FilesExpand file tree

v8

/

ci.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

129 lines (105 loc) · 4.39 KB

v8

/

ci.yml

Copy path

Top

File metadata and controls

• Code
• Blame

129 lines (105 loc) · 4.39 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

name: CI

on:

push:

branches: ["v1", "v2", "v3", "v4", "v5", "v6", "v7", "v8", "main"]

pull_request:

branches: ["v1", "v2", "v3", "v4", "v5", "v6", "v7", "v8", "main"]

workflow_dispatch:

jobs:

skillgen-check:

# Fast lint-style guard: the skill files under graphify/ are generated from

# the fragments in tools/skillgen/. This fails if someone hand-edited a

# generated file or forgot to re-run the generator and bless expected/, and it

# runs the build-time validators that guard per-host coverage, the file_type

# enum, the monolith round-trips, and the always-on round-trips.

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@v6

with:

# The audit-coverage, monolith-roundtrip, and always-on-roundtrip

# validators read blobs from origin/v8. A shallow checkout omits that

# ref, so fetch the full history here and the validators run for real

# (rather than skipping). The other jobs stay shallow.

fetch-depth: 0

- name: Install uv

uses: astral-sh/setup-uv@v8.1.0

with:

python-version: "3.12"

# --frozen keeps uv from re-resolving and rewriting uv.lock as a side

# effect of `uv run`; the lock is committed and must not churn in CI.

- name: Check generated skill artifacts are up to date

run: uv run --frozen python -m tools.skillgen --check

- name: Audit per-host v8 coverage

run: uv run --frozen python -m tools.skillgen --audit-coverage

- name: Check the file_type enum is a singleton

run: uv run --frozen python -m tools.skillgen --schema-singleton

- name: Round-trip the monoliths against v8

run: uv run --frozen python -m tools.skillgen --monolith-roundtrip

- name: Round-trip the always-on blocks against v8

run: uv run --frozen python -m tools.skillgen --always-on-roundtrip

test:

runs-on: ubuntu-latest

strategy:

matrix:

python-version: ["3.10", "3.12", "3.13", "3.14"]

steps:

- uses: actions/checkout@v6

with:

# test_skillgen.py reads pre-split skill bodies from the immutable

# baseline commit via `git show`; a shallow checkout omits that history

# and the baseline tests fail. Full history mirrors the skillgen-check job.

fetch-depth: 0

- name: Install uv

uses: astral-sh/setup-uv@v8.1.0

with:

python-version: ${{ matrix.python-version }}

# --frozen installs straight from the committed uv.lock without re-resolving

# or rewriting it, so CI never churns the lock.

- name: Install dependencies

run: uv sync --all-extras --frozen

- name: Run tests

run: uv run --frozen pytest tests/ -q --tb=short

- name: Verify install works end-to-end

run: |

uv run --frozen graphify --help

uv run --frozen graphify install

pi-guard:

# tests/pi.test.ts loads the real extension (Node built-ins only, no

# node_modules, as when installed) against the real installed Python CLI.

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@v6

- name: Install uv

uses: astral-sh/setup-uv@v8.1.0

with:

python-version: "3.12"

- name: Install bun

uses: oven-sh/setup-bun@v2

with:

bun-version: 1.4.0

- name: Install dependencies

run: uv sync --frozen

- name: Run Pi guard tests

run: GRAPHIFY_TEST_CLI=$PWD/.venv/bin/graphify bun test tests/pi.test.ts

security-scan:

# The dev deps include bandit and pip-audit. Run them in CI so a new

# HIGH-severity finding or vulnerable dependency is caught on the PR that

# introduces it, rather than at the next manual audit.

# Non-blocking for now (continue-on-error) to avoid breaking CI on

# pre-existing findings; remove continue-on-error after the initial

# cleanup pass.

runs-on: ubuntu-latest

steps:

- uses: actions/checkout@v6

- name: Install uv

uses: astral-sh/setup-uv@v8.1.0

with:

python-version: "3.12"

- name: Install dependencies

run: uv sync --frozen

- name: bandit (static security analysis)

continue-on-error: true

run: uv run --frozen bandit -r graphify -ll

- name: pip-audit (dependency vulnerabilities)

continue-on-error: true

run: uv run --frozen pip-audit --strict