Merging branch 'dev' into main for release v(Nelson's Sparrow)

.github/workflows/build-macos-dev.yml

@@ -25,7 +25,20 @@ jobs:
           source .venv2/bin/activate
           python -m pip install --upgrade pip
           pip install -r requirements-macos.txt
-          pip install pyinstaller
+          pip install pyinstaller pytest
+
+      - name: Run pytest from source (skip ui marker)
+        id: pretest
+        continue-on-error: true
+        shell: bash
+        run: |
+          source .venv2/bin/activate
+          python -m pytest analyzer/tests/ -m "not ui" -q --tb=short
+
+      - name: Warn if pre-build pytest failed
+        if: ${{ always() && steps.pretest.outcome == 'failure' }}
+        shell: bash
+        run: echo "::warning::Pre-build pytest failed on macOS dev build; continuing to PyInstaller."
 
       - name: Smoke test CLI from source (repo root, first 2 test images)
         shell: bash
@@ -67,47 +80,76 @@ jobs:
           chmod +x packaging/build_app_headless.sh
           ./packaging/build_app_headless.sh
 
-      - name: Smoke test built executable (first 2 test images)
-        id: smoke_test
+      - name: Run --validate against frozen binary
+        id: validate
         continue-on-error: true
         shell: bash
         run: |
           set -euo pipefail
-          SMOKE_DIR="${RUNNER_TEMP}/kestrel-smoke-input"
-          rm -rf "${SMOKE_DIR}"
-          mkdir -p "${SMOKE_DIR}"
+          VALIDATE_OUTPUT="${RUNNER_TEMP}/validate-result.json"
+          rm -f "${VALIDATE_OUTPUT}"
 
-          # mapfile is unavailable in macOS runner bash (3.2), so use while-read.
-          smoke_imgs=()
-          while IFS= read -r img; do
-            smoke_imgs+=("${img}")
-          done < <(find test_imgs -maxdepth 1 -type f | sort | head -n 2)
-          if [ "${#smoke_imgs[@]}" -lt 2 ]; then
-            echo "Expected at least 2 images in test_imgs/ for smoke test"
+          analyzer/dist/ProjectKestrel/ProjectKestrel \
+            --cli --validate \
+            --validate-images test_imgs \
+            --validate-output "${VALIDATE_OUTPUT}"
+
+          if [ ! -f "${VALIDATE_OUTPUT}" ]; then
+            echo "Frozen --validate did not produce a result JSON"
             exit 1
           fi
+          echo "=== validate-result.json ==="
+          cat "${VALIDATE_OUTPUT}"
 
-          for img in "${smoke_imgs[@]}"; do
-            cp "${img}" "${SMOKE_DIR}/"
-          done
+          # Copy to repo root so upload-artifact finds it.
+          cp "${VALIDATE_OUTPUT}" validate-result.json
+
+          ok=$(python3 -c "import json,sys; print(str(json.load(open('${VALIDATE_OUTPUT}')).get('ok')).lower())")
+          if [ "${ok}" != "true" ]; then
+            echo "Validation reported failure (ok=${ok})"
+            exit 1
+          fi
 
-          analyzer/dist/ProjectKestrel/ProjectKestrel --cli "${SMOKE_DIR}" --no-gpu --parallel-prefetch 1
+      - name: Warn if frozen --validate failed
+        if: ${{ always() && steps.validate.outcome == 'failure' }}
+        shell: bash
+        run: echo "::warning::Frozen-binary --validate failed on macOS dev build; continuing to publish available artifacts."
 
