chore(deps): bump pygments from 2.20.0 to 2.21.0 by dependabot[bot] · Pull Request #227 · ContextualWisdomLab/EgressWeave

dependabot · 2026-08-23T19:15:14Z

Bumps pygments from 2.20.0 to 2.21.0.

Release notes

2.21.0

New lexers:

BitBake (#3103)

Caddyfile (#3225)

CEL (#3048)

PureScript (#1077, #3054)

Updated lexers:

Bash: Fix coloured keyword at the beginning of a name (#2926)

Boogie: Add missing Boogie and Civl Verifier keywords (#3156)

C#:

Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)

Support dollar-prefixed and multi-quote raw strings (#3129, #2897)

Recognize union (#3182)

C/C++:

Add C23/C++26 attributes (#3084)

Add more C2Y keywords (#3092)

Highlight a function following a namespace body (#2928)

Fix C/C++ lexer support for multiline pre-processor comments (#3051)

Add .ipp as a file extension (#3141, #1008)

Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)

Csound: Add missing opcode parameter type letter (#3161)

CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)

D: Allow non-ASCII (Unicode) identifiers (#1088)

Fish: Fix single quote backslash escape (#3138, #2821)

Go: Various lexer improvements (#3199)

GoogleSQL: Require a word break after SET (#3167)

Hexdump: Only match valid digits (#3200, #2847)

JavaScript: Highlight the arguments object (#3146)

Jsonnet: Recognize colons in array slice expressions (#2828)

JSX: Allow apostrophes in element text (#2816)

Julia: Fix rstrings backslash (#3140, #2537)

Kotlin: Support companion objects without an explicit name (#2525)

Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)

Kusto: Recognize member-access dots in dynamic objects (#2779)

Lua: Various improvements (#3143)

Macaulay2: Update symbols to 1.26.05 (#3120)

Markdown:

Highlight bold-italics (***...*** and ___...___) (#3067)

Fix mention regex to support hyphens in usernames (#3139, #3135)

Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for embedded code blocks (#3133)

Mathematica: Recognize \[Name] named-character escapes such as \[Nu] instead of emitting an Error token (#3097)

... (truncated)

Changelog

Sourced from pygments's changelog.

Version 2.21.0

(released August 17th, 2026)

New lexers:

BitBake (#3103)

Caddyfile (#3225)

CEL (#3048)

PureScript (#1077, #3054)

Updated lexers:

Bash: Fix coloured keyword at the beginning of a name (#2926)

Boogie: Add missing Boogie and Civl Verifier keywords (#3156)

C#:

Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)

Support dollar-prefixed and multi-quote raw strings (#3129, #2897)

Recognize union (#3182)

C/C++:

Add C23/C++26 attributes (#3084)

Add more C2Y keywords (#3092)

Highlight a function following a namespace body (#2928)

Fix C/C++ lexer support for multiline pre-processor comments (#3051)

Add .ipp as a file extension (#3141, #1008)

Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)

Csound: Add missing opcode parameter type letter (#3161)

CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)

D: Allow non-ASCII (Unicode) identifiers (#1088)

Fish: Fix single quote backslash escape (#3138, #2821)

Go: Various lexer improvements (#3199)

GoogleSQL: Require a word break after SET (#3167)

Hexdump: Only match valid digits (#3200, #2847)

JavaScript: Highlight the arguments object (#3146)

Jsonnet: Recognize colons in array slice expressions (#2828)

JSX: Allow apostrophes in element text (#2816)

Julia: Fix rstrings backslash (#3140, #2537)

Kotlin: Support companion objects without an explicit name (#2525)

Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)

Kusto: Recognize member-access dots in dynamic objects (#2779)

Lua: Various improvements (#3143)

Macaulay2: Update symbols to 1.26.05 (#3120)

Markdown:

Highlight bold-italics (***...*** and ___...___) (#3067)

Fix mention regex to support hyphens in usernames (#3139, #3135)

Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for

... (truncated)

Commits

a43b45d Get ready for the 2.21.0 release.
d8f14cb Fix version_added for Purescript.
19c5817 Remove superfluous parentheses from PostgresExplainLexer (#3232)
9992e09 Merge pull request #3191 from jvoisin/dupes
bd22577 Fix regexlint warnings after latest update.
6a62df1 Release preparation: Update the changelog.
aabba32 Merge pull request #3221 from jvoisin/alter
d3441d0 Merge pull request #3225 from jvoisin/caddy
c593f3f Add a lexer for Caddy
0644b53 Simplify single-character regex alternations to character classes
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [pygments](https://github.com/pygments/pygments) from 2.20.0 to 2.21.0. - [Release notes](https://github.com/pygments/pygments/releases) - [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES) - [Commits](pygments/pygments@2.20.0...2.21.0) --- updated-dependencies: - dependency-name: pygments dependency-version: 2.21.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

devin-ai-integration

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

opencode-agent · 2026-08-24T14:07:39Z

OpenCode Review Overview

Head SHA: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
Workflow run: 32699441366
Workflow attempt: 1
Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode reviewed the current-head bounded evidence and found source-backed failed-check findings that must be addressed before merge.

Result: REQUEST_CHANGES
Reason: failed current-head checks were mapped to line-specific findings below for 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe.
Head SHA: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
Workflow run: 32699441366
Workflow attempt: 1

Failed checks

ci/test (3.10): FAILURE (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200341)
ci/test (3.11): FAILURE (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200342)
ci/test (3.12): FAILURE (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200356)
ci/test (3.13): FAILURE (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200346)
ci/test (3.14): FAILURE (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200339)
test (3.10) check run: failure (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200341)
test (3.11) check run: failure (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200342)
test (3.12) check run: failure (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200356)
test (3.13) check run: failure (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200346)
test (3.14) check run: failure (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200339)

Findings

1. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_has_deterministic_rfc4122_document_identity

Problem: GitHub Check failed in test step; pytest reported tests/test_attestable_release_sbom.py::test_attestable_sbom_has_deterministic_rfc4122_document_identity, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_attestable_release_sbom.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_attestable_release_sbom.py:1 to satisfy test_attestable_sbom_has_deterministic_rfc4122_document_identity, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_attestable_release_sbom.py::test_attestable_sbom_has_deterministic_rfc4122_document_identity -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_attestable_release_sbom.py:1 for test_attestable_sbom_has_deterministic_rfc4122_document_identity; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

2. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract

Problem: GitHub Check failed in test step; pytest reported tests/test_attestable_release_sbom.py::test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_attestable_release_sbom.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_attestable_release_sbom.py:1 to satisfy test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_attestable_release_sbom.py::test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_attestable_release_sbom.py:1 for test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

3. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_api_rejects_manifest_lock_drift

Problem: GitHub Check failed in test step; pytest reported tests/test_attestable_release_sbom.py::test_attestable_sbom_api_rejects_manifest_lock_drift, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_attestable_release_sbom.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_attestable_release_sbom.py:1 to satisfy test_attestable_sbom_api_rejects_manifest_lock_drift, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_attestable_release_sbom.py::test_attestable_sbom_api_rejects_manifest_lock_drift -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_attestable_release_sbom.py:1 for test_attestable_sbom_api_rejects_manifest_lock_drift; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

4. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_writer_rejects_missing_document_identity

Problem: GitHub Check failed in test step; pytest reported tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_missing_document_identity, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_attestable_release_sbom.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_attestable_release_sbom.py:1 to satisfy test_attestable_sbom_writer_rejects_missing_document_identity, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_missing_document_identity -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_attestable_release_sbom.py:1 for test_attestable_sbom_writer_rejects_missing_document_identity; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

5. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_writer_rejects_stale_identity_after_mutation

Problem: GitHub Check failed in test step; pytest reported tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_stale_identity_after_mutation, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_attestable_release_sbom.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_attestable_release_sbom.py:1 to satisfy test_attestable_sbom_writer_rejects_stale_identity_after_mutation, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_stale_identity_after_mutation -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_attestable_release_sbom.py:1 for test_attestable_sbom_writer_rejects_stale_identity_after_mutation; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

6. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_cli_writes_byte_stable_json

Problem: GitHub Check failed in test step; pytest reported tests/test_attestable_release_sbom.py::test_attestable_sbom_cli_writes_byte_stable_json, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_attestable_release_sbom.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_attestable_release_sbom.py:1 to satisfy test_attestable_sbom_cli_writes_byte_stable_json, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_attestable_release_sbom.py::test_attestable_sbom_cli_writes_byte_stable_json -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_attestable_release_sbom.py:1 for test_attestable_sbom_cli_writes_byte_stable_json; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

7. HIGH tests/test_prepare_release_evidence.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_prepare_release_evidence_emits_one_verified_six_file_set

Problem: GitHub Check failed in test step; pytest reported tests/test_prepare_release_evidence.py::test_prepare_release_evidence_emits_one_verified_six_file_set, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_prepare_release_evidence.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_prepare_release_evidence.py:1 to satisfy test_prepare_release_evidence_emits_one_verified_six_file_set, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_prepare_release_evidence.py::test_prepare_release_evidence_emits_one_verified_six_file_set -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_prepare_release_evidence.py:1 for test_prepare_release_evidence_emits_one_verified_six_file_set; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

8. HIGH tests/test_prepare_release_evidence.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_prepare_release_evidence_is_repeatable_for_identical_archives

Problem: GitHub Check failed in test step; pytest reported tests/test_prepare_release_evidence.py::test_prepare_release_evidence_is_repeatable_for_identical_archives, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_prepare_release_evidence.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_prepare_release_evidence.py:1 to satisfy test_prepare_release_evidence_is_repeatable_for_identical_archives, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_prepare_release_evidence.py::test_prepare_release_evidence_is_repeatable_for_identical_archives -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_prepare_release_evidence.py:1 for test_prepare_release_evidence_is_repeatable_for_identical_archives; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

9. HIGH tests/test_release_sbom.py:135 - Failed GitHub Check needs a source-backed pytest fix for test_manifest_is_bound_to_hash_locked_runtime_subset

Problem: GitHub Check failed in test step; pytest reported tests/test_release_sbom.py::test_manifest_is_bound_to_hash_locked_runtime_subset, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_release_sbom.py:135; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_release_sbom.py:135 to satisfy test_manifest_is_bound_to_hash_locked_runtime_subset, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_release_sbom.py::test_manifest_is_bound_to_hash_locked_runtime_subset -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_release_sbom.py:135 for test_manifest_is_bound_to_hash_locked_runtime_subset; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

Failed check evidence for line-specific fixes

Failed GitHub Check Evidence

PR: chore(deps): bump pygments from 2.20.0 to 2.21.0 #227
Head SHA: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
Repository: ContextualWisdomLab/EgressWeave

Line-specific repair contract

Treat the check logs and annotations below as diagnostic evidence, not as a complete review.
For each actionable failed check, inspect the local source or diff and identify the exact file line that must change.
OpenCode REQUEST_CHANGES findings must include path, line, root_cause, fix_direction, regression_test_direction, and suggested_diff.
Do not request changes with only a GitHub Actions URL or a generic check name.
When Strix logs contain multiple Vulnerability Report or Model ... Vulnerabilities ... sections, include every model-reported vulnerability in the review evidence and findings, including model name, title, severity, endpoint, and Code Locations/path:line evidence when present.
Create one OpenCode finding per Strix model vulnerability report; do not satisfy two model reports with one combined finding, even when titles or locations match.

Failed check: ci/test (3.10)

Type: check_run
Conclusion: FAILURE
Details URL: https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200341
Workflow run id: 32660653491
Check run id: 97246200341

Failed job steps

step 7: Run coverage run -m pytest -q (failure)

Check annotations

.github:431-431 [failure] Process completed with exit code 1.

