net-kingdom/.forgejo/workflows/identity-journeys.yaml

name: Identity provider journey acceptance
on:
  push:
    branches: [main]
    paths: ["identity-provisioner/**", "sso-mfa/k8s/synthetic-journey/**", "bounded-executor/**", "tools/bounded-execution-admission/**", "examples/bounded-execution-admission/**", ".forgejo/workflows/identity-journeys.yaml"]
  workflow_dispatch:
jobs:
  provider:
    runs-on: ubuntu-latest
    container:
      image: python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
    steps:
      - name: Run provider and directory-contract tests
        run: |
          set -eu
          mkdir -p identity-source
          python -c 'import os, urllib.request; urllib.request.urlretrieve("https://forgejo.coulomb.social/" + os.environ["GITHUB_REPOSITORY"] + "/archive/" + os.environ["GITHUB_SHA"] + ".tar.gz", "identity-source.tar.gz")'
          tar xzf identity-source.tar.gz -C identity-source --strip-components=1
          cd identity-source
          PYTHONDONTWRITEBYTECODE=1 PYTHONPATH=identity-provisioner python3 -m unittest discover -s identity-provisioner/tests -v
      - name: Run synthetic MFA journey runner tests (NK-WP-0056-T05)
        run: |
          set -eu
          cd identity-source/sso-mfa/k8s/synthetic-journey
          PYTHONDONTWRITEBYTECODE=1 python3 -m unittest test_journey test_lane -v
      - name: Run bounded executor tests (NK-WP-0056-T11..T13)
        run: |
          set -eu
          cd identity-source
          python3 -m pip install --no-cache-dir --require-hashes -r bounded-executor/requirements.txt
          PYTHONDONTWRITEBYTECODE=1 python3 -m unittest discover -s bounded-executor/tests -v