chore(ci): report gate result as ci-ok/ci-fail tags + scripts/ci-status.sh

scripts/ci-status.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Report whether the `gates` workflow has finished for a commit, using only
+# git against the remote (no SSH to the runner box, no API tokens).
+#
+# `.gitea/workflows/lint.yml` pushes a lightweight tag `ci-ok/<sha>` when the
+# gates pass and `ci-fail/<sha>` when they fail. This script reads those tags
+# with `git ls-remote`.
+#
+# Usage:
+#   scripts/ci-status.sh [<sha>]          # one-shot check (default: current HEAD)
+#   scripts/ci-status.sh --wait [<sha>]   # poll until done (max 10 min)
+#
+# Exit codes: 0 = green, 1 = red, 2 = still running / not reported.
+set -euo pipefail
+
+REMOTE="${CI_STATUS_REMOTE:-origin}"
+INTERVAL=10
+TIMEOUT=600
+
+sha="${1:-}"
+if [ "$sha" = "--wait" ]; then
+    wait=1
+    sha="${2:-}"
+fi
+[ -n "$sha" ] || sha="$(git rev-parse HEAD)"
+
+check() {
+    local ok="" fail=""
+    ok="$(git ls-remote "$REMOTE" "refs/tags/ci-ok/$sha" | awk '{print $1}')"
+    fail="$(git ls-remote "$REMOTE" "refs/tags/ci-fail/$sha" | awk '{print $1}')"
+    if [ -n "$ok" ]; then
+        echo "GREEN — gates passed for $sha ($ok)"
+        return 0
+    fi
+    if [ -n "$fail" ]; then
+        echo "RED — gates failed for $sha ($fail)"
+        return 1
+    fi
+    echo "PENDING — no gate result yet for $sha"
+    return 2
+}
+
+if [ "${wait:-0}" -ne 1 ]; then
+    if check; then
+        exit 0
+    else
+        rc=$?
+        exit "$rc"
+    fi
+fi
+
+deadline=$((SECONDS + TIMEOUT))
+while :; do
+    out="$(check 2>&1)" && { echo "$out"; exit 0; }
+    rc=$?
+    if [ "$rc" -eq 1 ]; then
+        echo "$out"
+        exit 1
+    fi
+    if (( SECONDS >= deadline )); then
+        echo "TIMEOUT after ${TIMEOUT}s — no gate result for $sha"
+        exit 2
+    fi
+    sleep "$INTERVAL"
+done