1 files changed, 103 insertions, 2 deletions
diff --git a/mod/mod-ci-github.cxx b/mod/mod-ci-github.cxx
index 394638a..14b3c00 100644
--- a/mod/mod-ci-github.cxx
+++ b/mod/mod-ci-github.cxx
@@ -669,10 +669,111 @@ namespace brep
     //
     // 2. Verify it is completed.
     //
-    // 3. Verify (like in build_built()) that all the check runs are
+    // 3. Verify the check run counts match.
+    //
+    // 4. Verify (like in build_built()) that all the check runs are
     //    completed.
     //
-    // 4. Verify the result matches what GitHub thinks it is (if easy).
+    // 5. Verify the result matches what GitHub thinks it is.
+
+    HANDLER_DIAG;
+
+    l3 ([&]{trace << "check_suite event { " << cs << " }";});
+
+    // Service id that uniquely identifies the CI tenant.
+    //
+    string sid (cs.repository.node_id + ':' + cs.check_suite.head_sha);
+
+    // The common log entry subject.
+    //
+    string sub ("check suite " + cs.check_suite.node_id + '/' + sid);
+
+    // Load the service data.
+    //
+    service_data sd;
+
+    if (optional<tenant_data> d = find (*build_db_, "ci-github", sid))
+    {
+      try
+      {
+        sd = service_data (*d->service.data);
+      }
+      catch (const invalid_argument& e)
+      {
+        fail << "failed to parse service data: " << e;
+      }
+    }
+    else
+    {
+      error << sub << ": tenant_service does not exist";
+      return true;
+    }
+
+    // Verify the completed flag and the number of check runs.
+    //
+    if (!sd.completed)
+    {
+      error << sub << " service data complete flag is false";
+      return true;
+    }
+
+    // Received count will be one higher because we don't store the conclusion
+    // check run.
+    //
+    size_t check_runs_count (sd.check_runs.size () + 1);
+
+    if (check_runs_count == 1)
+    {
+      error << sub << ": no check runs in service data";
+      return true;
+    }
+
+    if (cs.check_suite.check_runs_count != check_runs_count)
+    {
+      error << sub << ": check runs count " << cs.check_suite.check_runs_count
+            << " does not match service data count " << check_runs_count;
+      return true;
+    }
+
+    // Verify that all the check runs are built and compute the summary
+    // conclusion.
+    //
+    result_status conclusion (result_status::success);
+
+    for (const check_run& cr: sd.check_runs)
+    {
+      if (cr.state == build_state::built)
+      {
+        assert (cr.status.has_value ());
+        conclusion |= *cr.status;
+      }
+      else
+      {
+        error << sub << ": unbuilt check run in service data";
+        return true;
+      }
+    }
+
+    // Verify the conclusion.
+    //
+    if (!cs.check_suite.conclusion)
+    {
+      error << sub << ": absent conclusion in completed check suite";
+      return true;
+    }
+
+    // Note that the case mismatch is due to GraphQL (gh_conclusion())
+    // requiring uppercase conclusion values while the received webhook values
+    // are lower case.
+    //
+    string gh_conclusion (gh_to_conclusion (conclusion, warning_success));
+
+    if (icasecmp (*cs.check_suite.conclusion, gh_conclusion) != 0)
+    {
+      error << sub << ": conclusion " << *cs.check_suite.conclusion
+            << " does not match service data conclusion " << gh_conclusion;
+      return true;
+    }
 
     return true;
   }