# Bounded-execution contract tests (NK-WP-0058-T02): net-kingdom against its owners' source.
# On push: the owners at the commits in contracts/owner-pins.json. Nightly: the owners' main, so an owner change
# that breaks a contract fails here within a day. Owners are anonymous partial clones of public repositories; no
# credential is used. rapp-bounded-executor is private and tests itself (open: its CI, NK-WP-0058-T02 result).
name: Bounded-execution contracts
on:
  push:
    branches: [main]
    paths: ["bounded-executor/**", "tools/**", "tests/**", "contracts/**", "admissions/**", "security-cases/**",
            "security-case-types/**", "sso-mfa/k8s/bounded-executor/**", "canon/schemas/**",
            ".forgejo/workflows/bounded-execution-contracts.yaml"]
  schedule:
    - cron: "23 3 * * *"
  workflow_dispatch:
jobs:
  contracts:
    runs-on: ubuntu-latest
    container:
      image: python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
    steps:
      - name: Source and owners
        run: |
          set -eu
          apt-get update -qq && apt-get install -y -qq --no-install-recommends git ca-certificates >/dev/null
          mkdir -p ws/net-kingdom
          python -c 'import os, urllib.request; urllib.request.urlretrieve("https://forgejo.coulomb.social/" + os.environ["GITHUB_REPOSITORY"] + "/archive/" + os.environ["GITHUB_SHA"] + ".tar.gz", "source.tar.gz")'
          tar xzf source.tar.gz -C ws/net-kingdom --strip-components=1
          ref=pinned; [ "${GITHUB_EVENT_NAME}" = schedule ] && ref=main
          python3 ws/net-kingdom/tools/contract-tests/fetch_owners.py --dest ws --ref "$ref"
      - name: Contract suite
        run: |
          set -eu
          cd ws/net-kingdom
          python3 -m pip install --no-cache-dir --require-hashes -r bounded-executor/requirements.txt \
            -r tools/contract-tests/requirements.txt
          git config --global user.email ci@invalid && git config --global user.name ci
          bash tools/contract-tests/run.sh