From 207465a52e677a11e31d1179925b2856f234241f Mon Sep 17 00:00:00 2001 From: Brion Date: Tue, 15 Sep 2026 14:35:16 +0530 Subject: [PATCH] Block pull requests without a cross-SDK parity decision A capability that ships here usually has to ship in the other ThunderID SDKs too, and until now nothing at review time asked whether it did. The SDK development specification states that the decision is made on every pull request; this wires that up. Every pull request must carry exactly one of parity/prs-raised or parity/prs-not-needed. The check stays red until it does, and a label is the only thing that clears it, so a change is never waved through on the strength of the files it happened to touch. Applying the label re-runs the check, so it goes green without a push. The logic lives in thunder-id/.github and is shared by all four SDK repositories, which cannot drift as a result. This file owns only the triggers, which a reusable workflow cannot declare for its caller. Signed-off-by: Brion --- .github/pull_request_template.md | 2 ++ .github/workflows/parity-check.yml | 41 ++++++++++++++++++++++++++++++ 2 files changed, 43 insertions(+) create mode 100644 .github/workflows/parity-check.yml diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 542f9ad2..cae06bb0 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -43,6 +43,8 @@ _How should users update their code/configuration to adapt to the breaking chang - [ ] Breaking changes. (Fill if applicable) - [ ] Breaking changes section filled. - [ ] `breaking change` label added. +- [ ] Cross-SDK parity. Exactly one of `parity/prs-raised` or `parity/prs-not-needed` added. + - [ ] If `parity/prs-raised`, the port links are posted as a reply on the parity check's comment. ### Security checks diff --git a/.github/workflows/parity-check.yml b/.github/workflows/parity-check.yml new file mode 100644 index 00000000..def26eb4 --- /dev/null +++ b/.github/workflows/parity-check.yml @@ -0,0 +1,41 @@ +# Gates every pull request on an explicit cross-SDK parity decision, so a capability that ships +# here is never silently forgotten in the other ThunderID SDKs. +# +# All of the logic lives in thunder-id/.github so the four SDK repositories cannot drift. This +# file owns only the triggers, which a reusable workflow cannot declare for its caller. The +# sibling list is derived from the repository the check runs in, so there is nothing to pass. +# +# `pull_request_target`, rather than `pull_request`, is what lets the check comment on pull +# requests opened from forks. Nothing from the contributor's branch is checked out or executed. +# +# Uses: +# OS: ubuntu-latest + +name: 🔀 Parity Check + +on: + pull_request_target: + types: [opened, reopened, synchronize, ready_for_review, edited, labeled, unlabeled] + # Lets a reply carrying the port links refresh the checklist immediately, instead of it going + # stale until the next push. + issue_comment: + types: [created, edited] + merge_group: + +# Avoid running multiple parity checks for the same pull request on subsequent pushes, label +# changes, or replies. The event name is part of the group deliberately: a reply refreshing the +# checklist must not cancel the run that is gating the pull request, and any bot that comments +# would otherwise do exactly that. +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.event.issue.number || github.ref }}-${{ github.event_name }} + cancel-in-progress: true + +jobs: + parity: + name: 🔀 Cross-SDK Parity + permissions: + contents: read + pull-requests: write + # Pinned to a tag once one is cut, so a change to the shared workflow reaches the four SDK + # repositories deliberately rather than the moment it merges. + uses: thunder-id/.github/.github/workflows/sdk-parity-check.yml@main