Add a GitHub Actions workflow for automatic validation of the citation metadata file (CITATION.CFF)

[abelsiqueira]

Hello!

We noticed that your CITATION.cff had a small issue and fixed it.

In addition to the fix, this Pull Request automates validation of that file using the cffconvert GitHub Action. That way, it's a little bit easier to be robust against future changes to the CITATION.cff file.

BTW it's perfectly fine if you don't feel like accepting this Pull Request for whatever reason -- we just thought it might be helpful is all.

We found your repository using a partially automated workflow; if you have any questions about that, feel free to create an issue over at https://github.com/cffbots/filtering/issues/

On behalf of the cffbots team,
@abelsiqueira / @fdiblen / @jspaaks

[DilumAluthge]

1. The persist-credentials: false option should be passed to actions/checkout@v2
2. The GITHUB_TOKEN in this workflow should not have any write permissions. This can be accomplished by setting the appropriate top-level permissions key.

[fredrikekre]

Is it really necessary to have a workflow for a file which is more or less static?

[DilumAluthge]

Agreed; I would prefer that we not add a workflow solely for this file.

[vtjnash]

The way the workflow is written, it only gets triggered precisely when it is needed, so I think that addition is good

[fredrikekre]

Still, it will use some resources for every push to check if this file is in the diff, no?

[abelsiqueira]

Hi @DilumAluthge, I have updated the workflow following your comment. Let me know if this is correct.

[DilumAluthge]

You can further simplify the permissions section. If you specify the permissions you need (e.g. contents: read), and omit all other permissions, the omitted permissions should automatically be set to none, per the GitHub docs here: https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions

[abelsiqueira]

Thanks for the link, @DilumAluthge. I left only contents: read now.

[DilumAluthge]

Currently, this workflow will not be triggered on pull requests that come from forks.

I think the behavior we want is this:

1. If the CITATION.cff file was modified, and this is a pull request, and the base (target) branch of the pull request is either master or release-*, then run the workflow.
2. If the CITATION.cff file was modified, and this is a push to either master or release-*, then run the workflow.
3. Else, do not run the workflow.

I think that the following suggestion implements the above behavior, although it would be good for someone else to double-check.

Suggested change

	on:
	push:
	paths:
	- CITATION.cff
	on:
	push:
	branches:
	- 'master'
	- 'release-*'
	paths:
	- CITATION.cff
	pull_request:
	branches:
	- 'master'
	- 'release-*'
	paths:
	- CITATION.cff

[abelsiqueira]

Hi @DilumAluthge, I have updated the workflow and I made some tests:

• https://github.com/cffbots/julia/actions
• I have pushed to master
• I have created a branch release-no-change-to-cff with no changes to CITATION.cff and it did not trigger the action
• I have created a branch release-change-to-cff with changes to CITATION.cff and it did trigger the action
• I have forked cffbots/julia to abelsiqueira/julia and created 4 PRs:
  • Fork | No change to CFF cffbots/julia#1
  • Fork | Change to CFF cffbots/julia#2
  • Fork | CITATION.cff changed on release-1.7 cffbots/julia#3
  • Fork | Break CITATION.cff cffbots/julia#4

Let me know what you think.

[DilumAluthge]

@abelsiqueira Would you mind making a small separate PR that just has the fix to the CITATION.cff file? That change seems pretty uncontroversial and can be merged quickly.

[abelsiqueira]

Hi @DilumAluthge, I have created #44236 with just the fix. After that PR is merged I will rebase this one.

[DilumAluthge]

Now that #44236 has been merged, can you rebase and squash this PR?

[DilumAluthge]

The question for triage is: should we add the GitHub Actions workflow file for validating this file?

[DilumAluthge]

From a technical point of view, this looks good. Let's see what triage thinks about the idea.

The requested changes have been made.

[abelsiqueira]

I have rebased and squashed the commits.

[vtjnash]

Can you include a small no-op change to CITATION.cff in this PR, so that we can see this trigger and confirm it is working?

[abelsiqueira]

Can you include a small no-op change to CITATION.cff in this PR, so that we can see this trigger and confirm it is working?

I made a new no-op commit, but I don't expect it to run because the action is not part of the master branch yet. (Edit: https://github.com/JuliaLang/julia/actions/runs/1891858073, does not run because it is not part of the repo yet).

Alternatively, look at this earlier comment: #44062 (comment) specifically the cffbots#2 and cffbots#4 PRs.

[JeffBezanson]

From triage: this is cool, but does not really seem warranted for an almost-never-changed file with a single citation in it. But I guess we might as well do it, no real cost?

[vtjnash]

I enabled GitHub-provided and citation-file-format/cffconvert-github-action@2.0.0 actions. Can you push a rebase of this?

[abelsiqueira]

I have rebased it.

[fingolfin]

This looks good to me. I see no downsides: the action is only run when really needed. And yeah the file won't be changed often -- but rare events in my experience will be messed up precisely because they are rare and people forget what to watch out for. So I'd be for merging this.

[IanButterworth]

This branch is quite out of date, so getting CI green isn't worthwhile, but I'm going to merge this without a rebase because:

1. maintainer edits aren't enabled, so updating isn't trivial, and saves asking the OP to do so
2. CITATION.cff is not mentioned in the repo before this, so I can't see how it would fail anything