#!/bin/bash
set -euo pipefail

# Locate and print the relevant workflow section with line numbers
ls -la .github/workflows/auto-release.yaml
sed -n '1,120p' .github/workflows/auto-release.yaml | nl -ba

#!/bin/bash
set -euo pipefail

sed -n '1,120p' .github/workflows/auto-release.yaml | cat -n

#!/bin/bash
set -euo pipefail

sed -n '1,120p' .github/workflows/auto-release.yaml | cat -n

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/labels.yaml"
echo "== File = $FILE =="
ls -la "$FILE" || true

echo
echo "== Lines around 70-95 =="
nl -ba "$FILE" | sed -n '70,100p'

echo
echo "== Find all checkout steps in this workflow =="
rg -n "uses:\s*actions/checkout@" "$FILE" || true

echo
echo "== Show surrounding block for each checkout step =="
rg -n "uses:\s*actions/checkout@" "$FILE" | cut -d: -f1 | while read -r ln; do
  start=$((ln-8))
  end=$((ln+12))
  echo
  echo "--- checkout context at line $ln ($start-$end) ---"
  nl -ba "$FILE" | sed -n "${start},${end}p"
done

echo
echo "== Check sync job permissions and checkout persist-credentials settings =="
python3 - <<'PY'
import re, pathlib
p = pathlib.Path(".github/workflows/labels.yaml")
txt = p.read_text()
# Very lightweight parse: find "sync:" job block region by indentation
lines = txt.splitlines()
# locate "sync:" line
for i,l in enumerate(lines, start=1):
    if re.match(r'^\s*sync:\s*$', l):
        start=i
        # block ends when indentation <= that of 'sync:' (2 spaces typically for jobs: children)
        indent=len(l)-len(l.lstrip(' '))
        j=i
        while j < len(lines):
            nl=len(lines[j])-len(lines[j].lstrip(' '))
            if nl<=indent and re.match(r'^\s*\w', lines[j]) and not re.match(r'^\s*sync:\s*$', lines[j]):
                break
            j+=1
        block="\n".join(lines[start-1:j])
        print("== sync job block (approx lines %d-%d) =="%(start,j))
        print(block)
        break
else:
    print("sync job not found by exact 'sync:' match")
PY

#!/bin/bash
set -euo pipefail

FILE=".github/workflows/labels.yaml"
python3 - <<'PY'
import pathlib, re
p = pathlib.Path(".github/workflows/labels.yaml")
lines = p.read_text().splitlines()

def show(start, end):
    for i in range(start, min(end, len(lines)) + 1):
        print(f"{i:>4}: {lines[i-1]}")

print("== Lines 75-90 ==")
show(75, 90)

print("\n== All checkout steps ==");
pat = re.compile(r"^\s*-\s*uses:\s*actions/checkout@([0-9a-fA-F]{40})")
checkout_lines = [i for i,l in enumerate(lines, start=1) if pat.search(l)]
print("checkout line numbers:", checkout_lines)

for ln in checkout_lines:
    start = max(ln-8, 1)
    end = min(ln+12, len(lines))
    print(f"\n--- checkout context at line {ln} (SHA={pat.search(lines[ln-1]).group(1)}) ---")
    show(start, end)

print("\n== Attempt to extract `sync` job block & its permissions/checkout config ==");
# Simple indentation-based extraction:
sync_start = None
for i,l in enumerate(lines, start=1):
    if re.match(r"^\s*sync:\s*$", l):
        sync_start = i
        sync_indent = len(l) - len(l.lstrip(' '))
        break

if sync_start is None:
    print("No `sync:` job found.")
    raise SystemExit(0)

# Find end of block: first line with indentation <= sync_indent and starting a new top-level key
j = sync_start
while j <= len(lines):
    l = lines[j-1]
    indent = len(l) - len(l.lstrip(' '))
    if j > sync_start and indent <= sync_indent and re.match(r"^\s*\w", l):
        break
    j += 1

block = lines[sync_start-1:j-1]
print(f"sync job approx lines {sync_start}-{j-1}")

# Extract permissions section lines within sync block
perm_block = []
in_perm = False
perm_indent = None
for idx, l in enumerate(block, start=sync_start):
    if re.match(r"^\s*permissions:\s*$", l):
        in_perm = True
        perm_indent = len(l) - len(l.lstrip(' '))
        perm_block.append((idx, l))
        continue
    if in_perm:
        indent = len(l) - len(l.lstrip(' '))
        if indent <= perm_indent and re.match(r"^\s*\w", l):
            in_perm = False
            continue
        perm_block.append((idx,l))

if perm_block:
    print("\n-- sync permissions block --")
    for idx,l in perm_block:
        print(f"{idx:>4}: {l}")
else:
    print("\nNo `sync` permissions block found.")

# Find checkout inside sync block
sync_checkout = []
for idx in range(sync_start, j):
    l = lines[idx-1]
    if re.search(r"uses:\s*actions/checkout@", l):
        sync_checkout.append(idx)

print("\ncheckout steps inside sync job (line numbers):", sync_checkout)
for ln in sync_checkout:
    start=max(ln-6,1); end=min(ln+14,len(lines))
    print(f"\n--- sync checkout context at line {ln} ---")
    show(start,end)

# Check persist-credentials anywhere near checkout lines
for ln in sync_checkout:
    window = lines[max(ln-2,1)-1:min(ln+8,len(lines))]
    txt = "\n".join(window)
    if "persist-credentials:" in txt:
        print(f"persist-credentials present near line {ln}")
        # show exact line(s)
        for k in range(max(ln-2,1), min(ln+8,len(lines))+1):
            if "persist-credentials" in lines[k-1]:
                print(f"  {k:>4}: {lines[k-1]}")
    else:
        print(f"persist-credentials NOT present near line {ln}")
PY

#!/bin/bash
# Check all checkout SHAs used across workflows
echo "=== actions/checkout versions in workflows ==="
rg -n "uses:\s*actions/checkout@" .github/workflows/ | sort