ci(layer-b): ruleset payload + RC3 mirror guard (#3) #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ci.yml — quality gate. Required check name: "quality". | |
| # Reproduces the three local sweeps so a green local run means the PR passes | |
| # first time: ruff check -> ruff format --check -> compileall. | |
| name: ci | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| quality: | |
| name: quality | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: "3.12" | |
| # Exact-version pin: determinism + exact CI<->local parity. Bump at instantiation. | |
| - run: python -m pip install --upgrade pip && pip install --group lint --group runtime | |
| # Gate commands: single-sourced in scripts/gates/quality.sh, run | |
| # identically by a contributor (METHOD section 6 "retire le canal" / | |
| # S31). Setup stays in YAML (job-specific); commands live in the script. | |
| - run: bash scripts/gates/quality.sh |