Failed log signal summary

test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6499549Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:41.4517387Z /opt/hostedtoolcache/Python/3.10.21/x64/lib/python3.10/site-packages/coverage/core.py:108: CoverageWarning: Couldn't import C tracer: No module named 'coverage.tracer' (no-ctracer); see https://coverage.readthedocs.io/en/7.15.4/messages.html#warning-no-ctracer
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:41.4520122Z   warn(f"Couldn't import C tracer: {IMPORT_ERROR}", slug="no-ctracer", once=True)
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.0728763Z ##[error]Process completed with exit code 1.

Failed log excerpt

test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0036401Z Current runner version: '2.336.0'
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0064676Z ##[group]Runner Image Provisioner
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0065632Z Hosted Compute Agent
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0066238Z Version: 20260729.566
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0066918Z Commit: cf7153fe6e25b664e8693c24944bf2b00355d109
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0068083Z Build Date: 2026-07-29T19:17:02Z
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0068835Z Worker ID: {f88c2521-5d5f-463e-8241-3d2bd6ce3a03}
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0069609Z Azure Region: eastus
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0070206Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0071771Z ##[group]Operating System
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0072537Z Ubuntu
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0073081Z 24.04.4
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0073628Z LTS
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0074159Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0074744Z ##[group]Runner Image
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0075432Z Image: ubuntu-24.04
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0076005Z Version: 20260816.277.1
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0077309Z Included Software: https://github.com/actions/runner-images/blob/ubuntu24/20260816.277/images/ubuntu/Ubuntu2404-Readme.md
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0079197Z Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20260816.277
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0080314Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0081428Z ##[group]GITHUB_TOKEN Permissions
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0083624Z Contents: read
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0084286Z Metadata: read
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0084931Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0087127Z Secret source: Dependabot
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0088569Z Prepare workflow directory
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.2003672Z Prepare all required actions
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.2053028Z Getting action download info
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.3492550Z Download action repository 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' (SHA:3d3c42e5aac5ba805825da76410c181273ba90b1)
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.4826242Z Download action repository 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97' (SHA:5fda3b95a4ea91299a34e894583c3862153e4b97)
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.0090935Z Complete job name: test (3.10)
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5049349Z ##[group]Run actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5050665Z with:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5051196Z   ref: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5051858Z   persist-credentials: [REDACTED]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5052454Z   repository: ContextualWisdomLab/EgressWeave
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5056404Z   token: [REDACTED]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5056880Z   ssh-strict: true
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5057357Z   ssh-user: git
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5058022Z   clean: true
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5058513Z   sparse-checkout-cone-mode: true
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5059080Z   fetch-depth: 1
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5059594Z   fetch-tags: false
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5060089Z   show-progress: true
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5060563Z   lfs: false
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5061035Z   submodules: false
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5061542Z   set-safe-directory: true
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5062091Z   allow-unsafe-pr-checkout: false
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5062941Z env:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5063503Z   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5077307Z   PYTHONPATH: src
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5078361Z   CI_SOURCE_SHA: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5079030Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6158974Z Syncing repository: ContextualWisdomLab/EgressWeave
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6161869Z ##[group]Getting Git version info
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6163080Z Working directory is '/home/runner/work/EgressWeave/EgressWeave'
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6164862Z [command]/usr/bin/git version
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6238202Z git version 2.55.0
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6263121Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6279217Z Temporarily overriding HOME='/home/runner/work/_temp/15cac651-67d0-45b4-aa47-bd0bc8888347' before making global git config changes
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6283602Z Adding repository directory to the temporary git global config as a safe directory
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6285647Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6339662Z Deleting the contents of '/home/runner/work/EgressWeave/EgressWeave'
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6344055Z ##[group]Determining repository object format
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6346545Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6348433Z ##[group]Initializing the repository
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6352206Z [command]/usr/bin/git init /home/runner/work/EgressWeave/EgressWeave
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6495825Z hint: Using 'master' as the name for the initial branch. This default branch name
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6497898Z hint: will change to "main" in Git 3.0. To configure the initial branch name
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6499549Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6500972Z hint: call:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6501769Z hint:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6502764Z hint: 	git config --global init.defaultBranch <name>
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6503886Z hint:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6504905Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6506581Z hint: 'development'. The just-created branch can be renamed via this command:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6508106Z hint:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6508858Z hint: 	git branch -m <name>
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6509700Z hint:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6510791Z hint: Disable this message with "git config set advice.defaultBranchName false"
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6512651Z Initialized empty Git repository in /home/runner/work/EgressWeave/EgressWeave/.git/
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6515607Z [command]/usr/bin/git remote add origin https://github.com/ContextualWisdomLab/EgressWeave
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6575542Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6576996Z ##[group]Disabling automatic garbage collection
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6579805Z [command]/usr/bin/git config --local gc.auto 0
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6623052Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6624070Z ##[group]Setting up auth
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6624757Z Removing SSH command configuration
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6625653Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6671451Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"

... truncated 531 middle log lines ...

test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9030613Z     foundation.validate_runtime_lock(manifest_path, lock_path)
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9463242Z scripts/ci/generate_release_sbom.py:833: in validate_runtime_lock
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9464327Z     lock_entries = _load_runtime_lock(lock_path)
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9464960Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9465380Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9465776Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9466344Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9466663Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9467481Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9468597Z         try:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9468995Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9469614Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9470244Z             content = path.read_text(encoding="utf-8")
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9470776Z         except (OSError, UnicodeError) as error:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9471367Z             raise SystemExit("runtime lock is unreadable") from error
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9471983Z         entries: dict[str, dict[str, str | None]] = {}
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9472573Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9473095Z             line = raw_line.strip()
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9473459Z             if not line or line.startswith("#"):
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9473826Z                 continue
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9474139Z             if line.count("--hash=sha256:") != 1:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9474683Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9475699Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9476168Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9476336Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9476889Z _____________ test_manifest_is_bound_to_hash_locked_runtime_subset _____________
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9477297Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9477618Z tmp_path = PosixPath('/tmp/pytest-of-runner/pytest-0/test_manifest_is_bound_to_hash0')
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9478232Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9478579Z     def test_manifest_is_bound_to_hash_locked_runtime_subset(tmp_path: Path) -> None:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9479377Z         """Reject reviewed dependency evidence that drifts from the executable lock."""
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9479945Z         generator = _load_generator()
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9480393Z >       generator.validate_runtime_lock(MANIFEST_PATH, LOCK_PATH)
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9480743Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9480869Z tests/test_release_sbom.py:135: 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9481285Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9481843Z scripts/ci/generate_release_sbom.py:833: in validate_runtime_lock
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9482351Z     lock_entries = _load_runtime_lock(lock_path)
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9482911Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9483227Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9483536Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9483942Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9484149Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9484646Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9485014Z         try:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9485254Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9485642Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9486029Z             content = path.read_text(encoding="utf-8")
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9486498Z         except (OSError, UnicodeError) as error:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9486857Z             raise SystemExit("runtime lock is unreadable") from error
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9487222Z         entries: dict[str, dict[str, str | None]] = {}
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9487578Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9488054Z             line = raw_line.strip()
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9488412Z             if not line or line.startswith("#"):
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9488739Z                 continue
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9488982Z             if line.count("--hash=sha256:") != 1:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9489385Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9489886Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9490190Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9490321Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9490700Z =========================== short test summary info ============================
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9491670Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_has_deterministic_rfc4122_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9493043Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9494169Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_api_rejects_manifest_lock_drift - AssertionError: Regex pattern did not match.
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9494881Z   Expected regex: 'does not match the hash-locked runtime subset'
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9495337Z   Actual message: 'runtime lock entries require exactly one SHA-256 hash'
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9496279Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_missing_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9497810Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_stale_identity_after_mutation - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9498966Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_cli_writes_byte_stable_json - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9500212Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_emits_one_verified_six_file_set - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9501523Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_is_repeatable_for_identical_archives - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9502649Z FAILED tests/test_release_sbom.py::test_manifest_is_bound_to_hash_locked_runtime_subset - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9503328Z 9 failed, 1016 passed in 20.07s
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.0728763Z ##[error]Process completed with exit code 1.
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.2358408Z Post job cleanup.
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3335350Z [command]/usr/bin/git version
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3393023Z git version 2.55.0
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3443781Z Temporarily overriding HOME='/home/runner/work/_temp/d1162435-59d0-4971-8746-4679562aa942' before making global git config changes
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3445554Z Adding repository directory to the temporary git global config as a safe directory
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3448268Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3498495Z Removing SSH command configuration
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3508280Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3563942Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3927598Z Removing HTTP extra header
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3931419Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3993993Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.4345945Z Removing includeIf entries pointing to credentials config files
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.4354029Z [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.4410501Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp [REDACTED]
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.4864035Z Cleaning up orphan processes

Failed check: ci/test (3.11)

Type: check_run
Conclusion: FAILURE
Details URL: https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200342
Workflow run id: 32660653491
Check run id: 97246200342

Failed job steps

step 7: Run coverage run -m pytest -q (failure)

Check annotations

.github:445-445 [failure] Process completed with exit code 1.

Failed log signal summary

test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8835569Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:46.7827667Z /opt/hostedtoolcache/Python/3.11.16/x64/lib/python3.11/site-packages/coverage/core.py:108: CoverageWarning: Couldn't import C tracer: No module named 'coverage.tracer' (no-ctracer); see https://coverage.readthedocs.io/en/7.15.4/messages.html#warning-no-ctracer
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:46.7829942Z   warn(f"Couldn't import C tracer: {IMPORT_ERROR}", slug="no-ctracer", once=True)
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.4456938Z ##[error]Process completed with exit code 1.

Failed log excerpt

test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2142357Z Current runner version: '2.336.0'
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2168478Z ##[group]Runner Image Provisioner
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2169442Z Hosted Compute Agent
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2170080Z Version: 20260729.566
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2170798Z Commit: cf7153fe6e25b664e8693c24944bf2b00355d109
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2171563Z Build Date: 2026-07-29T19:17:02Z
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2172288Z Worker ID: {8ca8609a-fd63-46f9-8330-095a3b0110b7}
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2173034Z Azure Region: westus2
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2173624Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2175602Z ##[group]Operating System
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2176335Z Ubuntu
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2176867Z 24.04.4
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2177502Z LTS
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2178070Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2178683Z ##[group]Runner Image
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2179322Z Image: ubuntu-24.04
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2179898Z Version: 20260816.277.1
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2181242Z Included Software: https://github.com/actions/runner-images/blob/ubuntu24/20260816.277/images/ubuntu/Ubuntu2404-Readme.md
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2182847Z Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20260816.277
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2183842Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2185293Z ##[group]GITHUB_TOKEN Permissions
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2187286Z Contents: read
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2187891Z Metadata: read
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2188577Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2190747Z Secret source: Dependabot
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2191978Z Prepare workflow directory
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.4126219Z Prepare all required actions
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.4175849Z Getting action download info
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.7336037Z Download action repository 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' (SHA:3d3c42e5aac5ba805825da76410c181273ba90b1)
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.8677198Z Download action repository 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97' (SHA:5fda3b95a4ea91299a34e894583c3862153e4b97)
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.2725340Z Complete job name: test (3.11)
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7477942Z ##[group]Run actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7479200Z with:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7479733Z   ref: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7480402Z   persist-credentials: [REDACTED]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7481011Z   repository: ContextualWisdomLab/EgressWeave
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7485714Z   token: [REDACTED]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7486218Z   ssh-strict: true
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7486712Z   ssh-user: git
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7487184Z   clean: true
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7487681Z   sparse-checkout-cone-mode: true
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7488265Z   fetch-depth: 1
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7488742Z   fetch-tags: false
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7489254Z   show-progress: true
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7503087Z   lfs: false
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7503621Z   submodules: false
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7504386Z   set-safe-directory: true
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7504959Z   allow-unsafe-pr-checkout: false
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7506024Z env:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7506609Z   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7507234Z   PYTHONPATH: src
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7507832Z   CI_SOURCE_SHA: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7508844Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8550942Z Syncing repository: ContextualWisdomLab/EgressWeave
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8554230Z ##[group]Getting Git version info
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8555627Z Working directory is '/home/runner/work/EgressWeave/EgressWeave'
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8557561Z [command]/usr/bin/git version
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8616268Z git version 2.55.0
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8640301Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8651850Z Temporarily overriding HOME='/home/runner/work/_temp/79707528-cac8-4844-a566-e9a5730c53b4' before making global git config changes
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8655010Z Adding repository directory to the temporary git global config as a safe directory
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8658873Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8710416Z Deleting the contents of '/home/runner/work/EgressWeave/EgressWeave'
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8714277Z ##[group]Determining repository object format
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8715981Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8717290Z ##[group]Initializing the repository
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8720951Z [command]/usr/bin/git init /home/runner/work/EgressWeave/EgressWeave
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8831634Z hint: Using 'master' as the name for the initial branch. This default branch name
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8833597Z hint: will change to "main" in Git 3.0. To configure the initial branch name
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8835569Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8837030Z hint: call:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8837778Z hint:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8838696Z hint: 	git config --global init.defaultBranch <name>
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8839807Z hint:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8840894Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8842715Z hint: 'development'. The just-created branch can be renamed via this command:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8844348Z hint:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8845062Z hint: 	git branch -m <name>
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8845602Z hint:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8846296Z hint: Disable this message with "git config set advice.defaultBranchName false"
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8847394Z Initialized empty Git repository in /home/runner/work/EgressWeave/EgressWeave/.git/
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8851003Z [command]/usr/bin/git remote add origin https://github.com/ContextualWisdomLab/EgressWeave
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8926330Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8927740Z ##[group]Disabling automatic garbage collection
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8929686Z [command]/usr/bin/git config --local gc.auto 0
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8969831Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8970989Z ##[group]Setting up auth
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8971959Z Removing SSH command configuration
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8978915Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.9018761Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"

