ci: add actionlint and a test-environment guard #899
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| inputs: | |
| ref: | |
| description: "Branch or SHA to run CI on" | |
| required: false | |
| default: "" | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13"] | |
| os: [ubuntu-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]" | |
| - name: Security scan | |
| # --skip-editable: pip-audit resolves the editable install of this package | |
| # against PyPI and fails when the version is not published yet, so without | |
| # it no version-bump PR can ever pass CI. Dependencies are still audited. | |
| # | |
| run: pip install bandit pip-audit && bandit -r src/ -c pyproject.toml && pip-audit --skip-editable | |
| - name: Lint | |
| run: ruff check src/ tests/ | |
| - name: Type check | |
| run: mypy src/cmcp_runtime/ | |
| - name: Test | |
| # Soak tests are intentionally excluded from per-PR CI. | |
| run: pytest tests/unit/ tests/conformance/ tests/integration/ -v --tb=short --cov=src --cov-report=xml | |
| - name: Upload coverage report | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| fail_ci_if_error: false | |
| governance: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install cMCP dependencies | |
| run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]" | |
| - name: Install AGT as isolated CI tooling | |
| run: | | |
| python -m venv .agt-venv | |
| .agt-venv/bin/python -m pip install --upgrade pip "agent-governance-toolkit>=4.1" | |
| .agt-venv/bin/python -m pip install --no-deps -e . | |
| - name: Generate evidence file | |
| run: .agt-venv/bin/python scripts/gen_agt_evidence.py | |
| - name: Verify AGT runtime evidence (isolated) | |
| run: | | |
| set +e | |
| output=$(.agt-venv/bin/agt verify --evidence agt-evidence.json 2>&1) | |
| status=$? | |
| set -e | |
| printf '%s\n' "$output" | |
| printf '%s\n' "$output" | grep -Fq "Runtime Evidence: 6/6 checks passed" | |
| test "$status" -eq 0 || test "$status" -eq 1 | |
| - name: Save attestation JSON | |
| run: | | |
| set +e | |
| .agt-venv/bin/agt --json verify --evidence agt-evidence.json > agt-attestation.json | |
| status=$? | |
| set -e | |
| python -m json.tool agt-attestation.json > /dev/null | |
| test "$status" -eq 0 || test "$status" -eq 1 | |
| - name: Upload governance artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0 | |
| with: | |
| name: agt-governance-${{ github.sha }} | |
| path: | | |
| agt-evidence.json | |
| agt-attestation.json | |
| if-no-files-found: warn | |
| benchmark: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| if: github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install dependencies | |
| run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]" | |
| - name: Run benchmark (software-only, CI gate p99 < 5ms) | |
| run: python -m cmcp_runtime.benchmarks --provider software-only --calls 10000 --out benchmarks/ | |
| - name: Upload benchmark results | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0 | |
| with: | |
| name: benchmark-results | |
| path: benchmarks/ | |
| if-no-files-found: warn |