From ea3f6a2dcab9f8423857198a5566f25f6b630197 Mon Sep 17 00:00:00 2001 From: ilyam8 Date: Tue, 4 Aug 2026 18:44:58 +0300 Subject: [PATCH 1/3] testdata(prometheus): protect evidence line endings --- .gitattributes | 1 + .github/workflows/prometheus-evidence.yml | 17 ++++++++++++++++- 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/.gitattributes b/.gitattributes index 547d1e5..da11e23 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,3 +1,4 @@ +.gitattributes text eol=lf /prometheus/README.md text eol=lf /prometheus/ATTRIBUTION.md text eol=lf /prometheus/profiles/**/manifest.yaml text eol=lf diff --git a/.github/workflows/prometheus-evidence.yml b/.github/workflows/prometheus-evidence.yml index 36b52e9..b8f3263 100644 --- a/.github/workflows/prometheus-evidence.yml +++ b/.github/workflows/prometheus-evidence.yml @@ -5,6 +5,7 @@ on: pull_request: paths: - 'prometheus/profiles/**' + - '.gitattributes' - '.github/workflows/prometheus-evidence.yml' permissions: @@ -19,12 +20,26 @@ jobs: with: fetch-depth: 0 + - name: Verify LF storage contract + shell: bash + run: | + set -euxo pipefail + + mapfile -d '' -t prometheus_paths < <(git ls-files -z -- prometheus) + for path in .gitattributes "${prometheus_paths[@]}"; do + attribute=$(git check-attr eol -- "${path}") + if [[ "${attribute}" != "${path}: eol: lf" ]]; then + echo "Prometheus evidence must check out with LF line endings: ${attribute}" >&2 + exit 1 + fi + done + - name: Reject changes to existing evidence shell: bash env: BASE_SHA: ${{ github.event.pull_request.base.sha }} run: | - set -euo pipefail + set -euxo pipefail if git diff --quiet --diff-filter=MDRT "${BASE_SHA}"...HEAD -- prometheus/profiles; then : From 2adbc027b3e1d569eeb17a2afce5a944b3e151bd Mon Sep 17 00:00:00 2001 From: ilyam8 Date: Tue, 4 Aug 2026 18:59:53 +0300 Subject: [PATCH 2/3] testdata(prometheus): make evidence check required-safe --- .github/workflows/prometheus-evidence.yml | 28 +++++++++++++++-------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/.github/workflows/prometheus-evidence.yml b/.github/workflows/prometheus-evidence.yml index b8f3263..e3a095e 100644 --- a/.github/workflows/prometheus-evidence.yml +++ b/.github/workflows/prometheus-evidence.yml @@ -2,15 +2,15 @@ name: Prometheus Evidence Immutability on: - pull_request: - paths: - - 'prometheus/profiles/**' - - '.gitattributes' - - '.github/workflows/prometheus-evidence.yml' + pull_request: null permissions: contents: read +concurrency: + group: prometheus-evidence-${{ github.ref }}-${{ github.event_name }} + cancel-in-progress: true + jobs: immutable-paths: runs-on: ubuntu-latest @@ -25,11 +25,19 @@ jobs: run: | set -euxo pipefail - mapfile -d '' -t prometheus_paths < <(git ls-files -z -- prometheus) - for path in .gitattributes "${prometheus_paths[@]}"; do - attribute=$(git check-attr eol -- "${path}") - if [[ "${attribute}" != "${path}: eol: lf" ]]; then - echo "Prometheus evidence must check out with LF line endings: ${attribute}" >&2 + mapfile -d '' -t attributes < <( + { + printf '%s\0' .gitattributes + git ls-files -z -- prometheus + } | git check-attr --stdin -z eol + ) + test "$((${#attributes[@]} % 3))" -eq 0 + for ((index = 0; index < ${#attributes[@]}; index += 3)); do + path=${attributes[index]} + attribute=${attributes[index + 1]} + value=${attributes[index + 2]} + if [[ "${attribute}" != eol || "${value}" != lf ]]; then + echo "Prometheus evidence must check out with LF line endings: ${path}: ${attribute}: ${value}" >&2 exit 1 fi done From c40515846b4c1d20263464a37a9e10a6b5266a10 Mon Sep 17 00:00:00 2001 From: ilyam8 Date: Tue, 4 Aug 2026 19:06:21 +0300 Subject: [PATCH 3/3] testdata(prometheus): fail closed on evidence checks --- .github/workflows/prometheus-evidence.yml | 19 +++++++++++++------ prometheus/README.md | 6 +++--- 2 files changed, 16 insertions(+), 9 deletions(-) diff --git a/.github/workflows/prometheus-evidence.yml b/.github/workflows/prometheus-evidence.yml index e3a095e..c378589 100644 --- a/.github/workflows/prometheus-evidence.yml +++ b/.github/workflows/prometheus-evidence.yml @@ -19,18 +19,25 @@ jobs: uses: actions/checkout@v7 with: fetch-depth: 0 + sparse-checkout: | + .gitattributes + .github/workflows/prometheus-evidence.yml + prometheus + sparse-checkout-cone-mode: false - name: Verify LF storage contract shell: bash run: | set -euxo pipefail - mapfile -d '' -t attributes < <( - { - printf '%s\0' .gitattributes - git ls-files -z -- prometheus - } | git check-attr --stdin -z eol - ) + attributes_file=$(mktemp) + trap 'rm -f "${attributes_file}"' EXIT + { + printf '%s\0' .gitattributes + git ls-files -z -- prometheus + } | git check-attr --stdin -z eol > "${attributes_file}" + mapfile -d '' -t attributes < "${attributes_file}" + test "${#attributes[@]}" -gt 0 test "$((${#attributes[@]} % 3))" -eq 0 for ((index = 0; index < ${#attributes[@]}; index += 3)); do path=${attributes[index]} diff --git a/prometheus/README.md b/prometheus/README.md index 94dcb31..1c14af5 100644 --- a/prometheus/README.md +++ b/prometheus/README.md @@ -5,11 +5,11 @@ stock Prometheus profiles in `netdata/netdata`. ## Data boundary -- `profiles//fixtures/` contains sanitized, source-derived synthetic +- `profiles//fixtures/` contains sanitized, source-derived synthetic Prometheus exposition. -- `profiles//SOURCE-INVENTORY.tsv` contains the generated +- `profiles//SOURCE-INVENTORY.tsv` contains the generated source-family-to-profile reconciliation ledger. -- `profiles//manifest.yaml` records the size and SHA-256 digest of +- `profiles//manifest.yaml` records the size and SHA-256 digest of every evidence file. These fixtures are structural unions assembled from public exporter source and