... truncated 542 middle log lines ...

test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3114809Z     lock_entries = _load_runtime_lock(lock_path)
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3115169Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3115520Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3115787Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3116052Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3116431Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3116654Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3117204Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3117620Z         try:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3117877Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3118297Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3119066Z             content = path.read_text(encoding="utf-8")
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3119420Z         except (OSError, UnicodeError) as error:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3119816Z             raise SystemExit("runtime lock is unreadable") from error
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3120232Z         entries: dict[str, dict[str, str | None]] = {}
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3120633Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3121013Z             line = raw_line.strip()
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3121316Z             if not line or line.startswith("#"):
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3121623Z                 continue
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3121888Z             if line.count("--hash=sha256:") != 1:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3122352Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3122918Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3123243Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3123390Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3123854Z _____________ test_manifest_is_bound_to_hash_locked_runtime_subset _____________
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3124347Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3124621Z tmp_path = PosixPath('/tmp/pytest-of-runner/pytest-0/test_manifest_is_bound_to_hash0')
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3125005Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3125251Z     def test_manifest_is_bound_to_hash_locked_runtime_subset(tmp_path: Path) -> None:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3125826Z         """Reject reviewed dependency evidence that drifts from the executable lock."""
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3126269Z         generator = _load_generator()
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3126613Z >       generator.validate_runtime_lock(MANIFEST_PATH, LOCK_PATH)
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3126867Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3127104Z tests/test_release_sbom.py:135: 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3127412Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3127828Z scripts/ci/generate_release_sbom.py:833: in validate_runtime_lock
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3128210Z     lock_entries = _load_runtime_lock(lock_path)
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3128498Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3128802Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3129037Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3129276Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3129597Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3129796Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3130265Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3130621Z         try:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3130860Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3131230Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3131603Z             content = path.read_text(encoding="utf-8")
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3131919Z         except (OSError, UnicodeError) as error:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3132279Z             raise SystemExit("runtime lock is unreadable") from error
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3132642Z         entries: dict[str, dict[str, str | None]] = {}
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3133000Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3133334Z             line = raw_line.strip()
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3133609Z             if not line or line.startswith("#"):
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3134026Z                 continue
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3134272Z             if line.count("--hash=sha256:") != 1:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3134698Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3135201Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3135487Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3135620Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3135982Z =========================== short test summary info ============================
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3137062Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_has_deterministic_rfc4122_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3138280Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3139386Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_api_rejects_manifest_lock_drift - AssertionError: Regex pattern did not match.
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3140088Z   Expected regex: 'does not match the hash-locked runtime subset'
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3140548Z   Actual message: 'runtime lock entries require exactly one SHA-256 hash'
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3141374Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_missing_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3142557Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_stale_identity_after_mutation - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3143685Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_cli_writes_byte_stable_json - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3144952Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_emits_one_verified_six_file_set - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3146253Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_is_repeatable_for_identical_archives - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3147375Z FAILED tests/test_release_sbom.py::test_manifest_is_bound_to_hash_locked_runtime_subset - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3148024Z 9 failed, 1016 passed in 13.49s
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.4456938Z ##[error]Process completed with exit code 1.
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.6076671Z Post job cleanup.
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.6990868Z [command]/usr/bin/git version
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7034786Z git version 2.55.0
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7078504Z Temporarily overriding HOME='/home/runner/work/_temp/e065c94b-0a99-40ab-88ce-0ebe1b7a737c' before making global git config changes
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7080120Z Adding repository directory to the temporary git global config as a safe directory
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7085109Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7128928Z Removing SSH command configuration
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7136603Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7176794Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7426210Z Removing HTTP extra header
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7432208Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7478644Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7721596Z Removing includeIf entries pointing to credentials config files
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7727831Z [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7768939Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp [REDACTED]
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.8162600Z Cleaning up orphan processes

Failed check: ci/test (3.12)

Type: check_run
Conclusion: FAILURE
Details URL: https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200356
Workflow run id: 32660653491
Check run id: 97246200356

Failed job steps

step 7: Run coverage run -m pytest -q (failure)

Check annotations

.github:446-446 [failure] Process completed with exit code 1.

Failed log signal summary

test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3549897Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:53.9571623Z /opt/hostedtoolcache/Python/3.12.14/x64/lib/python3.12/site-packages/coverage/core.py:108: CoverageWarning: Couldn't import C tracer: No module named 'coverage.tracer' (no-ctracer); see https://coverage.readthedocs.io/en/7.15.4/messages.html#warning-no-ctracer
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:53.9573364Z   warn(f"Couldn't import C tracer: {IMPORT_ERROR}", slug="no-ctracer", once=True)
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.2067457Z ##[error]Process completed with exit code 1.

Failed log excerpt

test (3.12)	UNKNOWN STEP	2026-08-23T19:15:46.9976311Z Current runner version: '2.336.0'
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0001095Z ##[group]Runner Image Provisioner
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0001855Z Hosted Compute Agent
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0002482Z Version: 20260729.566
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0003044Z Commit: cf7153fe6e25b664e8693c24944bf2b00355d109
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0003750Z Build Date: 2026-07-29T19:17:02Z
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0004364Z Worker ID: {46e445d7-356a-4f89-83fc-ad731e26ab09}
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0004997Z Azure Region: westus3
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0005526Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0007200Z ##[group]Operating System
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0007827Z Ubuntu
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0008334Z 24.04.4
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0008780Z LTS
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0009276Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0009778Z ##[group]Runner Image
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0010359Z Image: ubuntu-24.04
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0010896Z Version: 20260816.277.1
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0012040Z Included Software: https://github.com/actions/runner-images/blob/ubuntu24/20260816.277/images/ubuntu/Ubuntu2404-Readme.md
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0013426Z Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20260816.277
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0014285Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0015320Z ##[group]GITHUB_TOKEN Permissions
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0017439Z Contents: read
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0018007Z Metadata: read
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0018530Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0020622Z Secret source: Dependabot
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0021581Z Prepare workflow directory
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.1829925Z Prepare all required actions
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.1879301Z Getting action download info
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.4613779Z Download action repository 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' (SHA:3d3c42e5aac5ba805825da76410c181273ba90b1)
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.5411443Z Download action repository 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97' (SHA:5fda3b95a4ea91299a34e894583c3862153e4b97)
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.8799783Z Complete job name: test (3.12)
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2164497Z ##[group]Run actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2165608Z with:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2166213Z   ref: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2166753Z   persist-credentials: [REDACTED]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2167241Z   repository: ContextualWisdomLab/EgressWeave
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2171107Z   token: [REDACTED]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2171482Z   ssh-strict: true
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2171858Z   ssh-user: git
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2172221Z   clean: true
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2172621Z   sparse-checkout-cone-mode: true
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2173083Z   fetch-depth: 1
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2173458Z   fetch-tags: false
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2173846Z   show-progress: true
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2174234Z   lfs: false
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2174595Z   submodules: false
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2174987Z   set-safe-directory: true
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2175430Z   allow-unsafe-pr-checkout: false
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2176246Z env:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2176706Z   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2177204Z   PYTHONPATH: src
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2177683Z   CI_SOURCE_SHA: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2178219Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3282703Z Syncing repository: ContextualWisdomLab/EgressWeave
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3285921Z ##[group]Getting Git version info
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3287495Z Working directory is '/home/runner/work/EgressWeave/EgressWeave'
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3289418Z [command]/usr/bin/git version
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3328273Z git version 2.55.0
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3359259Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3365817Z Temporarily overriding HOME='/home/runner/work/_temp/f8c8d25b-aadf-41de-858e-174df4446fa3' before making global git config changes
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3368540Z Adding repository directory to the temporary git global config as a safe directory
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3370777Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3420745Z Deleting the contents of '/home/runner/work/EgressWeave/EgressWeave'
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3423545Z ##[group]Determining repository object format
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3425386Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3426785Z ##[group]Initializing the repository
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3447507Z [command]/usr/bin/git init /home/runner/work/EgressWeave/EgressWeave
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3545636Z hint: Using 'master' as the name for the initial branch. This default branch name
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3547885Z hint: will change to "main" in Git 3.0. To configure the initial branch name
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3549897Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3551428Z hint: call:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3552318Z hint:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3553370Z hint: 	git config --global init.defaultBranch <name>
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3554617Z hint:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3555804Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3557621Z hint: 'development'. The just-created branch can be renamed via this command:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3559099Z hint:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3559997Z hint: 	git branch -m <name>
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3560980Z hint:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3562339Z hint: Disable this message with "git config set advice.defaultBranchName false"
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3564527Z Initialized empty Git repository in /home/runner/work/EgressWeave/EgressWeave/.git/
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3568752Z [command]/usr/bin/git remote add origin https://github.com/ContextualWisdomLab/EgressWeave
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3607213Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3608791Z ##[group]Disabling automatic garbage collection
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3610174Z [command]/usr/bin/git config --local gc.auto 0
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3636801Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3638266Z ##[group]Setting up auth
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3639339Z Removing SSH command configuration
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3642018Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3671959Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"

... truncated 543 middle log lines ...

