fix source-freeze test binary identity #268
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| router: | |
| name: Verification Router | |
| runs-on: ubuntu-latest | |
| outputs: | |
| profile: ${{ steps.route.outputs.profile }} | |
| policy_version: ${{ steps.route.outputs.policy_version }} | |
| policy_digest: ${{ steps.route.outputs.policy_digest }} | |
| changed_files_digest: ${{ steps.route.outputs.changed_files_digest }} | |
| docs: ${{ steps.route.outputs.docs }} | |
| quality: ${{ steps.route.outputs.quality }} | |
| release: ${{ steps.route.outputs.release }} | |
| linux_portability: ${{ steps.route.outputs.linux_portability }} | |
| steps: | |
| - name: Checkout complete change history | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Route affected verification gates | |
| id: route | |
| env: | |
| PLANR_BASE_REVISION: ${{ github.event.pull_request.base.sha || github.event.before || format('{0}^', github.sha) }} | |
| PLANR_HEAD_REVISION: ${{ github.sha }} | |
| run: | | |
| mkdir -p .planr/ci | |
| node scripts/ci-router.mjs route \ | |
| --base "$PLANR_BASE_REVISION" \ | |
| --head "$PLANR_HEAD_REVISION" \ | |
| --github-output "$GITHUB_OUTPUT" \ | |
| --selection-output .planr/ci/selection.json | |
| if [ "$GITHUB_EVENT_NAME" = "workflow_dispatch" ]; then | |
| printf 'docs=false\nquality=false\nrelease=false\nlinux_portability=true\n' >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Save explicit routing evidence | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: verification-selection | |
| path: .planr/ci/selection.json | |
| retention-days: 7 | |
| docs: | |
| name: Documentation | |
| needs: router | |
| if: needs.router.outputs.docs == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Download exact-source selection | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: verification-selection | |
| path: .planr/ci | |
| - name: Set up Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| - name: Enable pinned pnpm | |
| run: corepack enable | |
| - name: Verify deterministic workspace inventory | |
| run: npm run verify:pnpm-workspace | |
| - name: Install workspace dependencies | |
| run: pnpm install --frozen-lockfile | |
| - name: Run selected documentation gates once | |
| run: | | |
| node scripts/verification-runner.mjs run \ | |
| --input .planr/ci/selection.json \ | |
| --head "$GITHUB_SHA" \ | |
| --gates "docs-content,docs-typecheck,docs-lint,docs-build,docs-artifact" \ | |
| --receipt .planr/receipts/docs.json | |
| - name: Replay documented onboarding against this repository | |
| run: pnpm docs:verify-onboarding | |
| - name: Verify agent routes and prompt contracts | |
| run: | | |
| pnpm docs:verify-agent-journey | |
| pnpm docs:verify-agent-landing | |
| pnpm --filter @planr/docs verify:agent-markdown | |
| - name: Verify documented graph semantics against this repository | |
| run: pnpm docs:verify-concepts | |
| - name: Verify public reference coverage and drift | |
| run: pnpm docs:verify-reference | |
| - name: Verify contributor and operations contracts | |
| run: pnpm docs:verify-maintenance | |
| - name: Verify documentation release inventory and links | |
| run: pnpm docs:verify-release | |
| - name: Save exact-source documentation output | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: reviewed-docs-${{ github.sha }} | |
| path: | | |
| apps/docs/out | |
| .planr/ci/selection.json | |
| .planr/receipts/docs.json | |
| compression-level: 0 | |
| retention-days: 7 | |
| quality: | |
| name: Quality Gates | |
| needs: router | |
| if: needs.router.outputs.quality == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust components | |
| run: | | |
| rustup component add rustfmt clippy | |
| - name: Rust format | |
| run: cargo fmt --check | |
| - name: Rust lint | |
| run: cargo clippy --all-targets -- -D warnings | |
| - name: Rust tests | |
| run: cargo test | |
| release-contracts: | |
| name: Release Contracts | |
| needs: router | |
| if: needs.router.outputs.release == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 22 | |
| - name: Install system tools | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y shellcheck | |
| - name: Verify workflow routing and release contracts | |
| run: | | |
| npm run verify:github-actions | |
| npm run verify:release-eval-gate | |
| npm run verify:release-script | |
| shellcheck scripts/*.sh | |
| - name: Release dry-run | |
| run: | | |
| cargo build --release | |
| npm pack --dry-run | |
| node npm/bin/planr.js --version | |
| linux-portability: | |
| name: Portable Linux ${{ matrix.target }} | |
| needs: router | |
| if: needs.router.outputs.linux_portability == 'true' | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: linux-x86_64 | |
| rust_target: x86_64-unknown-linux-musl | |
| runner: ubuntu-24.04 | |
| - target: linux-arm64 | |
| rust_target: aarch64-unknown-linux-musl | |
| runner: ubuntu-24.04-arm | |
