Skip to content
CI

Merge pull request #22 from BayyinahEnterprise/phase-g11-0-2-f22-corr… #69

Sign in to view logs

Merge pull request #22 from BayyinahEnterprise/phase-g11-0-2-f22-corr…

Merge pull request #22 from BayyinahEnterprise/phase-g11-0-2-f22-corr… #69

Workflow file for this run

.github/workflows/ci.yml at ad6f6a1
name: CI
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
lint:
# Style and type checks plus once-only repo-hygiene gates.
# Runs in ~10 seconds. Failing fast here saves the test matrix
# from running on style-broken code. The em-dash check and the
# origin-tag-presence gate live here (not in test) because they
# are once-only checks; running them per-Python-version would
# be redundant.
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install "git+https://github.com/BayyinahEnterprise/furqan-programming-language.git@v0.11.1"
pip install -e ".[dev,onnx,gate11,gate11-rust]"
- name: Ruff lint
run: ruff check .
- name: Ruff format
run: ruff format --check .
- name: Mypy
run: mypy
- name: Em-dash check
run: |
# CODE_OF_CONDUCT.md is Contributor Covenant v2.1 verbatim;
# third-party text is excluded per the policy that bans
# em-dashes from project-authored prose only.
if LC_ALL=C.UTF-8 grep -rPn --exclude=CODE_OF_CONDUCT.md '[\x{2013}\x{2014}]' src/ tests/ README.md CHANGELOG.md pyproject.toml; then
echo "Em-dash or en-dash found in source, tests, README, CHANGELOG, or pyproject.toml"
exit 1
fi
echo "Em-dash check: clean"
- name: Origin tag presence gate
run: python scripts/verify_origin_tags.py
test-python-only:
# The Python-only install path. Adapter tests self-skip via the
# §7.11-enforced skip-guards. Pinning that the full pytest -q
# suite passes here is the empirical guarantee that the no-
# extras user does not see traceback-style failures.
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
python-version: ["3.10", "3.11", "3.12", "3.13"]
steps:
- uses: actions/checkout@v4
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install "git+https://github.com/BayyinahEnterprise/furqan-programming-language.git@v0.11.1"
pip install -e ".[dev,onnx]"
- name: Run tests
run: python -m pytest -q
- name: Verify version sync
run: |
python -c "
from furqan_lint import __version__
import sys
if sys.version_info >= (3, 11):
import tomllib
else:
import tomli as tomllib
with open('pyproject.toml', 'rb') as f:
v = tomllib.load(f)['project']['version']
assert __version__ == v, f'{__version__} != {v}'
print(f'Version sync OK: {__version__}')
"
test-rust:
# The Rust-extras install path. Runs the full pytest -q suite;
# rust-adapter tests run for real, go-adapter tests self-skip.
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
python-version: ["3.10", "3.11", "3.12", "3.13"]
steps:
- uses: actions/checkout@v4
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install "git+https://github.com/BayyinahEnterprise/furqan-programming-language.git@v0.11.1"
pip install -e ".[dev,rust,onnx]"
- name: Run tests
run: python -m pytest -q
test-go:
# The Go-extras install path. Runs the full pytest -q suite;
# go-adapter tests run for real, rust-adapter tests self-skip.
# Sets up the Go 1.22 toolchain so the [go] extra's PEP 517
# build hook can compile the bundled goast binary.
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
python-version: ["3.10", "3.11", "3.12", "3.13"]
steps:
- uses: actions/checkout@v4
- name: Set up Python ${{ matrix.python-version }}
uses: actions/setup-python@v5
with:
python-version: ${{ matrix.python-version }}
- name: Set up Go
uses: actions/setup-go@v5
with:
go-version: "1.22"
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install "git+https://github.com/BayyinahEnterprise/furqan-programming-language.git@v0.11.1"
pip install -e ".[dev,go,onnx]"
- name: Run tests
run: python -m pytest -q
test-full:
# The everything-installed path. Pin that rust + go extras
# coexist on a single environment without conflict and that
# the full pytest -q suite passes with zero skips. Python 3.12
# only; the matrix coverage of rust + go individually across
# 3.10-3.13 is sufficient.
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Set up Go
uses: actions/setup-go@v5
with:
go-version: "1.22"
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install "git+https://github.com/BayyinahEnterprise/furqan-programming-language.git@v0.11.1"
