tegwick
de7d1f35a6
All checks were successful
Bounded-execution contracts / contracts (push) Successful in 2m36s
Build and Publish bounded-executor / build-and-push (push) Successful in 16s
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
Identity provider journey acceptance / provider (push) Successful in 24s
contracts/owner-pins.json pins six public owners; tools/contract-tests/fetch_owners.py partial-clones them anonymously (pinned on push, main nightly). tools/contract-tests/run.sh is the one suite list (make contract-test, CI) and fails when any test skips. New: readiness against real owner source, replaying both 2026-11-04 states from informed-decision history. pytest pinned by PyPI-checked hashes. test_approval_request no longer hard-codes /home/worsch/informed-decision. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 943911@bnt-lap001 Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
37 lines
2 KiB
YAML
37 lines
2 KiB
YAML
# Bounded-execution contract tests (NK-WP-0058-T02): net-kingdom against its owners' source.
|
|
# On push: the owners at the commits in contracts/owner-pins.json. Nightly: the owners' main, so an owner change
|
|
# that breaks a contract fails here within a day. Owners are anonymous partial clones of public repositories; no
|
|
# credential is used. rapp-bounded-executor is private and tests itself (open: its CI, NK-WP-0058-T02 result).
|
|
name: Bounded-execution contracts
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
paths: ["bounded-executor/**", "tools/**", "tests/**", "contracts/**", "admissions/**", "security-cases/**",
|
|
"security-case-types/**", "sso-mfa/k8s/bounded-executor/**", "canon/schemas/**",
|
|
".forgejo/workflows/bounded-execution-contracts.yaml"]
|
|
schedule:
|
|
- cron: "23 3 * * *"
|
|
workflow_dispatch:
|
|
jobs:
|
|
contracts:
|
|
runs-on: ubuntu-latest
|
|
container:
|
|
image: python:3.12-slim@sha256:d764629ce0ddd8c71fd371e9901efb324a95789d2315a47db7e4d27e78f1b0e9
|
|
steps:
|
|
- name: Source and owners
|
|
run: |
|
|
set -eu
|
|
apt-get update -qq && apt-get install -y -qq --no-install-recommends git ca-certificates >/dev/null
|
|
mkdir -p ws/net-kingdom
|
|
python -c 'import os, urllib.request; urllib.request.urlretrieve("https://forgejo.coulomb.social/" + os.environ["GITHUB_REPOSITORY"] + "/archive/" + os.environ["GITHUB_SHA"] + ".tar.gz", "source.tar.gz")'
|
|
tar xzf source.tar.gz -C ws/net-kingdom --strip-components=1
|
|
ref=pinned; [ "${GITHUB_EVENT_NAME}" = schedule ] && ref=main
|
|
python3 ws/net-kingdom/tools/contract-tests/fetch_owners.py --dest ws --ref "$ref"
|
|
- name: Contract suite
|
|
run: |
|
|
set -eu
|
|
cd ws/net-kingdom
|
|
python3 -m pip install --no-cache-dir --require-hashes -r bounded-executor/requirements.txt \
|
|
-r tools/contract-tests/requirements.txt
|
|
git config --global user.email ci@invalid && git config --global user.name ci
|
|
bash tools/contract-tests/run.sh
|