .github/scripts/dsh-upstream-drift.ts run