-          META_PATH="${SMOKE_DIR}/.kestrel/kestrel_database.csv"
-          if [ ! -f "${META_PATH}" ]; then
-            echo "Smoke test did not produce kestrel_database.csv"
+      - name: UI probe (real visualizer.html) against frozen binary
+        id: ui_probe
+        continue-on-error: true
+        shell: bash
+        run: |
+          set -euo pipefail
+          UI_PROBE_OUTPUT="${RUNNER_TEMP}/ui-probe-result.json"
+          rm -f "${UI_PROBE_OUTPUT}"
+
+          analyzer/dist/ProjectKestrel/ProjectKestrel \
+            --api-probe \
+            --probe-target visualizer \
+            --probe-output "${UI_PROBE_OUTPUT}" \
+            --probe-timeout 60 \
+            --port 8798
+
+          if [ ! -f "${UI_PROBE_OUTPUT}" ]; then
+            echo "UI probe did not produce a result JSON"
             exit 1
           fi
-          PROCESSED_ROWS=$(( $(wc -l < "${META_PATH}") - 1 ))
-          if [ "${PROCESSED_ROWS}" -lt 2 ]; then
-            echo "Smoke test processed fewer than 2 images (rows=${PROCESSED_ROWS})"
+          echo "=== ui-probe-result.json ==="
+          cat "${UI_PROBE_OUTPUT}"
+
+          cp "${UI_PROBE_OUTPUT}" ui-probe-result.json
+
+          ok=$(python3 -c "import json,sys; print(str(json.load(open('${UI_PROBE_OUTPUT}')).get('ok')).lower())")
+          if [ "${ok}" != "true" ]; then
+            echo "UI probe reported failure (ok=${ok}); visualizer.html did not wire up window.pywebview.api"
             exit 1
           fi
 
-      - name: Warn if smoke test failed
-        if: ${{ always() && steps.smoke_test.outcome == 'failure' }}
+      - name: Warn if UI probe failed
+        if: ${{ always() && steps.ui_probe.outcome == 'failure' }}
         shell: bash
-        run: echo "::warning::Smoke test failed on macOS dev build; continuing to publish available artifacts."
+        run: echo "::warning::Frozen-binary UI probe failed on macOS dev build; visualizer.html did not see window.pywebview.api."
 
       - name: Collect macOS .app
         shell: bash
@@ -131,3 +173,21 @@ jobs:
         with:
           name: macos-dev-app
           path: artifact/
+
+      - name: Upload validate-result.json
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: macos-dev-validate-result
+          path: validate-result.json
+          if-no-files-found: warn
+          retention-days: 14
+
+      - name: Upload ui-probe-result.json
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: macos-dev-ui-probe-result
+          path: ui-probe-result.json
+          if-no-files-found: warn
+          retention-days: 14