| runs-on: ${{ matrix.runner }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Download exact-SHA selection | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: verification-selection | |
| path: .planr/ci | |
| - name: Build and verify on the compatible native host | |
| run: | | |
| node scripts/verification-runner.mjs run-linux-target \ | |
| --target "${{ matrix.target }}" \ | |
| --receipt ".planr/receipts/${{ matrix.target }}.json" \ | |
| --input .planr/ci/selection.json \ | |
| --head "$GITHUB_SHA" | |
| - name: Save exact Linux archive and target receipt | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: portable-${{ matrix.target }} | |
| path: | | |
| dist/planr-${{ matrix.target }}.tar.gz | |
| .planr/receipts/${{ matrix.target }}.json | |
| compression-level: 0 | |
| linux-portability-checksums: | |
| name: Portable Linux aggregate checksums | |
| needs: [router, linux-portability] | |
| if: needs.router.outputs.linux_portability == 'true' && needs.linux-portability.result == 'success' | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout exact source | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Download exact-SHA selection | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| name: verification-selection | |
| path: .planr/ci | |
| - name: Download exact Linux release tarballs | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: portable-linux-* | |
| path: . | |
| merge-multiple: true | |
| - name: Verify both receipts and complete aggregate checksum set | |
| run: | | |
| node scripts/verification-runner.mjs verify-linux-target \ | |
| --receipt .planr/receipts/linux-x86_64.json \ | |
| --input .planr/ci/selection.json \ | |
| --head "$GITHUB_SHA" | |
| node scripts/verification-runner.mjs verify-linux-target \ | |
| --receipt .planr/receipts/linux-arm64.json \ | |
| --input .planr/ci/selection.json \ | |
| --head "$GITHUB_SHA" | |
| test "$(find dist -maxdepth 1 -name 'planr-linux-*.tar.gz' -type f | wc -l)" -eq 2 | |
| cd dist | |
| sha256sum planr-linux-arm64.tar.gz planr-linux-x86_64.tar.gz > SHA256SUMS | |
| sha256sum -c SHA256SUMS | |
| - name: Save exact-SHA native Linux evidence | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: native-linux-receipts-${{ github.sha }} | |
| path: | | |
| dist/planr-linux-x86_64.tar.gz | |
| dist/planr-linux-arm64.tar.gz | |
| dist/SHA256SUMS | |
| .planr/receipts/linux-x86_64.json | |
| .planr/receipts/linux-arm64.json | |
| compression-level: 0 | |
| summary: | |
| name: CI Summary | |
| if: always() | |
| needs: [router, docs, quality, release-contracts, linux-portability-checksums] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout summary verifier | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Require every selected job and intentional skips | |
| run: | | |
| node scripts/ci-router.mjs summary \ | |
| --router-result "${{ needs.router.result }}" \ | |
| --selected "docs=${{ needs.router.outputs.docs }}" \ | |
| --selected "quality=${{ needs.router.outputs.quality }}" \ | |
| --selected "release=${{ needs.router.outputs.release }}" \ | |
| --selected "linux_portability=${{ needs.router.outputs.linux_portability }}" \ | |
| --result "docs=${{ needs.docs.result }}" \ | |
| --result "quality=${{ needs.quality.result }}" \ | |
| --result "release=${{ needs.release-contracts.result }}" \ | |
| --result "linux_portability=${{ needs.linux-portability-checksums.result }}" | |
| - name: Record selected policy identity | |
| env: | |
| PLANR_PROFILE: ${{ needs.router.outputs.profile }} | |
| PLANR_POLICY_VERSION: ${{ needs.router.outputs.policy_version }} | |
| PLANR_POLICY_DIGEST: ${{ needs.router.outputs.policy_digest }} | |
| PLANR_CHANGED_FILES_DIGEST: ${{ needs.router.outputs.changed_files_digest }} | |
| run: | | |
| printf 'profile=%s\npolicy_version=%s\npolicy_digest=%s\nchanged_files_digest=%s\n' \ | |
| "$PLANR_PROFILE" "$PLANR_POLICY_VERSION" "$PLANR_POLICY_DIGEST" "$PLANR_CHANGED_FILES_DIGEST" >> "$GITHUB_STEP_SUMMARY" | |
| - name: Write exact-SHA promotion receipt | |
| if: github.event_name != 'workflow_dispatch' | |
| env: | |
| PLANR_PROFILE: ${{ needs.router.outputs.profile }} | |
| PLANR_POLICY_VERSION: ${{ needs.router.outputs.policy_version }} | |
| PLANR_POLICY_DIGEST: ${{ needs.router.outputs.policy_digest }} | |
| PLANR_CHANGED_FILES_DIGEST: ${{ needs.router.outputs.changed_files_digest }} | |
| PLANR_DOCS_RESULT: ${{ needs.docs.result }} | |
| PLANR_QUALITY_RESULT: ${{ needs.quality.result }} | |
| PLANR_RELEASE_RESULT: ${{ needs.release-contracts.result }} | |
| PLANR_LINUX_RESULT: ${{ needs.linux-portability-checksums.result }} | |
| run: node scripts/write-ci-promotion-receipt.mjs .planr/ci/promotion-receipt.json | |
| - name: Save exact-SHA promotion receipt | |
| if: github.event_name != 'workflow_dispatch' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: release-promotion-${{ github.sha }} | |
| path: .planr/ci/promotion-receipt.json | |
| retention-days: 7 |