test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0487036Z     lock_entries = _load_runtime_lock(lock_path)
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0487366Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0487706Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0487955Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0488225Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0488581Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0488798Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0489307Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0489691Z         try:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0489960Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0490638Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0491048Z             content = path.read_text(encoding="utf-8")
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0491400Z         except (OSError, UnicodeError) as error:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0491788Z             raise SystemExit("runtime lock is unreadable") from error
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0492199Z         entries: dict[str, dict[str, str | None]] = {}
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0492597Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0492968Z             line = raw_line.strip()
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0493276Z             if not line or line.startswith("#"):
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0493597Z                 continue
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0493876Z             if line.count("--hash=sha256:") != 1:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0494315Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0494849Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0495162Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0495313Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0495759Z _____________ test_manifest_is_bound_to_hash_locked_runtime_subset _____________
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0496166Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0496424Z tmp_path = PosixPath('/tmp/pytest-of-runner/pytest-0/test_manifest_is_bound_to_hash0')
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0496789Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0497025Z     def test_manifest_is_bound_to_hash_locked_runtime_subset(tmp_path: Path) -> None:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0497610Z         """Reject reviewed dependency evidence that drifts from the executable lock."""
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0498065Z         generator = _load_generator()
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0498574Z >       generator.validate_runtime_lock(MANIFEST_PATH, LOCK_PATH)
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0498852Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0498984Z tests/test_release_sbom.py:135: 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0499311Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0499747Z scripts/ci/generate_release_sbom.py:833: in validate_runtime_lock
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0500139Z     lock_entries = _load_runtime_lock(lock_path)
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0500430Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0500759Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0500975Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0501225Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0501532Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0501713Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0502160Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0502497Z         try:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0502728Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0503131Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0503495Z             content = path.read_text(encoding="utf-8")
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0503804Z         except (OSError, UnicodeError) as error:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0504140Z             raise SystemExit("runtime lock is unreadable") from error
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0504490Z         entries: dict[str, dict[str, str | None]] = {}
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0504828Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0505145Z             line = raw_line.strip()
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0505410Z             if not line or line.startswith("#"):
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0505672Z                 continue
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0505918Z             if line.count("--hash=sha256:") != 1:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0506373Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0506834Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0507097Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0507227Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0507652Z =========================== short test summary info ============================
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0508529Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_has_deterministic_rfc4122_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0509675Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0510696Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_api_rejects_manifest_lock_drift - AssertionError: Regex pattern did not match.
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0511356Z   Expected regex: 'does not match the hash-locked runtime subset'
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0511797Z   Actual message: 'runtime lock entries require exactly one SHA-256 hash'
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0512557Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_missing_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0513648Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_stale_identity_after_mutation - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0514682Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_cli_writes_byte_stable_json - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0515720Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_emits_one_verified_six_file_set - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0517133Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_is_repeatable_for_identical_archives - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0518158Z FAILED tests/test_release_sbom.py::test_manifest_is_bound_to_hash_locked_runtime_subset - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0518773Z 9 failed, 1016 passed in 17.86s
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.2067457Z ##[error]Process completed with exit code 1.
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.3657240Z Post job cleanup.
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4481923Z [command]/usr/bin/git version
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4519957Z git version 2.55.0
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4561462Z Temporarily overriding HOME='/home/runner/work/_temp/1fd33cf3-c092-4534-a2d8-2bd6f45cba80' before making global git config changes
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4562815Z Adding repository directory to the temporary git global config as a safe directory
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4564466Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4590991Z Removing SSH command configuration
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4598230Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4631879Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4849618Z Removing HTTP extra header
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4850601Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4894964Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.5088234Z Removing includeIf entries pointing to credentials config files
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.5093917Z [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.5124978Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp [REDACTED]
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.5519275Z Cleaning up orphan processes

Failed check: ci/test (3.13)

Type: check_run
Conclusion: FAILURE
Details URL: https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200346
Workflow run id: 32660653491
Check run id: 97246200346

Failed job steps

step 7: Run coverage run -m pytest -q (failure)

Check annotations

.github:446-446 [failure] Process completed with exit code 1.

Failed log signal summary

test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4500070Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:59.2333054Z /opt/hostedtoolcache/Python/3.13.15/x64/lib/python3.13/site-packages/coverage/core.py:108: CoverageWarning: Couldn't import C tracer: No module named 'coverage.tracer' (no-ctracer); see https://coverage.readthedocs.io/en/7.15.4/messages.html#warning-no-ctracer
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:59.2336224Z   warn(f"Couldn't import C tracer: {IMPORT_ERROR}", slug="no-ctracer", once=True)
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.9385861Z ##[error]Process completed with exit code 1.

Failed log excerpt

test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8494453Z Current runner version: '2.336.0'
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8519045Z ##[group]Runner Image Provisioner
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8519924Z Hosted Compute Agent
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8520589Z Version: 20260729.566
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8521242Z Commit: cf7153fe6e25b664e8693c24944bf2b00355d109
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8521964Z Build Date: 2026-07-29T19:17:02Z
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8522732Z Worker ID: {ff24cd42-9ba5-438a-bdaf-8aa518ca1061}
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8523462Z Azure Region: westus2
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8524144Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8526011Z ##[group]Operating System
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8526657Z Ubuntu
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8527266Z 24.04.4
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8527820Z LTS
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8528316Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8528934Z ##[group]Runner Image
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8529522Z Image: ubuntu-24.04
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8530141Z Version: 20260816.277.1
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8531426Z Included Software: https://github.com/actions/runner-images/blob/ubuntu24/20260816.277/images/ubuntu/Ubuntu2404-Readme.md
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8533067Z Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20260816.277
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8534021Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8535210Z ##[group]GITHUB_TOKEN Permissions
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8537410Z Contents: read
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8538181Z Metadata: read
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8538747Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8540754Z Secret source: Dependabot
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8541937Z Prepare workflow directory
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:49.0789535Z Prepare all required actions
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:49.0861577Z Getting action download info
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:49.4180640Z Download action repository 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' (SHA:3d3c42e5aac5ba805825da76410c181273ba90b1)
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:49.5396324Z Download action repository 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97' (SHA:5fda3b95a4ea91299a34e894583c3862153e4b97)
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:49.9018456Z Complete job name: test (3.13)
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3173473Z ##[group]Run actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3174667Z with:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3175177Z   ref: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3176221Z   persist-credentials: [REDACTED]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3176827Z   repository: ContextualWisdomLab/EgressWeave
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3180859Z   token: [REDACTED]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3181327Z   ssh-strict: true
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3181797Z   ssh-user: git
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3182240Z   clean: true
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3182712Z   sparse-checkout-cone-mode: true
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3183275Z   fetch-depth: 1
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3183744Z   fetch-tags: false
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3184214Z   show-progress: true
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3184687Z   lfs: false
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3185126Z   submodules: false
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3199106Z   set-safe-directory: true
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3199898Z   allow-unsafe-pr-checkout: false
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3200884Z env:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3201430Z   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3202090Z   PYTHONPATH: src
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3202676Z   CI_SOURCE_SHA: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3203339Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4214517Z Syncing repository: ContextualWisdomLab/EgressWeave
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4216938Z ##[group]Getting Git version info
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4217769Z Working directory is '/home/runner/work/EgressWeave/EgressWeave'
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4218902Z [command]/usr/bin/git version
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4286399Z git version 2.55.0
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4316783Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4337301Z Temporarily overriding HOME='/home/runner/work/_temp/9ebeba7d-7b83-41c4-a1ce-b195a565782f' before making global git config changes
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4339535Z Adding repository directory to the temporary git global config as a safe directory
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4341813Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4385908Z Deleting the contents of '/home/runner/work/EgressWeave/EgressWeave'
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4389696Z ##[group]Determining repository object format
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4391665Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4392483Z ##[group]Initializing the repository
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4397957Z [command]/usr/bin/git init /home/runner/work/EgressWeave/EgressWeave
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4495758Z hint: Using 'master' as the name for the initial branch. This default branch name
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4498105Z hint: will change to "main" in Git 3.0. To configure the initial branch name
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4500070Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4501633Z hint: call:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4502673Z hint:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4503656Z hint: 	git config --global init.defaultBranch <name>
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4504339Z hint:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4504981Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4506804Z hint: 'development'. The just-created branch can be renamed via this command:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4507715Z hint:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4508168Z hint: 	git branch -m <name>
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4508683Z hint:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4509347Z hint: Disable this message with "git config set advice.defaultBranchName false"
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4510512Z Initialized empty Git repository in /home/runner/work/EgressWeave/EgressWeave/.git/
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4513493Z [command]/usr/bin/git remote add origin https://github.com/ContextualWisdomLab/EgressWeave
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4561456Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4563007Z ##[group]Disabling automatic garbage collection
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4564741Z [command]/usr/bin/git config --local gc.auto 0
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4598885Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4600002Z ##[group]Setting up auth
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4600707Z Removing SSH command configuration
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4607152Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4641813Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"

... truncated 546 middle log lines ...

test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8323515Z     lock_entries = _load_runtime_lock(lock_path)
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8323862Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8324222Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8324788Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8325059Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8325631Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8325869Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8326426Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8326853Z         try:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8327121Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8327565Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8328013Z             content = path.read_text(encoding="utf-8")
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8328385Z         except (OSError, UnicodeError) as error:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8328786Z             raise SystemExit("runtime lock is unreadable") from error
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8329166Z         entries: dict[str, dict[str, str | None]] = {}
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8329548Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8329898Z             line = raw_line.strip()
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8330181Z             if not line or line.startswith("#"):
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8330473Z                 continue
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8330716Z             if line.count("--hash=sha256:") != 1:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8331123Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8331624Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8331918Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8332054Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8332468Z _____________ test_manifest_is_bound_to_hash_locked_runtime_subset _____________
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8332764Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8333007Z tmp_path = PosixPath('/tmp/pytest-of-runner/pytest-0/test_manifest_is_bound_to_hash0')
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8333347Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8333576Z     def test_manifest_is_bound_to_hash_locked_runtime_subset(tmp_path: Path) -> None:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8334116Z         """Reject reviewed dependency evidence that drifts from the executable lock."""
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8334532Z         generator = _load_generator()
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8335018Z >       generator.validate_runtime_lock(MANIFEST_PATH, LOCK_PATH)
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8335283Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8335519Z tests/test_release_sbom.py:135: 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8335834Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8336244Z scripts/ci/generate_release_sbom.py:833: in validate_runtime_lock
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8336628Z     lock_entries = _load_runtime_lock(lock_path)
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8336920Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8337226Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8337461Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8337692Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8338021Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8338224Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8338697Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8339055Z         try:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8339293Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8339679Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8340068Z             content = path.read_text(encoding="utf-8")
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8340388Z         except (OSError, UnicodeError) as error:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8340772Z             raise SystemExit("runtime lock is unreadable") from error
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8341142Z         entries: dict[str, dict[str, str | None]] = {}
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8341500Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8341837Z             line = raw_line.strip()
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8342117Z             if not line or line.startswith("#"):
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8342523Z                 continue
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8342764Z             if line.count("--hash=sha256:") != 1:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8343171Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8343677Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8343959Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8344095Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8344454Z =========================== short test summary info ============================
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8345508Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_has_deterministic_rfc4122_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8346738Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8347845Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_api_rejects_manifest_lock_drift - AssertionError: Regex pattern did not match.
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8348550Z   Expected regex: 'does not match the hash-locked runtime subset'
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8349005Z   Actual message: 'runtime lock entries require exactly one SHA-256 hash'
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8349870Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_missing_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8351044Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_stale_identity_after_mutation - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8352173Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_cli_writes_byte_stable_json - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8353319Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_emits_one_verified_six_file_set - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8354625Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_is_repeatable_for_identical_archives - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8356048Z FAILED tests/test_release_sbom.py::test_manifest_is_bound_to_hash_locked_runtime_subset - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8356730Z 9 failed, 1016 passed in 13.24s
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.9385861Z ##[error]Process completed with exit code 1.
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.0978651Z Post job cleanup.
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1804413Z [command]/usr/bin/git version
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1849543Z git version 2.55.0
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1891390Z Temporarily overriding HOME='/home/runner/work/_temp/587c869f-814c-4dd6-98fa-a289deac398d' before making global git config changes
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1893058Z Adding repository directory to the temporary git global config as a safe directory
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1897324Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1929247Z Removing SSH command configuration
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1943499Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1997023Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2246215Z Removing HTTP extra header
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2252980Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2287942Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2532715Z Removing includeIf entries pointing to credentials config files
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2541024Z [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2580527Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp [REDACTED]
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2984419Z Cleaning up orphan processes

Failed check: ci/test (3.14)

Type: check_run
Conclusion: FAILURE
Details URL: https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200339
Workflow run id: 32660653491
Check run id: 97246200339

Failed job steps

step 7: Run coverage run -m pytest -q (failure)

Check annotations

.github:444-444 [failure] Process completed with exit code 1.

