fix: harden fixture and demo boundaries #227
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: pytest | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| pytest: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ['3.11', '3.12', '3.13'] | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install | |
| run: | | |
| python -m pip install -r .github/release-build-requirements.txt | |
| python -m pip install -r .github/release-test-requirements.txt | |
| python -m pip install "sclite-core==2.0.1" | |
| python -m pip install --no-build-isolation -e '.[dev]' | |
| - name: Validate public truth | |
| run: python scripts/validate_public_truth.py | |
| - name: Validate release train truth | |
| run: python scripts/validate_release_train_truth.py --local | |
| - name: Validate API stability inventory | |
| run: python scripts/validate_api_stability.py --local | |
| - name: Validate v1 API and schema freeze | |
| run: python scripts/validate_v1_freeze.py | |
| - name: Validate immutable rc1 window history | |
| run: >- | |
| python scripts/validate_rc_window.py | |
| --record docs/rc-window/1.0.0rc1.json --expected-version 1.0.0rc1 | |
| --history-mode | |
| - name: Validate conformance corpus generation | |
| run: python scripts/generate_conformance_corpus.py --check | |
| - name: Validate workflow supply-chain security | |
| run: python scripts/validate_workflow_security.py | |
| - name: Validate v1 security review record | |
| run: python scripts/validate_v1_security_review.py | |
| - name: Validate release-candidate readiness | |
| run: python scripts/validate_release_readiness.py | |
| - name: Ruff | |
| run: python -m ruff check . | |
| - name: Mypy | |
| run: python -m mypy govengine | |
| - name: Mypy stable facade strict | |
| run: >- | |
| python -m mypy --strict --disable-error-code=import-untyped | |
| govengine/v1.py govengine/api.py govengine/approvals.py | |
| govengine/governance.py govengine/governance_decision.py | |
| govengine/governance_trace.py govengine/policy | |
| - name: Test | |
| run: python -m pytest -q | |
| edge-integration: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: '3.13' | |
| - name: Install pinned SCLite edge | |
| run: | | |
| python -m pip install -r .github/release-build-requirements.txt | |
| python -m pip install -r .github/release-test-requirements.txt | |
| python -m pip install "sclite-core @ git+https://github.com/rozmiarD/SCLite.git@66dff5cf7d75059e13db92b553c192caf67c0338" | |
| python -m pip install --no-build-isolation -e '.[dev]' | |
| - name: Test pinned edge integration | |
| run: python -m pytest -q | |
| stack-qualification: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| repository: rozmiarD/SCLite | |
| ref: f7c740f5b06f5121dd3a13e8d66c78c7f8922614 | |
| path: _govstack/sclite | |
| persist-credentials: false | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| repository: rozmiarD/RExecOP | |
| ref: c7c3a44634b00bbcdacd34d0da2fad145d02bdd8 | |
| path: _govstack/rexecop | |
| persist-credentials: false | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| repository: rozmiarD/tecrax | |
| ref: e785209475b4dcce14f90fc47efc0ab39c8d2b80 | |
| path: _govstack/tecrax | |
| persist-credentials: false | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: '3.13' | |
| - name: Exercise the aligned source dependency graph | |
| run: | | |
| python -m venv "$RUNNER_TEMP/govstack-source" | |
| "$RUNNER_TEMP/govstack-source/bin/python" -m pip install \ | |
| "$GITHUB_WORKSPACE/_govstack/sclite" \ | |
| "$GITHUB_WORKSPACE" \ | |
| "$GITHUB_WORKSPACE/_govstack/rexecop" | |
| "$RUNNER_TEMP/govstack-source/bin/python" -m pip check | |
| - name: Qualify exact source candidates and downstream API consumers | |
| run: | | |
| "$RUNNER_TEMP/govstack-source/bin/python" \ | |
| scripts/validate_release_train_truth.py --cross-repo \ | |
| --sclite-root "$GITHUB_WORKSPACE/_govstack/sclite" \ | |
| --rexecop-root "$GITHUB_WORKSPACE/_govstack/rexecop" \ | |
| --tecrax-root "$GITHUB_WORKSPACE/_govstack/tecrax" | |
| "$RUNNER_TEMP/govstack-source/bin/python" \ | |
| scripts/validate_api_stability.py --cross-repo \ | |
| --consumer-root "$GITHUB_WORKSPACE/_govstack/rexecop" \ | |
| --consumer-root "$GITHUB_WORKSPACE/_govstack/tecrax" | |
| package-dry-run: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: '3.13' | |
| - name: Install exact release tooling | |
| run: | | |
| python -m pip install -r .github/release-build-requirements.txt | |
| python -m pip install "sclite-core==2.0.1" | |
| - name: Build exact hosted-runner review artifacts | |
| run: PYTHON=python bash scripts/build_release_artifacts.sh --outdir dist | |
| - name: Prove deterministic source artifacts | |
| run: PYTHON=python bash scripts/reproducible_build_gate.sh | |
| - name: Exercise lifecycle-aware record-only A/B gate | |
| run: PYTHON=python bash scripts/release_ab_repro_gate.sh | |
| - name: Exercise wheel and sdist package smoke | |
| run: PYTHON=python bash scripts/package_smoke.sh | |
| - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: govengine-hosted-runner-review-artifacts | |
| path: dist/* | |
| if-no-files-found: error |