.github/workflows/build-macos.yml

@@ -63,6 +63,69 @@ jobs:
             exit 1
           fi
 
+      - name: Generate build attestation
+        id: attestation
+        shell: bash
+        env:
+          SIGNING_SECRET: ${{ secrets.KESTREL_BUILD_SIGNING_SECRET }}
+        run: |
+          set -euo pipefail
+          if [ -z "${SIGNING_SECRET:-}" ]; then
+            echo "::warning::KESTREL_BUILD_SIGNING_SECRET is not set; skipping attestation. This build will be tagged 'legacy' by the API worker."
+            exit 0
+          fi
+          if [ ! -d analyzer ]; then
+            echo "::error::analyzer/ directory is missing — cannot place build_attestation.json"
+            exit 1
+          fi
+
+          # Use python (already installed by setup-python@v5) to keep version-parsing
+          # logic in sync with kestrel_telemetry._read_version. Doing all work in a
+          # single python invocation avoids whitespace-splitting bugs in bash `read`
+          # when the version string contains spaces (e.g. "Nelson's Sparrow").
+          python3 - <<'PY' | tee -a "$GITHUB_OUTPUT"
+          import hashlib, hmac, json, os, time
+
+          def read_version():
+              for cand in ("VERSION.txt", os.path.join("analyzer", "VERSION.txt")):
+                  if not os.path.isfile(cand):
+                      continue
+                  with open(cand, "r", encoding="utf-8") as f:
+                      lines = [l.strip() for l in f if l.strip()]
+                  for line in lines:
+                      if line.lower().startswith("version:"):
+                          return line.split(":", 1)[1].strip()
+                  if len(lines) == 1:
+                      return lines[0]
+              return "unknown"
+
+          version = read_version()
+          sha = os.environ["GITHUB_SHA"]
+          ts = str(int(time.time()))
+          meta = f"{version}|{sha}|{ts}"
+          sig = hmac.new(
+              os.environ["SIGNING_SECRET"].encode("utf-8"),
+              meta.encode("utf-8"),
+              hashlib.sha256,
+          ).hexdigest()
+
+          with open("analyzer/build_attestation.json", "w", encoding="utf-8") as f:
+              json.dump({"meta": meta, "sig": sig}, f, separators=(",", ":"))
+
+          # GITHUB_OUTPUT lines (tee'd by the surrounding bash so they're visible too):
+          print(f"version={version}")
+          print(f"sha={sha}")
+          print(f"ts={ts}")
+          # Diagnostics on stderr so they don't pollute GITHUB_OUTPUT:
+          import sys
+          print(f"Build attestation generated:", file=sys.stderr)
+          print(f"  version : {version}", file=sys.stderr)
+          print(f"  sha     : {sha}", file=sys.stderr)
+          print(f"  ts      : {ts}", file=sys.stderr)
+          print(f"  meta    : {meta}", file=sys.stderr)
+          print(f"  sig     : {sig[:16]}... (truncated)", file=sys.stderr)
+          PY
+
       - name: Run macOS headless build
         shell: bash
         run: |
@@ -263,3 +326,49 @@ jobs:
         with:
           name: macos-bundle
           path: analyzer/dist/ProjectKestrel/
+
+      - name: Register build with worker
+        if: ${{ always() && steps.attestation.outputs.sha != '' }}
+        shell: bash
+        continue-on-error: true
+        env:
+          SIGNING_SECRET: ${{ secrets.KESTREL_BUILD_SIGNING_SECRET }}
+          BUILD_VERSION:  ${{ steps.attestation.outputs.version }}
+          BUILD_SHA:      ${{ steps.attestation.outputs.sha }}
+          BUILD_TS:       ${{ steps.attestation.outputs.ts }}
+        run: |
+          set -euo pipefail
+          if [ -z "${SIGNING_SECRET:-}" ]; then
+            echo "::warning::No signing secret available; skipping build registration."
+            exit 0
+          fi
+
+          # Build JSON via python to avoid quoting headaches when version contains apostrophes.
+          BODY=$(BUILD_VERSION="$BUILD_VERSION" BUILD_SHA="$BUILD_SHA" BUILD_TS="$BUILD_TS" \
+                 RUN_ID="$GITHUB_RUN_ID" ACTOR="$GITHUB_ACTOR" python3 -c '
+          import json, os
+          print(json.dumps({
+              "version": os.environ["BUILD_VERSION"],
+              "sha":     os.environ["BUILD_SHA"],
+              "ts":      os.environ["BUILD_TS"],
+              "run_id":  os.environ["RUN_ID"],
+              "actor":   os.environ["ACTOR"],
+          }))
+          ')
+
+          # --fail makes curl exit non-zero on HTTP errors; --max-time 15 bounds the call.
+          # Capture both stdout and exit code so failure is logged but non-blocking.
+          set +e
+          RESP=$(curl --silent --show-error --fail --max-time 15 \
+            -H "X-Kestrel-Signing-Token: ${SIGNING_SECRET}" \
+            -H "Content-Type: application/json" \
+            --data-raw "${BODY}" \
+            "https://api.projectkestrel.org/api/builds/register" 2>&1)
+          RC=$?
+          set -e
+
+          if [ "$RC" -eq 0 ]; then
+            echo "Build registered with worker: ${RESP}"
+          else
+            echo "::warning::Build registration failed (non-blocking, rc=${RC}): ${RESP}"
+          fi