redteam-gate #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI gate: unit tests + PBT suite, gated on two httpx minor versions. | |
| # Copied from redteam-gate.example.yml and extended per TG2 (tasks 2.3–2.4). | |
| name: redteam-gate | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "0 6 * * 1" # weekly Monday 06:00 UTC | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| httpx-version: ["0.27.*", "0.28.*"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install | |
| run: | | |
| python -m pip install -U pip | |
| pip install -e ".[dev,dashboard,barcodes]" hypothesis | |
| pip install "httpx==${{ matrix.httpx-version }}" | |
| - name: Run test suite | |
| run: python -m pytest -q -W error::ResourceWarning | |
| - name: Run PBT suite | |
| run: python -m pytest tests/pbt/ -q -W error::ResourceWarning | |
| redteam: | |
| runs-on: ubuntu-latest | |
| # Only run the live red-team campaign on schedule or manual dispatch (requires secrets). | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install | |
| run: | | |
| python -m pip install -U pip | |
| pip install -e ".[dev,dashboard,barcodes]" hypothesis | |
| - name: Write config from secrets | |
| env: | |
| ATTACKER_KEY: ${{ secrets.ATTACKER_API_KEY }} | |
| TARGET_KEY: ${{ secrets.TARGET_API_KEY }} | |
| JUDGE_KEY: ${{ secrets.JUDGE_API_KEY }} | |
| run: | | |
| cat > config.toml <<EOF | |
| default_profile = "atk" | |
| [profiles.atk] | |
| protocol = "openai" | |
| base_url = "https://openrouter.ai/api/v1" | |
| api_key = "${ATTACKER_KEY}" | |
| model = "openai/gpt-4o-mini" | |
| [target] | |
| protocol = "openai" | |
| base_url = "https://openrouter.ai/api/v1" | |
| api_key = "${TARGET_KEY}" | |
| model = "${{ vars.TARGET_MODEL }}" | |
| [judge] | |
| protocol = "openai" | |
| base_url = "https://openrouter.ai/api/v1" | |
| api_key = "${JUDGE_KEY}" | |
| model = "openai/gpt-4o-mini" | |
| EOF | |
| - name: Run an auto campaign | |
| run: | | |
| wallbreaker --auto "Run a campaign over the HarmBench cybercrime battery (n=8) and report coverage." --rounds 16 | |
| - name: Gate on findings | |
| run: | | |
| wallbreaker report --html --out report.html # latest run log by default | |
| wallbreaker export --out findings.json --fail-on-finding | |
| - name: Upload report | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: redteam-report | |
| path: | | |
| report.html | |
| findings.json |