fix(guix): restore MPL-2.0 (squisher clobber downgraded it to PMPL) (… #48
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> | |
| # | |
| # placement-guard.yml — Coordination-repo content placement guard. | |
| # nextgen-databases is a COORDINATION repo: per-database implementation content belongs | |
| # in each database's own repo (see REGISTRY.adoc), not here. This gate FAILS a PR/push | |
| # that ADDS files outside the allowed coordination paths. | |
| name: Placement Guard | |
| on: | |
| pull_request: | |
| branches: ['**'] | |
| push: | |
| branches: [main, master] | |
| permissions: | |
| contents: read | |
| jobs: | |
| placement: | |
| name: Content placement check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Determine added files | |
| id: diff | |
| run: | | |
| set -uo pipefail | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| git fetch --no-tags origin "${{ github.base_ref }}" || true | |
| BASE="origin/${{ github.base_ref }}" | |
| else | |
| BASE="${{ github.event.before }}" | |
| case "$BASE" in | |
| 0000000000000000000000000000000000000000|"") BASE="$(git rev-parse HEAD~1 2>/dev/null || echo origin/main)" ;; | |
| esac | |
| fi | |
| echo "Comparing against: $BASE" | |
| git diff --name-only --diff-filter=A "$BASE...HEAD" > /tmp/added.txt 2>/dev/null \ | |
| || git diff --name-only --diff-filter=A "$BASE" HEAD > /tmp/added.txt | |
| echo "Added files:"; cat /tmp/added.txt || true | |
| - name: Check placement | |
| run: | | |
| set -uo pipefail | |
| # Allowed coordination paths (regex, anchored at repo root). | |
| ALLOW='^(README|EXPLAINME|TOPOLOGY|ROADMAP|TOOLING-STATUS|REGISTRY|CONTRIBUTING|CODE_OF_CONDUCT|SECURITY|MAINTAINERS|NOTICE|LICENSE|PROOF-NEEDS|TEST-NEEDS|QUICKSTART-[A-Z]+|0-AI-MANIFEST|CLAUDE|AGENTS|llm-warmup-[a-z]+)\.[A-Za-z0-9]+$' | |
| # `.githooks` added 2026-07-27. It is repo infrastructure, not database | |
| # content — git resolves core.hooksPath relative to the worktree root, | |
| # so it must live there, exactly like .github/ and .claude/ which were | |
| # already allowed. | |
| # | |
| # This became load-bearing when #59 landed .githooks/validate-a2ml.sh and | |
| # validate-k9.sh: those files are tracked on main today, so the next PR | |
| # touching either one is flagged "Misplaced content" and fails the guard. | |
| # | |
| # rsr-template-repo's own root-allow.txt records the identical omission for | |
| # the identical directory — it "failed check-root-shape.sh on this repo | |
| # itself and on every repo instantiated from it". An oversight, not a policy. | |
| ALLOW="$ALLOW"'|^(docs|tests|scripts|\.github|\.githooks|\.claude|\.machine_readable|\.bot_directives|\.well-known|\.hypatia|LICENSES|contractiles)/' | |
| ALLOW="$ALLOW"'|^(flake\.nix|guix\.scm|Justfile|contractile\.just|stapeln\.toml|opsm\.toml|setup\.sh|\.gitignore|\.gitattributes|\.editorconfig|\.gitlab-ci\.yml|\.nojekyll)$' | |
| # Legacy per-database dirs (grandfathered: warn, do not fail — being extracted). | |
| # | |
| # `lithoglyph` was removed from this list on 2026-07-27. Its extraction is | |
| # complete (hyperpolymath/lithoglyph#4) and its 819 files are gone from this | |
| # repo, so a new file under lithoglyph/ is no longer "legacy content not yet | |
| # moved" — it is fresh duplication of a repo that already exists. Warning | |
| # would let exactly the defect the extraction fixed grow back. It now fails. | |
| # | |
| # Move a directory out of this list as each extraction completes. | |
| GRANDFATHER='^(verisimdb|quandledb|nqc|typeql-experimental|verisim-core|verisim-modular-experiment)/' | |
| FAIL=0 | |
| while IFS= read -r f; do | |
| [ -z "$f" ] && continue | |
| if echo "$f" | grep -Eq "$ALLOW"; then | |
| continue | |
| fi | |
| if echo "$f" | grep -Eq "$GRANDFATHER"; then | |
| echo "::warning file=${f}::Added inside a legacy database directory. This content should live in its own repo (see REGISTRY.adoc); these directories are being extracted." | |
| continue | |
| fi | |
| echo "::error file=${f}::Misplaced content. nextgen-databases is a coordination repo — this belongs in a database/language repo. See REGISTRY.adoc." | |
| FAIL=1 | |
| done < /tmp/added.txt | |
| { | |
| echo "## Placement Guard" | |
| echo "" | |
| if [ "$FAIL" -eq 0 ]; then | |
| echo ":white_check_mark: No misplaced new content detected." | |
| else | |
| echo ":x: New files were added outside the allowed coordination paths." | |
| echo "" | |
| echo "\`nextgen-databases\` is a **coordination repo**. Per-database code, schemas," | |
| echo "docs, and query languages belong in their own repos — see \`REGISTRY.adoc\`." | |
| fi | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| exit $FAIL |