refactor: isolate harness revocation HTTP routes #315
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Cross-platform package conformance | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| package-host: | |
| name: ${{ matrix.host }} package host | |
| runs-on: ${{ matrix.host }} | |
| timeout-minutes: 45 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| host: | |
| - ubuntu-latest | |
| - macos-latest | |
| - windows-latest | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Configure Node.js | |
| uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: "24.18.0" | |
| package-manager-cache: false | |
| - name: Install pinned npm CLI | |
| shell: bash | |
| run: | | |
| npm install --global npm@12.0.1 --ignore-scripts --no-audit --no-fund | |
| test "$(node --version)" = "v24.18.0" | |
| test "$(npm --version)" = "12.0.1" | |
| - name: Configure uv and Python | |
| uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: | |
| version: "0.11.28" | |
| python-version: "3.13.13" | |
| enable-cache: false | |
| - name: Install Linux Manager sandbox | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y apparmor-profiles apparmor-utils bubblewrap | |
| sudo install -m 0644 \ | |
| /usr/share/apparmor/extra-profiles/bwrap-userns-restrict \ | |
| /etc/apparmor.d/bwrap-userns-restrict | |
| sudo apparmor_parser -r /etc/apparmor.d/bwrap-userns-restrict | |
| test -x /usr/bin/bwrap | |
| test "$(stat -c '%u:%a' /usr/bin/bwrap)" = "0:755" | |
| bwrap --unshare-user --die-with-parent --ro-bind / / /usr/bin/true | |
| - name: Install locked test environment | |
| shell: bash | |
| run: uv sync --frozen --extra test | |
| - name: Verify portable platform contracts | |
| shell: bash | |
| run: | | |
| uv run pytest -q tests/platform/test_host_support.py | |
| node npm/scripts/check-package.mjs | |
| node npm/bin/agentnet.mjs --version | |
| - name: Pack, install, and launch from an unrelated directory | |
| shell: bash | |
| run: | | |
| PACK_DIR="$RUNNER_TEMP/agentnet-pack" | |
| PREFIX="$RUNNER_TEMP/agentnet-prefix" | |
| UNRELATED="$RUNNER_TEMP/agentnet-unrelated" | |
| mkdir -p "$PACK_DIR" "$PREFIX" "$UNRELATED" | |
| PACKED="$(npm pack --ignore-scripts --pack-destination "$PACK_DIR")" | |
| umask 022 | |
| npm install --prefix "$PREFIX" --umask=0022 --ignore-scripts --no-audit --no-fund "$PACK_DIR/$PACKED" | |
| PACKAGE_ROOT="$PREFIX/node_modules/@misunders2d/agentnet" | |
| LAUNCHER="$PACKAGE_ROOT/npm/bin/agentnet.mjs" | |
| cd "$UNRELATED" | |
| node "$LAUNCHER" --version | |
| # Development pushes prove the current source tree without rewriting the | |
| # immutable evidence for the last release. Exact installed-release | |
| # verification remains a separate manual/tag gate below. | |
| - name: Verify current source regression | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: | | |
| uv run pytest -q \ | |
| --ignore=tests/adapters/test_installed_live_inference.py \ | |
| --ignore=tests/conformance/test_release_manifest.py | |
| # macOS and Windows lifecycle qualification remains a separate blocked | |
| # gate, so the installed-runtime journey stays on the proven Linux host. | |
| - name: Verify the packaged journey | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: | | |
| PREFIX="$RUNNER_TEMP/agentnet-prefix" | |
| UNRELATED="$RUNNER_TEMP/agentnet-unrelated" | |
| PORTABLE_RUNTIME="$RUNNER_TEMP/agentnet-portable-runtime" | |
| mkdir -p "$PORTABLE_RUNTIME" | |
| PACKAGE_ROOT="$PREFIX/node_modules/@misunders2d/agentnet" | |
| cd "$UNRELATED" | |
| UV_PROJECT_ENVIRONMENT="$PORTABLE_RUNTIME" uv run \ | |
| --project "$PACKAGE_ROOT" --frozen --no-default-groups \ | |
| --python 3.13.13 python -B -I \ | |
| "$PACKAGE_ROOT/scripts/ci/packaged_v0145_user_journey.py" portable \ | |
| --package-root "$PACKAGE_ROOT" | |
| # This gate intentionally fails when source differs from the immutable | |
| # release manifest or bundled Python artifacts. Run it only for an exact | |
| # release tag or an explicit release-readiness dispatch. | |
| - name: Verify immutable installed-release evidence | |
| if: runner.os == 'Linux' && (github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/')) | |
| shell: bash | |
| run: | | |
| PREFIX="$RUNNER_TEMP/agentnet-prefix" | |
| PACKAGE_ROOT="$PREFIX/node_modules/@misunders2d/agentnet" | |
| node "$PACKAGE_ROOT/npm/bin/agentnet.mjs" verify | |
| - name: Verify immutable recursive packed package and server preflight | |
| if: runner.os == 'Linux' && (github.event_name == 'workflow_dispatch' || startsWith(github.ref, 'refs/tags/')) | |
| shell: bash | |
| run: npm run check:packed | |
| node-compatibility: | |
| name: Ubuntu / Node.js ${{ matrix.node }} compatibility | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - node: "22.19.0" | |
| npm: "10.9.3" | |
| - node: "24.18.0" | |
| npm: "12.0.1" | |
| - node: "26.5.0" | |
| npm: "12.0.1" | |
| steps: | |
| - name: Check out source | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - name: Configure Node.js | |
| uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6 | |
| with: | |
| node-version: ${{ matrix.node }} | |
| package-manager-cache: false | |
| - name: Install pinned npm CLI | |
| shell: bash | |
| run: | | |
| npm install --global npm@${{ matrix.npm }} --ignore-scripts --no-audit --no-fund | |
| test "$(npm --version)" = "${{ matrix.npm }}" | |
| - name: Configure uv and Python | |
| uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: | |
| version: "0.11.28" | |
| python-version: "3.13.13" | |
| enable-cache: false | |
| - name: Install locked dependencies | |
| shell: bash | |
| run: npm ci --ignore-scripts --no-audit --no-fund | |
| - name: Pack, install, and launch compatibility artifact | |
| shell: bash | |
| run: | | |
| test "$(node --version)" = "v${{ matrix.node }}" | |
| node npm/scripts/check-package.mjs | |
| PACK_DIR="$RUNNER_TEMP/agentnet-node-${{ matrix.node }}-pack" | |
| PREFIX="$RUNNER_TEMP/agentnet-node-${{ matrix.node }}-prefix" | |
| UNRELATED="$RUNNER_TEMP/agentnet-node-${{ matrix.node }}-unrelated" | |
| mkdir -p "$PACK_DIR" "$PREFIX" "$UNRELATED" | |
| PACKED="$(npm pack --ignore-scripts --pack-destination "$PACK_DIR")" | |
| umask 022 | |
| npm install --prefix "$PREFIX" --umask=0022 --ignore-scripts --no-audit --no-fund "$PACK_DIR/$PACKED" | |
| cd "$UNRELATED" | |
| node "$PREFIX/node_modules/@misunders2d/agentnet/npm/bin/agentnet.mjs" --version |