fix(indexer): enforce vendored system-note action list at build time

Giannis Kepasrequested to merge
gitlab-community/gitlab-org/orbit/knowledge-graph:816-vendor-icon-types into main

What does this MR do and why?

The vendored ICON_TYPES list in icon_types.rs had no real drift guard.

The module comment referenced scripts/check-system-note-actions.sh as the enforcement mechanism, but that script didn't exist.

This MR introduces a two-layer protection, mirroring the Iglu schema pattern:

  1. Build time: config/vendored/system_note_metadata.actions becomes the source of truth (one action per line, pinned SHA in the header).
    crates/indexer/build.rs generates ICON_TYPES from it, so the Rust constant can't drift from the vendor file, it's derived from it.

  2. CI: scripts/check-system-note-actions.sh fetches app/models/system_note_metadata.rb from gitlab-org/gitlab at the pinned SHA and diffs it against the committed vendor file. The new system-note-actions-check lint job runs it on every MR.

Related Issues

N/A

Testing

  • cargo build -p indexer generates icon_types_generated.rs
  • cargo test -p indexer passes all 379 tests
  • Build fails with a clear panic when a duplicate is added to the vendor file.
  • SKIP_SYSTEM_NOTE_ACTIONS_CHECK=1 exits cleanly (shared ci-skip-utils.sh path).
  • Python regex correctly extracts tokens from multiline %w[] and %i[] Ruby arrays.

Performance Analysis

No runtime changes. Build script runs once per vendor-file change.

  • This merge request does not introduce any performance regression.

Closes #816 (closed)

Merge request reports