tegwick
e3681150d9
Some checks failed
Governed runtime contract / contract (push) Failing after 10s
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9
71 lines
3.4 KiB
YAML
71 lines
3.4 KiB
YAML
name: Governed runtime contract
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
contract:
|
|
runs-on: self-hosted
|
|
steps:
|
|
# The Railiance host runner does not support actions/checkout. Clone the
|
|
# exact pushed revision and the source revisions declared by the lock.
|
|
- name: Verify pinned cross-package runtime
|
|
env:
|
|
FORGE_BASE: ${{ github.server_url }}
|
|
REPO_NAME: ${{ github.repository }}
|
|
REPO_SHA: ${{ github.sha }}
|
|
UV_VERSION: "0.8.0"
|
|
UV_X86_64_SHA256: "0208cbcb3850bfc69277c9a16c2b0399218b075dc923aca7e4b576ee4228c570"
|
|
run: |
|
|
set -eu
|
|
work_dir="$(mktemp -d /tmp/rein-contract.XXXXXX)"
|
|
trap 'rm -rf "${work_dir}"' EXIT
|
|
|
|
download() {
|
|
if command -v curl >/dev/null 2>&1; then
|
|
curl -fsSL "$1" -o "$2"
|
|
elif command -v wget >/dev/null 2>&1; then
|
|
wget -qO "$2" "$1"
|
|
else
|
|
echo "curl or wget is required to bootstrap uv" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
case "$(uname -m)" in
|
|
x86_64|amd64) uv_target="x86_64-unknown-linux-musl" ;;
|
|
*) echo "unsupported contract-runner architecture: $(uname -m)" >&2; exit 1 ;;
|
|
esac
|
|
uv_archive="${work_dir}/uv.tar.gz"
|
|
download \
|
|
"https://github.com/astral-sh/uv/releases/download/${UV_VERSION}/uv-${uv_target}.tar.gz" \
|
|
"${uv_archive}"
|
|
printf '%s %s\n' "${UV_X86_64_SHA256}" "${uv_archive}" | sha256sum -c -
|
|
tar -xzf "${uv_archive}" -C "${work_dir}"
|
|
uv_bin="${work_dir}/uv-${uv_target}/uv"
|
|
export UV_CACHE_DIR="${work_dir}/uv-cache"
|
|
export UV_PYTHON_INSTALL_DIR="${work_dir}/uv-python"
|
|
"${uv_bin}" python install 3.12
|
|
python_bin="$("${uv_bin}" python find 3.12)"
|
|
|
|
git clone "${FORGE_BASE}/${REPO_NAME}.git" "${work_dir}/rein-aharness"
|
|
git -C "${work_dir}/rein-aharness" checkout --detach "${REPO_SHA}"
|
|
|
|
lock="${work_dir}/rein-aharness/deploy/runtime-contract-lock.json"
|
|
llm_sha="$("${python_bin}" -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "llm-connect"))' "${lock}")"
|
|
glas_sha="$("${python_bin}" -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "glas-harness"))' "${lock}")"
|
|
sandbox_sha="$("${python_bin}" -c 'import json,sys; rows=json.load(open(sys.argv[1]))["dependencies"]; print(next(row["commit"] for row in rows if row["distribution"] == "sandboxer"))' "${lock}")"
|
|
|
|
git clone "${FORGE_BASE}/coulomb/llm-connect.git" "${work_dir}/llm-connect"
|
|
git -C "${work_dir}/llm-connect" checkout --detach "${llm_sha}"
|
|
git clone "${FORGE_BASE}/coulomb/glas-harness.git" "${work_dir}/glas-harness"
|
|
git -C "${work_dir}/glas-harness" checkout --detach "${glas_sha}"
|
|
git clone "${FORGE_BASE}/coulomb/sand-boxer.git" "${work_dir}/sand-boxer"
|
|
git -C "${work_dir}/sand-boxer" checkout --detach "${sandbox_sha}"
|
|
|
|
cd "${work_dir}/rein-aharness"
|
|
"${uv_bin}" sync --python "${python_bin}" --frozen --no-editable --extra glas --extra llm --extra dev
|
|
./scripts/verify-runtime-contracts.sh
|