security: pin remaining floating action tags and add Dependabot (#8) #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Engine composition test | |
| # Proves the REAL SpawnRunTaskOperator drives a task end-to-end against the | |
| # Substrate AWS emulator — no real AWS, no cost, no workload execution. Real | |
| # op.execute() → real `spawn task run` + real `aws s3` staging vs. Substrate → | |
| # completion record → exit code → return (success) / AirflowException (failure). | |
| # Substrate serves the completion as a seedable, clock-aware outcome | |
| # (substrate#360); unseeded ⇒ exit 0, a seeded nonzero drives the failure path. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| env: | |
| # v0.75.0 was the first release with seedable task-completion (substrate#360); | |
| # v0.85.0 keeps that contract byte-identical (verified locally: POST/DELETE | |
| # /v1/spawn/task-completion with the same snake_case payload, and both TESTs | |
| # below pass unchanged) and adds the S3 and error-code fidelity fixes this | |
| # test's staging step exercises (substrate#391, #392, #396, #398, #399, #406). | |
| # v0.85.0 specifically fixes substrate#457 — HeadObject now resolves a | |
| # synthesized completion, so HEAD and GET agree. This test doesn't depend on | |
| # that (spawn's fetchCompletion calls GetObject directly), but `aws s3 cp` on a | |
| # completion record only works from v0.85.0 on, so don't reach for it below a | |
| # pin that has it. | |
| SUBSTRATE_VERSION: v0.85.0 | |
| SPAWN_VERSION: 0.95.0 | |
| jobs: | |
| composition: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - name: Setup Go (for the Substrate emulator) | |
| uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 | |
| with: | |
| go-version: '1.26' | |
| - name: Install + start Substrate | |
| run: | | |
| go install github.com/scttfrdmn/substrate/cmd/substrate@${SUBSTRATE_VERSION} | |
| "$(go env GOPATH)/bin/substrate" server > /tmp/substrate.log 2>&1 & | |
| for i in $(seq 1 30); do | |
| curl -fsS http://localhost:4566/health >/dev/null 2>&1 && { echo "substrate up"; break; } | |
| sleep 1 | |
| done | |
| curl -fsS http://localhost:4566/health | |
| - name: Install the spawn CLI (release binary) | |
| run: | | |
| curl -fsSL -o /tmp/spawn.tgz \ | |
| "https://github.com/spore-host/spawn/releases/download/v${SPAWN_VERSION}/spawn_${SPAWN_VERSION}_linux_amd64.tar.gz" | |
| tar -xzf /tmp/spawn.tgz -C /tmp | |
| sudo install /tmp/spawn /usr/local/bin/spawn | |
| spawn version | head -1 || true | |
| - name: Setup Python + install Airflow + adapter | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: '3.11' | |
| - run: pip install --quiet apache-airflow -e . | |
| - name: Run engine composition test (Substrate, no AWS) | |
| env: | |
| AWS_ENDPOINT_URL: http://localhost:4566 | |
| run: python tests/composition/composition_test.py |