38 lines
2 KiB
YAML
38 lines
2 KiB
YAML
|
# Bounded-execution contract tests (NK-WP-0058-T02): net-kingdom against its owners' source.
|
||
|
|
# On push: the owners at the commits in contracts/owner-pins.json. Nightly: the owners' main, so an owner change
|
||
|
|
# that breaks a contract fails here within a day. Owners are anonymous partial clones of public repositories; no
|
||
|
|
# credential is used. rapp-bounded-executor is private and tests itself (open: its CI, NK-WP-0058-T02 result).
|
||
|
|
name: Bounded-execution contracts
|
||
|
|
on:
|
||
|
|
push:
|
||
|
|
branches: [main]
|
||
|
|
paths: ["bounded-executor/**", "tools/**", "tests/**", "contracts/**", "admissions/**", "security-cases/**",
|
||
|
|
"security-case-types/**", "sso-mfa/k8s/bounded-executor/**", "canon/schemas/**",
|
||
|
|
".forgejo/workflows/bounded-execution-contracts.yaml"]
|
||
|
|
schedule:
|
||
|
|
- cron: "23 3 * * *"
|
||
|
|
workflow_dispatch:
|
||
|
|
jobs:
|
||
|
|
contracts:
|
||
|
|
runs-on: ubuntu-latest
|
||
|
|
container:
|
||
|
|
image: python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
|
||
|
|
steps:
|
||
|
|
- name: Source and owners
|
||
|
|
run: |
|
||
|
|
set -eu
|
||
|
|
apt-get update -qq && apt-get install -y -qq --no-install-recommends git ca-certificates >/dev/null
|
||
|
|
mkdir -p ws/net-kingdom
|
||
|
|
python -c 'import os, urllib.request; urllib.request.urlretrieve("https://forgejo.coulomb.social/" + os.environ["GITHUB_REPOSITORY"] + "/archive/" + os.environ["GITHUB_SHA"] + ".tar.gz", "source.tar.gz")'
|
||
|
|
tar xzf source.tar.gz -C ws/net-kingdom --strip-components=1
|
||
|
|
ref=pinned; [ "${GITHUB_EVENT_NAME}" = schedule ] && ref=main
|
||
|
|
python3 ws/net-kingdom/tools/contract-tests/fetch_owners.py --dest ws --ref "$ref"
|
||
|
|
- name: Contract suite
|
||
|
|
run: |
|
||
|
|
set -eu
|
||
|
|
cd ws/net-kingdom
|
||
|
|
python3 -m pip install --no-cache-dir --require-hashes -r bounded-executor/requirements.txt \
|
||
|
|
-r tools/contract-tests/requirements.txt
|
||
|
|
git config --global user.email ci@invalid && git config --global user.name ci
|
||
|
|
bash tools/contract-tests/run.sh
|