fix: Ensure build fails if changes are detected while building for linux

Author: sindre-nistad

Makefile

@@ -25,6 +25,12 @@ install:
 	$(PYTHON) -m pip install $(CODE_DIR)
 
 venv:
+ifeq ($(ENFORCE_CLEAN_GIT),true)
+	# Ensure git 'trusts' the directory inside docker
+	git config --global --add safe.directory $(CODE_DIR)
+	$(CODE_DIR)/bin/ensure-clean-working-directory.sh
+
+endif
 	$(PYTHON) -m venv venv
 
 tests: venv

bin/ensure-clean-working-directory.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+readonly ROOT_DIR="$(cd "$(dirname -- "$0")/.." >/dev/null; pwd -P)"
+
+CHANGED_FILES=$(git -C "$ROOT_DIR" status --untracked-files=no --porcelain | wc -l)
+
+if [[ "$CHANGED_FILES" -eq 0 ]]; then
+  echo "Clean working directory"
+else
+  echo "Changes detected" >/dev/stderr
+  git status --untracked-files=no >/dev/stderr
+  exit 1
+fi

compose.yaml

@@ -3,6 +3,7 @@ services:
     image: quay.io/pypa/manylinux2014_x86_64
     environment:
       PYTHON:
+      ENFORCE_CLEAN_GIT: "true"
     volumes:
       # Sharing the entire volume causes the created venv to be broken on the host
 
@@ -32,6 +33,7 @@ services:
       # These are included in the source distribution
       - "./LICENSE.txt:/code/LICENSE.txt"
       - "./README.md:/code/README.md"
+      - "./SECURITY.md:/code/SECURITY.md"
       - "./py.typed:/code/py.typed"
 
       # The build artifacts are stored in these locations