Failed log signal summary

test (3.14)	UNKNOWN STEP	2026-08-23T19:15:31.2513554Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.14)	UNKNOWN STEP	2026-08-23T19:15:46.8460110Z ##[error]Process completed with exit code 1.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: requirements-ci.txt"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: requirements-ci.txt"]
  R1 --> V1["required checks"]

opencode-agent

Pull request overview

OpenCode reviewed the current-head bounded evidence and found source-backed failed-check findings that must be addressed before merge.

Result: REQUEST_CHANGES
Reason: failed current-head checks were mapped to line-specific findings below for 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe.
Head SHA: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
Workflow run: 32699441366
Workflow attempt: 1

Failed checks

ci/test (3.10): FAILURE (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200341)
ci/test (3.11): FAILURE (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200342)
ci/test (3.12): FAILURE (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200356)
ci/test (3.13): FAILURE (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200346)
ci/test (3.14): FAILURE (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200339)
test (3.10) check run: failure (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200341)
test (3.11) check run: failure (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200342)
test (3.12) check run: failure (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200356)
test (3.13) check run: failure (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200346)
test (3.14) check run: failure (https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200339)

Findings

1. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_has_deterministic_rfc4122_document_identity

Problem: GitHub Check failed in test step; pytest reported tests/test_attestable_release_sbom.py::test_attestable_sbom_has_deterministic_rfc4122_document_identity, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_attestable_release_sbom.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_attestable_release_sbom.py:1 to satisfy test_attestable_sbom_has_deterministic_rfc4122_document_identity, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_attestable_release_sbom.py::test_attestable_sbom_has_deterministic_rfc4122_document_identity -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_attestable_release_sbom.py:1 for test_attestable_sbom_has_deterministic_rfc4122_document_identity; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

2. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract

Problem: GitHub Check failed in test step; pytest reported tests/test_attestable_release_sbom.py::test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_attestable_release_sbom.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_attestable_release_sbom.py:1 to satisfy test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_attestable_release_sbom.py::test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_attestable_release_sbom.py:1 for test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

3. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_api_rejects_manifest_lock_drift

Problem: GitHub Check failed in test step; pytest reported tests/test_attestable_release_sbom.py::test_attestable_sbom_api_rejects_manifest_lock_drift, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_attestable_release_sbom.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_attestable_release_sbom.py:1 to satisfy test_attestable_sbom_api_rejects_manifest_lock_drift, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_attestable_release_sbom.py::test_attestable_sbom_api_rejects_manifest_lock_drift -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_attestable_release_sbom.py:1 for test_attestable_sbom_api_rejects_manifest_lock_drift; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

4. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_writer_rejects_missing_document_identity

Problem: GitHub Check failed in test step; pytest reported tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_missing_document_identity, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_attestable_release_sbom.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_attestable_release_sbom.py:1 to satisfy test_attestable_sbom_writer_rejects_missing_document_identity, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_missing_document_identity -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_attestable_release_sbom.py:1 for test_attestable_sbom_writer_rejects_missing_document_identity; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

5. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_writer_rejects_stale_identity_after_mutation

Problem: GitHub Check failed in test step; pytest reported tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_stale_identity_after_mutation, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_attestable_release_sbom.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_attestable_release_sbom.py:1 to satisfy test_attestable_sbom_writer_rejects_stale_identity_after_mutation, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_stale_identity_after_mutation -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_attestable_release_sbom.py:1 for test_attestable_sbom_writer_rejects_stale_identity_after_mutation; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

6. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_cli_writes_byte_stable_json

Problem: GitHub Check failed in test step; pytest reported tests/test_attestable_release_sbom.py::test_attestable_sbom_cli_writes_byte_stable_json, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_attestable_release_sbom.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_attestable_release_sbom.py:1 to satisfy test_attestable_sbom_cli_writes_byte_stable_json, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_attestable_release_sbom.py::test_attestable_sbom_cli_writes_byte_stable_json -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_attestable_release_sbom.py:1 for test_attestable_sbom_cli_writes_byte_stable_json; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

7. HIGH tests/test_prepare_release_evidence.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_prepare_release_evidence_emits_one_verified_six_file_set

Problem: GitHub Check failed in test step; pytest reported tests/test_prepare_release_evidence.py::test_prepare_release_evidence_emits_one_verified_six_file_set, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_prepare_release_evidence.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_prepare_release_evidence.py:1 to satisfy test_prepare_release_evidence_emits_one_verified_six_file_set, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_prepare_release_evidence.py::test_prepare_release_evidence_emits_one_verified_six_file_set -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_prepare_release_evidence.py:1 for test_prepare_release_evidence_emits_one_verified_six_file_set; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

8. HIGH tests/test_prepare_release_evidence.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_prepare_release_evidence_is_repeatable_for_identical_archives

Problem: GitHub Check failed in test step; pytest reported tests/test_prepare_release_evidence.py::test_prepare_release_evidence_is_repeatable_for_identical_archives, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_prepare_release_evidence.py:1; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_prepare_release_evidence.py:1 to satisfy test_prepare_release_evidence_is_repeatable_for_identical_archives, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_prepare_release_evidence.py::test_prepare_release_evidence_is_repeatable_for_identical_archives -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_prepare_release_evidence.py:1 for test_prepare_release_evidence_is_repeatable_for_identical_archives; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

9. HIGH tests/test_release_sbom.py:135 - Failed GitHub Check needs a source-backed pytest fix for test_manifest_is_bound_to_hash_locked_runtime_subset

Problem: GitHub Check failed in test step; pytest reported tests/test_release_sbom.py::test_manifest_is_bound_to_hash_locked_runtime_subset, so the review must explain the failing assertion instead of linking only to the Actions URL.
Root cause: The failed log maps the pytest failure to tests/test_release_sbom.py:135; OpenCode must inspect that source line and explain the assertion-level cause before approval.
Fix: Patch tests/test_release_sbom.py:135 to satisfy test_manifest_is_bound_to_hash_locked_runtime_subset, then rerun the focused pytest target.
Regression test: Run cd backend && python -m pytest tests/test_release_sbom.py::test_manifest_is_bound_to_hash_locked_runtime_subset -q when the repository has a backend test layout, then rerun the failed check.
Suggested edit: update tests/test_release_sbom.py:135 for test_manifest_is_bound_to_hash_locked_runtime_subset; do not approve or post a URL-only review until the exact failing assertion is explained with this file, line, command, and fix direction.

Failed check evidence for line-specific fixes

Failed GitHub Check Evidence

PR: #227
Head SHA: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
Repository: ContextualWisdomLab/EgressWeave

Line-specific repair contract

Treat the check logs and annotations below as diagnostic evidence, not as a complete review.
For each actionable failed check, inspect the local source or diff and identify the exact file line that must change.
OpenCode REQUEST_CHANGES findings must include path, line, root_cause, fix_direction, regression_test_direction, and suggested_diff.
Do not request changes with only a GitHub Actions URL or a generic check name.
When Strix logs contain multiple Vulnerability Report or Model ... Vulnerabilities ... sections, include every model-reported vulnerability in the review evidence and findings, including model name, title, severity, endpoint, and Code Locations/path:line evidence when present.
Create one OpenCode finding per Strix model vulnerability report; do not satisfy two model reports with one combined finding, even when titles or locations match.

Failed check: ci/test (3.10)

Type: check_run
Conclusion: FAILURE
Details URL: https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200341
Workflow run id: 32660653491
Check run id: 97246200341

Failed job steps

step 7: Run coverage run -m pytest -q (failure)

Check annotations

.github:431-431 [failure] Process completed with exit code 1.

Failed log signal summary

test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6499549Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:41.4517387Z /opt/hostedtoolcache/Python/3.10.21/x64/lib/python3.10/site-packages/coverage/core.py:108: CoverageWarning: Couldn't import C tracer: No module named 'coverage.tracer' (no-ctracer); see https://coverage.readthedocs.io/en/7.15.4/messages.html#warning-no-ctracer
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:41.4520122Z   warn(f"Couldn't import C tracer: {IMPORT_ERROR}", slug="no-ctracer", once=True)
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.0728763Z ##[error]Process completed with exit code 1.

Failed log excerpt

test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0036401Z Current runner version: '2.336.0'
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0064676Z ##[group]Runner Image Provisioner
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0065632Z Hosted Compute Agent
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0066238Z Version: 20260729.566
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0066918Z Commit: cf7153fe6e25b664e8693c24944bf2b00355d109
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0068083Z Build Date: 2026-07-29T19:17:02Z
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0068835Z Worker ID: {f88c2521-5d5f-463e-8241-3d2bd6ce3a03}
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0069609Z Azure Region: eastus
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0070206Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0071771Z ##[group]Operating System
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0072537Z Ubuntu
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0073081Z 24.04.4
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0073628Z LTS
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0074159Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0074744Z ##[group]Runner Image
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0075432Z Image: ubuntu-24.04
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0076005Z Version: 20260816.277.1
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0077309Z Included Software: https://github.com/actions/runner-images/blob/ubuntu24/20260816.277/images/ubuntu/Ubuntu2404-Readme.md
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0079197Z Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20260816.277
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0080314Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0081428Z ##[group]GITHUB_TOKEN Permissions
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0083624Z Contents: read
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0084286Z Metadata: read
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0084931Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0087127Z Secret source: Dependabot
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.0088569Z Prepare workflow directory
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.2003672Z Prepare all required actions
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.2053028Z Getting action download info
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.3492550Z Download action repository 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' (SHA:3d3c42e5aac5ba805825da76410c181273ba90b1)
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:34.4826242Z Download action repository 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97' (SHA:5fda3b95a4ea91299a34e894583c3862153e4b97)
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.0090935Z Complete job name: test (3.10)
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5049349Z ##[group]Run actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5050665Z with:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5051196Z   ref: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5051858Z   persist-credentials: [REDACTED]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5052454Z   repository: ContextualWisdomLab/EgressWeave
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5056404Z   token: [REDACTED]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5056880Z   ssh-strict: true
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5057357Z   ssh-user: git
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5058022Z   clean: true
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5058513Z   sparse-checkout-cone-mode: true
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5059080Z   fetch-depth: 1
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5059594Z   fetch-tags: false
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5060089Z   show-progress: true
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5060563Z   lfs: false
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5061035Z   submodules: false
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5061542Z   set-safe-directory: true
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5062091Z   allow-unsafe-pr-checkout: false
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5062941Z env:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5063503Z   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5077307Z   PYTHONPATH: src
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5078361Z   CI_SOURCE_SHA: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.5079030Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6158974Z Syncing repository: ContextualWisdomLab/EgressWeave
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6161869Z ##[group]Getting Git version info
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6163080Z Working directory is '/home/runner/work/EgressWeave/EgressWeave'
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6164862Z [command]/usr/bin/git version
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6238202Z git version 2.55.0
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6263121Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6279217Z Temporarily overriding HOME='/home/runner/work/_temp/15cac651-67d0-45b4-aa47-bd0bc8888347' before making global git config changes
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6283602Z Adding repository directory to the temporary git global config as a safe directory
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6285647Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6339662Z Deleting the contents of '/home/runner/work/EgressWeave/EgressWeave'
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6344055Z ##[group]Determining repository object format
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6346545Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6348433Z ##[group]Initializing the repository
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6352206Z [command]/usr/bin/git init /home/runner/work/EgressWeave/EgressWeave
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6495825Z hint: Using 'master' as the name for the initial branch. This default branch name
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6497898Z hint: will change to "main" in Git 3.0. To configure the initial branch name
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6499549Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6500972Z hint: call:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6501769Z hint:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6502764Z hint: 	git config --global init.defaultBranch <name>
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6503886Z hint:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6504905Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6506581Z hint: 'development'. The just-created branch can be renamed via this command:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6508106Z hint:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6508858Z hint: 	git branch -m <name>
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6509700Z hint:
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6510791Z hint: Disable this message with "git config set advice.defaultBranchName false"
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6512651Z Initialized empty Git repository in /home/runner/work/EgressWeave/EgressWeave/.git/
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6515607Z [command]/usr/bin/git remote add origin https://github.com/ContextualWisdomLab/EgressWeave
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6575542Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6576996Z ##[group]Disabling automatic garbage collection
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6579805Z [command]/usr/bin/git config --local gc.auto 0
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6623052Z ##[endgroup]
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6624070Z ##[group]Setting up auth
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6624757Z Removing SSH command configuration
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6625653Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.10)	UNKNOWN STEP	2026-08-23T19:15:35.6671451Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"

