Enforce v1.0.0 validation and coverage gates

.github/workflows/ci.yml

@@ -0,0 +1,160 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    name: Quality
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install project and development tooling
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[dev]"
+
+      - name: Lint shipped Python and tests
+        run: flake8 micro src scripts tests
+
+      - name: Run tests with branch coverage
+        run: coverage run --branch --source=micro,src,scripts -m pytest
+        env:
+          PYTHONPATH: src:.
+
+      - name: Report and enforce per-file coverage
+        run: |
+          coverage report -m
+          coverage json --pretty-print -o coverage.json
+          python scripts/check_coverage.py coverage.json
+
+      - name: Build and validate release OTA candidate
+        run: |
+          version="$(python -c 'import json; print(json.load(open("docs/release-validation.json"))["candidate_version"])')"
+          python scripts/build_ota_bundle.py \
+            --version "$version" \
+            --output candidate-assets/bambutton-ota.json
+          python - <<'PY'
+          import json
+          from pathlib import Path
+
+          from micro import ota_manager
+
+          path = Path("candidate-assets/bambutton-ota.json")
+          raw = path.read_bytes()
+          max_bytes = getattr(ota_manager, "MAX_BUNDLE_BODY_BYTES", 96 * 1024)
+          if len(raw) > max_bytes:
+              raise SystemExit("OTA bundle is {} bytes; limit is {}".format(len(raw), max_bytes))
+          ota_manager.validate_bundle(json.loads(raw))
+          print("Validated OTA bundle: {} bytes".format(len(raw)))
+          PY
+
+      - name: Upload OTA release candidate
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-candidate-ota
+          path: candidate-assets/bambutton-ota.json
+
+      - name: Build wheel and source distribution
+        run: python -m build
+
+      - name: Smoke-test installed wheel resources
+        run: |
+          python -m pip install --force-reinstall --no-deps dist/*.whl
+          python scripts/smoke_installed_package.py
+
+      - name: Smoke-test installed source distribution resources
+        run: |
+          python -m pip install --no-build-isolation --force-reinstall --no-deps dist/*.tar.gz
+          python scripts/smoke_installed_package.py
+
+      - name: Upload per-file coverage report
+        uses: actions/upload-artifact@v4
+        with:
+          name: python-coverage
+          path: coverage.json
+
+  desktop-smoke:
+    name: Desktop smoke (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Install project and desktop build tooling
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install ".[dev]"
+
+      - name: Build and install wheel
+        run: |
+          python -m build --wheel
+          python -c "import glob, subprocess, sys; wheels = glob.glob('dist/*.whl'); assert len(wheels) == 1, wheels; subprocess.check_call([sys.executable, '-m', 'pip', 'install', '--force-reinstall', '--no-deps', wheels[0]])"
+
+      - name: Smoke-test installed setup tool
+        run: python -m bambutton --self-test
+
+      - name: Build desktop application
+        run: python scripts/build_gui.py
+
+      - name: Smoke-test Windows application
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: .\dist\Bambutton.exe --self-test
+
+      - name: Package Windows release candidate
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: Compress-Archive -Path dist/Bambutton.exe -DestinationPath dist/Bambutton-windows.zip -Force
+
+      - name: Upload Windows release candidate
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main' && runner.os == 'Windows'
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-candidate-windows
+          path: dist/Bambutton-windows.zip
+
+      - name: Smoke-test macOS application
+        if: runner.os == 'macOS'
+        run: dist/Bambutton.app/Contents/MacOS/Bambutton --self-test
+
+      - name: Package macOS release candidate
+        if: runner.os == 'macOS'
+        run: ditto -c -k --keepParent dist/Bambutton.app dist/Bambutton-macos.zip
+
+      - name: Upload macOS release candidate
+        if: github.event_name == 'push' && github.ref == 'refs/heads/main' && runner.os == 'macOS'
+        uses: actions/upload-artifact@v4
+        with:
+          name: release-candidate-macos
+          path: dist/Bambutton-macos.zip