fix: harden phase 8 CI workflow and checks

Co-authored-by: Eriyc <50216491+Eriyc@users.noreply.github.com>

.github/workflows/ci.yml

@@ -7,6 +7,8 @@ on:
 
 jobs:
   test:
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -24,4 +26,6 @@ jobs:
       - uses: actions/checkout@v4
       - uses: bazel-contrib/setup-bazel@0.15.0
       - name: Run tests (${{ matrix.phase8_target }})
-        run: bazel test //tests/...
+        run: |
+          echo "Phase 8 target: ${{ matrix.phase8_target }}"
+          bazel test //tests/...

tests/ci_test/phase8_ci_matrix_shape_test.sh

@@ -2,12 +2,26 @@
 set -euo pipefail
 
 workflow_file="$1"
+if [ -z "${workflow_file}" ]; then
+  echo "Error: workflow file path required as first argument" >&2
+  exit 1
+fi
 
-grep -Eq '^name:[[:space:]]+CI$' "${workflow_file}"
+check_pattern() {
-grep -Eq 'USE_BAZEL_VERSION:[[:space:]]+9\.0\.0' "${workflow_file}"
+  local pattern="$1"
-grep -Eq 'os:[[:space:]]+ubuntu-latest' "${workflow_file}"
+  local message="$2"
-grep -Eq 'phase8_target:[[:space:]]+linux-x64' "${workflow_file}"
+  if ! grep -Eq "${pattern}" "${workflow_file}"; then
-grep -Eq 'os:[[:space:]]+macos-14' "${workflow_file}"
+    echo "Error: ${message}" >&2
-grep -Eq 'phase8_target:[[:space:]]+darwin-arm64' "${workflow_file}"
+    exit 1
-grep -Eq 'os:[[:space:]]+windows-latest' "${workflow_file}"
+  fi
-grep -Eq 'phase8_target:[[:space:]]+windows' "${workflow_file}"
+}
+
+check_pattern '^name:[[:space:]]+CI$' "missing workflow name CI"
+check_pattern 'USE_BAZEL_VERSION:[[:space:]]+9\.0\.0' "missing Bazel 9.0.0 pin"
+check_pattern 'os:[[:space:]]+ubuntu-latest' "missing ubuntu matrix entry"
+check_pattern 'phase8_target:[[:space:]]+linux-x64' "missing linux-x64 matrix target"
+check_pattern 'os:[[:space:]]+macos-14' "missing macos matrix entry"
+check_pattern 'phase8_target:[[:space:]]+darwin-arm64' "missing darwin-arm64 matrix target"
+check_pattern 'os:[[:space:]]+windows-latest' "missing windows matrix entry"
+check_pattern 'phase8_target:[[:space:]]+windows' "missing windows matrix target"
+echo "CI matrix shape checks passed"