... truncated 531 middle log lines ...

test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9030613Z     foundation.validate_runtime_lock(manifest_path, lock_path)
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9463242Z scripts/ci/generate_release_sbom.py:833: in validate_runtime_lock
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9464327Z     lock_entries = _load_runtime_lock(lock_path)
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9464960Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9465380Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9465776Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9466344Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9466663Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9467481Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9468597Z         try:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9468995Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9469614Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9470244Z             content = path.read_text(encoding="utf-8")
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9470776Z         except (OSError, UnicodeError) as error:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9471367Z             raise SystemExit("runtime lock is unreadable") from error
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9471983Z         entries: dict[str, dict[str, str | None]] = {}
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9472573Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9473095Z             line = raw_line.strip()
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9473459Z             if not line or line.startswith("#"):
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9473826Z                 continue
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9474139Z             if line.count("--hash=sha256:") != 1:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9474683Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9475699Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9476168Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9476336Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9476889Z _____________ test_manifest_is_bound_to_hash_locked_runtime_subset _____________
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9477297Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9477618Z tmp_path = PosixPath('/tmp/pytest-of-runner/pytest-0/test_manifest_is_bound_to_hash0')
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9478232Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9478579Z     def test_manifest_is_bound_to_hash_locked_runtime_subset(tmp_path: Path) -> None:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9479377Z         """Reject reviewed dependency evidence that drifts from the executable lock."""
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9479945Z         generator = _load_generator()
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9480393Z >       generator.validate_runtime_lock(MANIFEST_PATH, LOCK_PATH)
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9480743Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9480869Z tests/test_release_sbom.py:135: 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9481285Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9481843Z scripts/ci/generate_release_sbom.py:833: in validate_runtime_lock
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9482351Z     lock_entries = _load_runtime_lock(lock_path)
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9482911Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9483227Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9483536Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9483942Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9484149Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9484646Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9485014Z         try:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9485254Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9485642Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9486029Z             content = path.read_text(encoding="utf-8")
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9486498Z         except (OSError, UnicodeError) as error:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9486857Z             raise SystemExit("runtime lock is unreadable") from error
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9487222Z         entries: dict[str, dict[str, str | None]] = {}
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9487578Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9488054Z             line = raw_line.strip()
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9488412Z             if not line or line.startswith("#"):
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9488739Z                 continue
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9488982Z             if line.count("--hash=sha256:") != 1:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9489385Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9489886Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9490190Z 
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9490321Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9490700Z =========================== short test summary info ============================
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9491670Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_has_deterministic_rfc4122_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9493043Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9494169Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_api_rejects_manifest_lock_drift - AssertionError: Regex pattern did not match.
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9494881Z   Expected regex: 'does not match the hash-locked runtime subset'
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9495337Z   Actual message: 'runtime lock entries require exactly one SHA-256 hash'
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9496279Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_missing_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9497810Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_stale_identity_after_mutation - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9498966Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_cli_writes_byte_stable_json - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9500212Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_emits_one_verified_six_file_set - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9501523Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_is_repeatable_for_identical_archives - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9502649Z FAILED tests/test_release_sbom.py::test_manifest_is_bound_to_hash_locked_runtime_subset - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:02.9503328Z 9 failed, 1016 passed in 20.07s
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.0728763Z ##[error]Process completed with exit code 1.
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.2358408Z Post job cleanup.
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3335350Z [command]/usr/bin/git version
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3393023Z git version 2.55.0
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3443781Z Temporarily overriding HOME='/home/runner/work/_temp/d1162435-59d0-4971-8746-4679562aa942' before making global git config changes
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3445554Z Adding repository directory to the temporary git global config as a safe directory
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3448268Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3498495Z Removing SSH command configuration
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3508280Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3563942Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3927598Z Removing HTTP extra header
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3931419Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.3993993Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.4345945Z Removing includeIf entries pointing to credentials config files
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.4354029Z [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.4410501Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp [REDACTED]
test (3.10)	UNKNOWN STEP	2026-08-23T19:16:03.4864035Z Cleaning up orphan processes

Failed check: ci/test (3.11)

Type: check_run
Conclusion: FAILURE
Details URL: https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200342
Workflow run id: 32660653491
Check run id: 97246200342

Failed job steps

step 7: Run coverage run -m pytest -q (failure)

Check annotations

.github:445-445 [failure] Process completed with exit code 1.

Failed log signal summary

test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8835569Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:46.7827667Z /opt/hostedtoolcache/Python/3.11.16/x64/lib/python3.11/site-packages/coverage/core.py:108: CoverageWarning: Couldn't import C tracer: No module named 'coverage.tracer' (no-ctracer); see https://coverage.readthedocs.io/en/7.15.4/messages.html#warning-no-ctracer
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:46.7829942Z   warn(f"Couldn't import C tracer: {IMPORT_ERROR}", slug="no-ctracer", once=True)
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.4456938Z ##[error]Process completed with exit code 1.

Failed log excerpt

test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2142357Z Current runner version: '2.336.0'
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2168478Z ##[group]Runner Image Provisioner
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2169442Z Hosted Compute Agent
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2170080Z Version: 20260729.566
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2170798Z Commit: cf7153fe6e25b664e8693c24944bf2b00355d109
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2171563Z Build Date: 2026-07-29T19:17:02Z
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2172288Z Worker ID: {8ca8609a-fd63-46f9-8330-095a3b0110b7}
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2173034Z Azure Region: westus2
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2173624Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2175602Z ##[group]Operating System
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2176335Z Ubuntu
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2176867Z 24.04.4
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2177502Z LTS
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2178070Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2178683Z ##[group]Runner Image
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2179322Z Image: ubuntu-24.04
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2179898Z Version: 20260816.277.1
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2181242Z Included Software: https://github.com/actions/runner-images/blob/ubuntu24/20260816.277/images/ubuntu/Ubuntu2404-Readme.md
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2182847Z Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20260816.277
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2183842Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2185293Z ##[group]GITHUB_TOKEN Permissions
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2187286Z Contents: read
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2187891Z Metadata: read
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2188577Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2190747Z Secret source: Dependabot
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.2191978Z Prepare workflow directory
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.4126219Z Prepare all required actions
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.4175849Z Getting action download info
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.7336037Z Download action repository 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' (SHA:3d3c42e5aac5ba805825da76410c181273ba90b1)
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:37.8677198Z Download action repository 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97' (SHA:5fda3b95a4ea91299a34e894583c3862153e4b97)
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.2725340Z Complete job name: test (3.11)
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7477942Z ##[group]Run actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7479200Z with:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7479733Z   ref: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7480402Z   persist-credentials: [REDACTED]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7481011Z   repository: ContextualWisdomLab/EgressWeave
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7485714Z   token: [REDACTED]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7486218Z   ssh-strict: true
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7486712Z   ssh-user: git
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7487184Z   clean: true
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7487681Z   sparse-checkout-cone-mode: true
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7488265Z   fetch-depth: 1
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7488742Z   fetch-tags: false
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7489254Z   show-progress: true
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7503087Z   lfs: false
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7503621Z   submodules: false
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7504386Z   set-safe-directory: true
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7504959Z   allow-unsafe-pr-checkout: false
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7506024Z env:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7506609Z   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7507234Z   PYTHONPATH: src
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7507832Z   CI_SOURCE_SHA: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.7508844Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8550942Z Syncing repository: ContextualWisdomLab/EgressWeave
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8554230Z ##[group]Getting Git version info
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8555627Z Working directory is '/home/runner/work/EgressWeave/EgressWeave'
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8557561Z [command]/usr/bin/git version
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8616268Z git version 2.55.0
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8640301Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8651850Z Temporarily overriding HOME='/home/runner/work/_temp/79707528-cac8-4844-a566-e9a5730c53b4' before making global git config changes
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8655010Z Adding repository directory to the temporary git global config as a safe directory
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8658873Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8710416Z Deleting the contents of '/home/runner/work/EgressWeave/EgressWeave'
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8714277Z ##[group]Determining repository object format
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8715981Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8717290Z ##[group]Initializing the repository
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8720951Z [command]/usr/bin/git init /home/runner/work/EgressWeave/EgressWeave
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8831634Z hint: Using 'master' as the name for the initial branch. This default branch name
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8833597Z hint: will change to "main" in Git 3.0. To configure the initial branch name
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8835569Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8837030Z hint: call:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8837778Z hint:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8838696Z hint: 	git config --global init.defaultBranch <name>
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8839807Z hint:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8840894Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8842715Z hint: 'development'. The just-created branch can be renamed via this command:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8844348Z hint:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8845062Z hint: 	git branch -m <name>
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8845602Z hint:
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8846296Z hint: Disable this message with "git config set advice.defaultBranchName false"
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8847394Z Initialized empty Git repository in /home/runner/work/EgressWeave/EgressWeave/.git/
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8851003Z [command]/usr/bin/git remote add origin https://github.com/ContextualWisdomLab/EgressWeave
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8926330Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8927740Z ##[group]Disabling automatic garbage collection
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8929686Z [command]/usr/bin/git config --local gc.auto 0
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8969831Z ##[endgroup]
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8970989Z ##[group]Setting up auth
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8971959Z Removing SSH command configuration
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.8978915Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.11)	UNKNOWN STEP	2026-08-23T19:15:38.9018761Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"

... truncated 542 middle log lines ...

test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3114809Z     lock_entries = _load_runtime_lock(lock_path)
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3115169Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3115520Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3115787Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3116052Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3116431Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3116654Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3117204Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3117620Z         try:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3117877Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3118297Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3119066Z             content = path.read_text(encoding="utf-8")
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3119420Z         except (OSError, UnicodeError) as error:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3119816Z             raise SystemExit("runtime lock is unreadable") from error
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3120232Z         entries: dict[str, dict[str, str | None]] = {}
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3120633Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3121013Z             line = raw_line.strip()
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3121316Z             if not line or line.startswith("#"):
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3121623Z                 continue
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3121888Z             if line.count("--hash=sha256:") != 1:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3122352Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3122918Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3123243Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3123390Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3123854Z _____________ test_manifest_is_bound_to_hash_locked_runtime_subset _____________
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3124347Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3124621Z tmp_path = PosixPath('/tmp/pytest-of-runner/pytest-0/test_manifest_is_bound_to_hash0')
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3125005Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3125251Z     def test_manifest_is_bound_to_hash_locked_runtime_subset(tmp_path: Path) -> None:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3125826Z         """Reject reviewed dependency evidence that drifts from the executable lock."""
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3126269Z         generator = _load_generator()
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3126613Z >       generator.validate_runtime_lock(MANIFEST_PATH, LOCK_PATH)
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3126867Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3127104Z tests/test_release_sbom.py:135: 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3127412Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3127828Z scripts/ci/generate_release_sbom.py:833: in validate_runtime_lock
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3128210Z     lock_entries = _load_runtime_lock(lock_path)
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3128498Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3128802Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3129037Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3129276Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3129597Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3129796Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3130265Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3130621Z         try:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3130860Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3131230Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3131603Z             content = path.read_text(encoding="utf-8")
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3131919Z         except (OSError, UnicodeError) as error:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3132279Z             raise SystemExit("runtime lock is unreadable") from error
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3132642Z         entries: dict[str, dict[str, str | None]] = {}
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3133000Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3133334Z             line = raw_line.strip()
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3133609Z             if not line or line.startswith("#"):
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3134026Z                 continue
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3134272Z             if line.count("--hash=sha256:") != 1:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3134698Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3135201Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3135487Z 
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3135620Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3135982Z =========================== short test summary info ============================
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3137062Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_has_deterministic_rfc4122_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3138280Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3139386Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_api_rejects_manifest_lock_drift - AssertionError: Regex pattern did not match.
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3140088Z   Expected regex: 'does not match the hash-locked runtime subset'
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3140548Z   Actual message: 'runtime lock entries require exactly one SHA-256 hash'
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3141374Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_missing_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3142557Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_stale_identity_after_mutation - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3143685Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_cli_writes_byte_stable_json - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3144952Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_emits_one_verified_six_file_set - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3146253Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_is_repeatable_for_identical_archives - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3147375Z FAILED tests/test_release_sbom.py::test_manifest_is_bound_to_hash_locked_runtime_subset - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.3148024Z 9 failed, 1016 passed in 13.49s
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.4456938Z ##[error]Process completed with exit code 1.
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.6076671Z Post job cleanup.
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.6990868Z [command]/usr/bin/git version
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7034786Z git version 2.55.0
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7078504Z Temporarily overriding HOME='/home/runner/work/_temp/e065c94b-0a99-40ab-88ce-0ebe1b7a737c' before making global git config changes
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7080120Z Adding repository directory to the temporary git global config as a safe directory
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7085109Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7128928Z Removing SSH command configuration
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7136603Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7176794Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7426210Z Removing HTTP extra header
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7432208Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7478644Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7721596Z Removing includeIf entries pointing to credentials config files
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7727831Z [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.7768939Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp [REDACTED]
test (3.11)	UNKNOWN STEP	2026-08-23T19:16:01.8162600Z Cleaning up orphan processes