pip install -e ".[dev,rust,go,onnx]"
- name: Run tests
run: python -m pytest -q
test-onnx-runtime:
# The [onnx-runtime] + [onnx-profile] install path (v0.9.4
# Part 5b(c)). Runs the full pytest -q suite so the
# CHANGELOG-math gate runs at full strength in CI (round-34
# HIGH-2b closure: pre-v0.9.4 the gate's onnxruntime-skip
# workaround meant the gate never ran with full extras in
# CI; arithmetic drift in the CHANGELOG ### Tests line was
# caught only on developer machines).
#
# Single Python version (3.12) sufficient for substrate
# coverage; the matrix's other jobs cover py 3.10-3.13
# cross-cutting concerns. Both [onnx-runtime] (v0.9.3
# numpy_divergence) and [onnx-profile] (v0.9.4 score_validity)
# are installed so all five ONNX checkers run end-to-end.
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install "git+https://github.com/BayyinahEnterprise/furqan-programming-language.git@v0.11.1"
pip install -e ".[dev,onnx,onnx-runtime,onnx-profile,gate11,gate11-rust]"
- name: Run tests
run: python -m pytest -q
gate11-smoke-test:
# Phase G11.0 / T10: end-to-end Sigstore sign + verify smoke
# test. Runs only on push to `main` (not on PRs from forks)
# because it requires the ambient GitHub OIDC token, which
# forked-PR workflows do not receive. The smoke test exercises
# the sign-then-verify round-trip on a fixture module via
# `FURQAN_LINT_GATE11_SMOKE_TEST=1` per T06's smoke-test
# contract.
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install "git+https://github.com/BayyinahEnterprise/furqan-programming-language.git@v0.11.1"
pip install -e ".[dev,gate11]"
- name: Sign and verify a fixture module via ambient OIDC
env:
FURQAN_LINT_GATE11_SMOKE_TEST: "1"
run: python -m pytest tests/test_gate11_signing.py -v
- name: Use the CLI to verify the bundle end to end
run: |
# The smoke test wrote an example fixture and bundle into
# the test's tmp_path. For a CLI-shaped end-to-end pin we
# also exercise `furqan-lint manifest verify` against a
# bundle the workflow produces directly, rather than the
# one in the test's tempdir which is cleaned up.
python -c "
import os, tempfile, subprocess, sys
os.environ['FURQAN_LINT_GATE11_SMOKE_TEST'] = '1'
# The smoke test in T06 already did the round-trip; here
# we just confirm the CLI entry point is reachable.
r = subprocess.run([sys.executable, '-m', 'furqan_lint.cli', '--help'],
capture_output=True, text=True, check=True)
assert 'manifest' in r.stdout, r.stdout
print('CLI help includes manifest subcommand')
"
gate11-rust-smoke-test:
# Phase G11.1 / T06: end-to-end Sigstore sign + verify smoke
# test for the Rust pipeline. Same gating as
# gate11-smoke-test (push to main only; id-token: write).
# The Rust pipeline reuses sigstore-python (no FFI to
# sigstore-rs in v1; v1.5 horizon item per Yusuf Horizon
# discipline), so the install matrix is the existing
# [gate11-rust] extra plus the [rust] extra for the legacy
# tree-sitter-rust adapter.
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install "git+https://github.com/BayyinahEnterprise/furqan-programming-language.git@v0.11.1"
pip install -e ".[dev,gate11-rust,rust]"
- name: Sign and verify a fixture .rs module via ambient OIDC
env:
FURQAN_LINT_GATE11_SMOKE_TEST: "1"
run: |
# Build a minimal .rs fixture, sign it via the manifest
# init pipeline, then verify the resulting bundle.
# Identity policy is asserted via --expected-identity
# against the GitHub Actions OIDC SAN pattern.
python -c "
import os, subprocess, sys, tempfile, re
from pathlib import Path
tmp = Path(tempfile.mkdtemp())
rs = tmp / 'lib.rs'
rs.write_text('pub fn smoke(a: i32, b: i32) -> i32 { a + b }')
# Sign:
subprocess.run([sys.executable, '-m', 'furqan_lint.cli',
'manifest', 'init', str(rs)], check=True)
bundle = rs.parent / (rs.name + '.furqan.manifest.sigstore')
assert bundle.exists(), 'bundle not written'
# Verify with the GitHub Actions OIDC SAN pattern:
repo = os.environ['GITHUB_REPOSITORY']
ref = os.environ['GITHUB_REF']
pattern = f'https://github.com/{repo}/.github/workflows/.*@{ref}'
subprocess.run([sys.executable, '-m', 'furqan_lint.cli',
'manifest', 'verify', str(bundle),
'--expected-identity', pattern,
'--expected-issuer',
'https://token.actions.githubusercontent.com'],
check=True)
print('Rust manifest signed + verified end to end via ambient OIDC')
"