Failed check: ci/test (3.12)

Type: check_run
Conclusion: FAILURE
Details URL: https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200356
Workflow run id: 32660653491
Check run id: 97246200356

Failed job steps

step 7: Run coverage run -m pytest -q (failure)

Check annotations

.github:446-446 [failure] Process completed with exit code 1.

Failed log signal summary

test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3549897Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:53.9571623Z /opt/hostedtoolcache/Python/3.12.14/x64/lib/python3.12/site-packages/coverage/core.py:108: CoverageWarning: Couldn't import C tracer: No module named 'coverage.tracer' (no-ctracer); see https://coverage.readthedocs.io/en/7.15.4/messages.html#warning-no-ctracer
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:53.9573364Z   warn(f"Couldn't import C tracer: {IMPORT_ERROR}", slug="no-ctracer", once=True)
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.2067457Z ##[error]Process completed with exit code 1.

Failed log excerpt

test (3.12)	UNKNOWN STEP	2026-08-23T19:15:46.9976311Z Current runner version: '2.336.0'
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0001095Z ##[group]Runner Image Provisioner
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0001855Z Hosted Compute Agent
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0002482Z Version: 20260729.566
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0003044Z Commit: cf7153fe6e25b664e8693c24944bf2b00355d109
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0003750Z Build Date: 2026-07-29T19:17:02Z
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0004364Z Worker ID: {46e445d7-356a-4f89-83fc-ad731e26ab09}
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0004997Z Azure Region: westus3
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0005526Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0007200Z ##[group]Operating System
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0007827Z Ubuntu
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0008334Z 24.04.4
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0008780Z LTS
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0009276Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0009778Z ##[group]Runner Image
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0010359Z Image: ubuntu-24.04
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0010896Z Version: 20260816.277.1
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0012040Z Included Software: https://github.com/actions/runner-images/blob/ubuntu24/20260816.277/images/ubuntu/Ubuntu2404-Readme.md
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0013426Z Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20260816.277
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0014285Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0015320Z ##[group]GITHUB_TOKEN Permissions
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0017439Z Contents: read
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0018007Z Metadata: read
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0018530Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0020622Z Secret source: Dependabot
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.0021581Z Prepare workflow directory
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.1829925Z Prepare all required actions
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.1879301Z Getting action download info
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.4613779Z Download action repository 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' (SHA:3d3c42e5aac5ba805825da76410c181273ba90b1)
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.5411443Z Download action repository 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97' (SHA:5fda3b95a4ea91299a34e894583c3862153e4b97)
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:47.8799783Z Complete job name: test (3.12)
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2164497Z ##[group]Run actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2165608Z with:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2166213Z   ref: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2166753Z   persist-credentials: [REDACTED]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2167241Z   repository: ContextualWisdomLab/EgressWeave
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2171107Z   token: [REDACTED]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2171482Z   ssh-strict: true
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2171858Z   ssh-user: git
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2172221Z   clean: true
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2172621Z   sparse-checkout-cone-mode: true
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2173083Z   fetch-depth: 1
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2173458Z   fetch-tags: false
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2173846Z   show-progress: true
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2174234Z   lfs: false
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2174595Z   submodules: false
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2174987Z   set-safe-directory: true
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2175430Z   allow-unsafe-pr-checkout: false
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2176246Z env:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2176706Z   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2177204Z   PYTHONPATH: src
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2177683Z   CI_SOURCE_SHA: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.2178219Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3282703Z Syncing repository: ContextualWisdomLab/EgressWeave
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3285921Z ##[group]Getting Git version info
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3287495Z Working directory is '/home/runner/work/EgressWeave/EgressWeave'
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3289418Z [command]/usr/bin/git version
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3328273Z git version 2.55.0
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3359259Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3365817Z Temporarily overriding HOME='/home/runner/work/_temp/f8c8d25b-aadf-41de-858e-174df4446fa3' before making global git config changes
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3368540Z Adding repository directory to the temporary git global config as a safe directory
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3370777Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3420745Z Deleting the contents of '/home/runner/work/EgressWeave/EgressWeave'
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3423545Z ##[group]Determining repository object format
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3425386Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3426785Z ##[group]Initializing the repository
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3447507Z [command]/usr/bin/git init /home/runner/work/EgressWeave/EgressWeave
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3545636Z hint: Using 'master' as the name for the initial branch. This default branch name
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3547885Z hint: will change to "main" in Git 3.0. To configure the initial branch name
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3549897Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3551428Z hint: call:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3552318Z hint:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3553370Z hint: 	git config --global init.defaultBranch <name>
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3554617Z hint:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3555804Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3557621Z hint: 'development'. The just-created branch can be renamed via this command:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3559099Z hint:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3559997Z hint: 	git branch -m <name>
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3560980Z hint:
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3562339Z hint: Disable this message with "git config set advice.defaultBranchName false"
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3564527Z Initialized empty Git repository in /home/runner/work/EgressWeave/EgressWeave/.git/
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3568752Z [command]/usr/bin/git remote add origin https://github.com/ContextualWisdomLab/EgressWeave
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3607213Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3608791Z ##[group]Disabling automatic garbage collection
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3610174Z [command]/usr/bin/git config --local gc.auto 0
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3636801Z ##[endgroup]
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3638266Z ##[group]Setting up auth
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3639339Z Removing SSH command configuration
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3642018Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.12)	UNKNOWN STEP	2026-08-23T19:15:48.3671959Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"

... truncated 543 middle log lines ...

test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0487036Z     lock_entries = _load_runtime_lock(lock_path)
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0487366Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0487706Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0487955Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0488225Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0488581Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0488798Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0489307Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0489691Z         try:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0489960Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0490638Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0491048Z             content = path.read_text(encoding="utf-8")
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0491400Z         except (OSError, UnicodeError) as error:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0491788Z             raise SystemExit("runtime lock is unreadable") from error
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0492199Z         entries: dict[str, dict[str, str | None]] = {}
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0492597Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0492968Z             line = raw_line.strip()
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0493276Z             if not line or line.startswith("#"):
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0493597Z                 continue
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0493876Z             if line.count("--hash=sha256:") != 1:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0494315Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0494849Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0495162Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0495313Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0495759Z _____________ test_manifest_is_bound_to_hash_locked_runtime_subset _____________
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0496166Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0496424Z tmp_path = PosixPath('/tmp/pytest-of-runner/pytest-0/test_manifest_is_bound_to_hash0')
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0496789Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0497025Z     def test_manifest_is_bound_to_hash_locked_runtime_subset(tmp_path: Path) -> None:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0497610Z         """Reject reviewed dependency evidence that drifts from the executable lock."""
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0498065Z         generator = _load_generator()
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0498574Z >       generator.validate_runtime_lock(MANIFEST_PATH, LOCK_PATH)
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0498852Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0498984Z tests/test_release_sbom.py:135: 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0499311Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0499747Z scripts/ci/generate_release_sbom.py:833: in validate_runtime_lock
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0500139Z     lock_entries = _load_runtime_lock(lock_path)
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0500430Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0500759Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0500975Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0501225Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0501532Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0501713Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0502160Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0502497Z         try:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0502728Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0503131Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0503495Z             content = path.read_text(encoding="utf-8")
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0503804Z         except (OSError, UnicodeError) as error:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0504140Z             raise SystemExit("runtime lock is unreadable") from error
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0504490Z         entries: dict[str, dict[str, str | None]] = {}
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0504828Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0505145Z             line = raw_line.strip()
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0505410Z             if not line or line.startswith("#"):
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0505672Z                 continue
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0505918Z             if line.count("--hash=sha256:") != 1:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0506373Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0506834Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0507097Z 
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0507227Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0507652Z =========================== short test summary info ============================
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0508529Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_has_deterministic_rfc4122_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0509675Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0510696Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_api_rejects_manifest_lock_drift - AssertionError: Regex pattern did not match.
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0511356Z   Expected regex: 'does not match the hash-locked runtime subset'
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0511797Z   Actual message: 'runtime lock entries require exactly one SHA-256 hash'
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0512557Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_missing_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0513648Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_stale_identity_after_mutation - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0514682Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_cli_writes_byte_stable_json - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0515720Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_emits_one_verified_six_file_set - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0517133Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_is_repeatable_for_identical_archives - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0518158Z FAILED tests/test_release_sbom.py::test_manifest_is_bound_to_hash_locked_runtime_subset - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.0518773Z 9 failed, 1016 passed in 17.86s
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.2067457Z ##[error]Process completed with exit code 1.
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.3657240Z Post job cleanup.
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4481923Z [command]/usr/bin/git version
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4519957Z git version 2.55.0
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4561462Z Temporarily overriding HOME='/home/runner/work/_temp/1fd33cf3-c092-4534-a2d8-2bd6f45cba80' before making global git config changes
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4562815Z Adding repository directory to the temporary git global config as a safe directory
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4564466Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4590991Z Removing SSH command configuration
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4598230Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4631879Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4849618Z Removing HTTP extra header
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4850601Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.4894964Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.5088234Z Removing includeIf entries pointing to credentials config files
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.5093917Z [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.5124978Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp [REDACTED]
test (3.12)	UNKNOWN STEP	2026-08-23T19:16:13.5519275Z Cleaning up orphan processes

Failed check: ci/test (3.13)

Type: check_run
Conclusion: FAILURE
Details URL: https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200346
Workflow run id: 32660653491
Check run id: 97246200346

Failed job steps

step 7: Run coverage run -m pytest -q (failure)

Check annotations

.github:446-446 [failure] Process completed with exit code 1.

Failed log signal summary

test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4500070Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:59.2333054Z /opt/hostedtoolcache/Python/3.13.15/x64/lib/python3.13/site-packages/coverage/core.py:108: CoverageWarning: Couldn't import C tracer: No module named 'coverage.tracer' (no-ctracer); see https://coverage.readthedocs.io/en/7.15.4/messages.html#warning-no-ctracer
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:59.2336224Z   warn(f"Couldn't import C tracer: {IMPORT_ERROR}", slug="no-ctracer", once=True)
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.9385861Z ##[error]Process completed with exit code 1.

Failed log excerpt

test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8494453Z Current runner version: '2.336.0'
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8519045Z ##[group]Runner Image Provisioner
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8519924Z Hosted Compute Agent
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8520589Z Version: 20260729.566
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8521242Z Commit: cf7153fe6e25b664e8693c24944bf2b00355d109
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8521964Z Build Date: 2026-07-29T19:17:02Z
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8522732Z Worker ID: {ff24cd42-9ba5-438a-bdaf-8aa518ca1061}
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8523462Z Azure Region: westus2
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8524144Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8526011Z ##[group]Operating System
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8526657Z Ubuntu
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8527266Z 24.04.4
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8527820Z LTS
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8528316Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8528934Z ##[group]Runner Image
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8529522Z Image: ubuntu-24.04
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8530141Z Version: 20260816.277.1
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8531426Z Included Software: https://github.com/actions/runner-images/blob/ubuntu24/20260816.277/images/ubuntu/Ubuntu2404-Readme.md
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8533067Z Image Release: https://github.com/actions/runner-images/releases/tag/ubuntu24%2F20260816.277
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8534021Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8535210Z ##[group]GITHUB_TOKEN Permissions
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8537410Z Contents: read
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8538181Z Metadata: read
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8538747Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8540754Z Secret source: Dependabot
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:48.8541937Z Prepare workflow directory
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:49.0789535Z Prepare all required actions
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:49.0861577Z Getting action download info
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:49.4180640Z Download action repository 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' (SHA:3d3c42e5aac5ba805825da76410c181273ba90b1)
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:49.5396324Z Download action repository 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97' (SHA:5fda3b95a4ea91299a34e894583c3862153e4b97)
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:49.9018456Z Complete job name: test (3.13)
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3173473Z ##[group]Run actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3174667Z with:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3175177Z   ref: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3176221Z   persist-credentials: [REDACTED]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3176827Z   repository: ContextualWisdomLab/EgressWeave
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3180859Z   token: [REDACTED]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3181327Z   ssh-strict: true
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3181797Z   ssh-user: git
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3182240Z   clean: true
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3182712Z   sparse-checkout-cone-mode: true
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3183275Z   fetch-depth: 1
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3183744Z   fetch-tags: false
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3184214Z   show-progress: true
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3184687Z   lfs: false
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3185126Z   submodules: false
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3199106Z   set-safe-directory: true
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3199898Z   allow-unsafe-pr-checkout: false
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3200884Z env:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3201430Z   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3202090Z   PYTHONPATH: src
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3202676Z   CI_SOURCE_SHA: 7125d60f1a5eb0ed2e7c2cb9809f53312347b0fe
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.3203339Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4214517Z Syncing repository: ContextualWisdomLab/EgressWeave
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4216938Z ##[group]Getting Git version info
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4217769Z Working directory is '/home/runner/work/EgressWeave/EgressWeave'
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4218902Z [command]/usr/bin/git version
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4286399Z git version 2.55.0
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4316783Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4337301Z Temporarily overriding HOME='/home/runner/work/_temp/9ebeba7d-7b83-41c4-a1ce-b195a565782f' before making global git config changes
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4339535Z Adding repository directory to the temporary git global config as a safe directory
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4341813Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4385908Z Deleting the contents of '/home/runner/work/EgressWeave/EgressWeave'
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4389696Z ##[group]Determining repository object format
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4391665Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4392483Z ##[group]Initializing the repository
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4397957Z [command]/usr/bin/git init /home/runner/work/EgressWeave/EgressWeave
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4495758Z hint: Using 'master' as the name for the initial branch. This default branch name
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4498105Z hint: will change to "main" in Git 3.0. To configure the initial branch name
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4500070Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4501633Z hint: call:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4502673Z hint:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4503656Z hint: 	git config --global init.defaultBranch <name>
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4504339Z hint:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4504981Z hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4506804Z hint: 'development'. The just-created branch can be renamed via this command:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4507715Z hint:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4508168Z hint: 	git branch -m <name>
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4508683Z hint:
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4509347Z hint: Disable this message with "git config set advice.defaultBranchName false"
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4510512Z Initialized empty Git repository in /home/runner/work/EgressWeave/EgressWeave/.git/
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4513493Z [command]/usr/bin/git remote add origin https://github.com/ContextualWisdomLab/EgressWeave
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4561456Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4563007Z ##[group]Disabling automatic garbage collection
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4564741Z [command]/usr/bin/git config --local gc.auto 0
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4598885Z ##[endgroup]
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4600002Z ##[group]Setting up auth
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4600707Z Removing SSH command configuration
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4607152Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.13)	UNKNOWN STEP	2026-08-23T19:15:50.4641813Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"

... truncated 546 middle log lines ...

test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8323515Z     lock_entries = _load_runtime_lock(lock_path)
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8323862Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8324222Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8324788Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8325059Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8325631Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8325869Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8326426Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8326853Z         try:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8327121Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8327565Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8328013Z             content = path.read_text(encoding="utf-8")
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8328385Z         except (OSError, UnicodeError) as error:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8328786Z             raise SystemExit("runtime lock is unreadable") from error
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8329166Z         entries: dict[str, dict[str, str | None]] = {}
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8329548Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8329898Z             line = raw_line.strip()
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8330181Z             if not line or line.startswith("#"):
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8330473Z                 continue
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8330716Z             if line.count("--hash=sha256:") != 1:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8331123Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8331624Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8331918Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8332054Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8332468Z _____________ test_manifest_is_bound_to_hash_locked_runtime_subset _____________
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8332764Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8333007Z tmp_path = PosixPath('/tmp/pytest-of-runner/pytest-0/test_manifest_is_bound_to_hash0')
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8333347Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8333576Z     def test_manifest_is_bound_to_hash_locked_runtime_subset(tmp_path: Path) -> None:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8334116Z         """Reject reviewed dependency evidence that drifts from the executable lock."""
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8334532Z         generator = _load_generator()
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8335018Z >       generator.validate_runtime_lock(MANIFEST_PATH, LOCK_PATH)
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8335283Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8335519Z tests/test_release_sbom.py:135: 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8335834Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8336244Z scripts/ci/generate_release_sbom.py:833: in validate_runtime_lock
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8336628Z     lock_entries = _load_runtime_lock(lock_path)
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8336920Z                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8337226Z _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8337461Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8337692Z path = PosixPath('/home/runner/work/EgressWeave/EgressWeave/requirements-ci.txt')
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8338021Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8338224Z     def _load_runtime_lock(path: Path) -> dict[str, dict[str, str | None]]:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8338697Z         """Load exact package versions, markers, and hashes from the CI lock."""
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8339055Z         try:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8339293Z             if path.stat().st_size > MAX_MANIFEST_BYTES:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8339679Z                 raise SystemExit("runtime lock exceeds the safety bound")
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8340068Z             content = path.read_text(encoding="utf-8")
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8340388Z         except (OSError, UnicodeError) as error:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8340772Z             raise SystemExit("runtime lock is unreadable") from error
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8341142Z         entries: dict[str, dict[str, str | None]] = {}
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8341500Z         for raw_line in content.replace("\\\n", " ").splitlines():
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8341837Z             line = raw_line.strip()
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8342117Z             if not line or line.startswith("#"):
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8342523Z                 continue
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8342764Z             if line.count("--hash=sha256:") != 1:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8343171Z >               raise SystemExit("runtime lock entries require exactly one SHA-256 hash")
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8343677Z E               SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8343959Z 
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8344095Z scripts/ci/generate_release_sbom.py:800: SystemExit
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8344454Z =========================== short test summary info ============================
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8345508Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_has_deterministic_rfc4122_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8346738Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8347845Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_api_rejects_manifest_lock_drift - AssertionError: Regex pattern did not match.
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8348550Z   Expected regex: 'does not match the hash-locked runtime subset'
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8349005Z   Actual message: 'runtime lock entries require exactly one SHA-256 hash'
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8349870Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_missing_document_identity - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8351044Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_writer_rejects_stale_identity_after_mutation - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8352173Z FAILED tests/test_attestable_release_sbom.py::test_attestable_sbom_cli_writes_byte_stable_json - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8353319Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_emits_one_verified_six_file_set - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8354625Z FAILED tests/test_prepare_release_evidence.py::test_prepare_release_evidence_is_repeatable_for_identical_archives - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8356048Z FAILED tests/test_release_sbom.py::test_manifest_is_bound_to_hash_locked_runtime_subset - SystemExit: runtime lock entries require exactly one SHA-256 hash
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.8356730Z 9 failed, 1016 passed in 13.24s
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:13.9385861Z ##[error]Process completed with exit code 1.
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.0978651Z Post job cleanup.
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1804413Z [command]/usr/bin/git version
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1849543Z git version 2.55.0
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1891390Z Temporarily overriding HOME='/home/runner/work/_temp/587c869f-814c-4dd6-98fa-a289deac398d' before making global git config changes
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1893058Z Adding repository directory to the temporary git global config as a safe directory
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1897324Z [command]/usr/bin/git config --global --add safe.directory /home/runner/work/EgressWeave/EgressWeave
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1929247Z Removing SSH command configuration
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1943499Z [command]/usr/bin/git config --local --name-only --get-regexp core\.sshCommand
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.1997023Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'core\.sshCommand' && git config --local --unset-all 'core.sshCommand' || :"
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2246215Z Removing HTTP extra header
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2252980Z [command]/usr/bin/git config --local --name-only --get-regexp http\.https\:\/\/github\.com\/\.extraheader
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2287942Z [command]/usr/bin/git submodule foreach --recursive sh -c "git config --local --name-only --get-regexp 'http\.https\:\/\/github\.com\/\.extraheader' && git config --local --unset-all 'http.https://github.com/.extraheader' || :"
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2532715Z Removing includeIf entries pointing to credentials config files
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2541024Z [command]/usr/bin/git config --local --name-only --get-regexp ^includeIf\.gitdir:
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2580527Z [command]/usr/bin/git submodule foreach --recursive git config --local --show-origin --name-only --get-regexp [REDACTED]
test (3.13)	UNKNOWN STEP	2026-08-23T19:16:14.2984419Z Cleaning up orphan processes

Failed check: ci/test (3.14)

Type: check_run
Conclusion: FAILURE
Details URL: https://github.com/ContextualWisdomLab/EgressWeave/actions/runs/32660653491/job/97246200339
Workflow run id: 32660653491
Check run id: 97246200339

Failed job steps

step 7: Run coverage run -m pytest -q (failure)

Check annotations

.github:444-444 [failure] Process completed with exit code 1.

Failed log signal summary

test (3.14)	UNKNOWN STEP	2026-08-23T19:15:31.2513554Z hint: to use in all of your new repositories, which will suppress this warning,
test (3.14)	UNKNOWN STEP	2026-08-23T19:15:46.8460110Z ##[error]Process completed with exit code 1.

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file: requirements-ci.txt"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file: requirements-ci.txt"]
  R1 --> V1["required checks"]

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 23, 2026

devin-ai-integration Bot reviewed Aug 23, 2026

View reviewed changes

opencode-agent Bot requested changes Aug 24, 2026

View reviewed changes

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 23, 2026 • edited by devin-ai-integration Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.21.0

Version 2.21.0

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

✅ Devin Review: No Issues Found

Uh oh!

opencode-agent Bot commented Aug 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

OpenCode Review Overview

Pull request overview

Findings

1. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_has_deterministic_rfc4122_document_identity

2. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract

3. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_api_rejects_manifest_lock_drift

4. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_writer_rejects_missing_document_identity

5. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_writer_rejects_stale_identity_after_mutation

6. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_cli_writes_byte_stable_json

7. HIGH tests/test_prepare_release_evidence.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_prepare_release_evidence_emits_one_verified_six_file_set

8. HIGH tests/test_prepare_release_evidence.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_prepare_release_evidence_is_repeatable_for_identical_archives

9. HIGH tests/test_release_sbom.py:135 - Failed GitHub Check needs a source-backed pytest fix for test_manifest_is_bound_to_hash_locked_runtime_subset

Failed GitHub Check Evidence

Line-specific repair contract

Failed check: ci/test (3.10)

Failed job steps

Check annotations

Failed log signal summary

Failed log excerpt

Failed check: ci/test (3.11)

Failed job steps

Check annotations

Failed log signal summary

Failed log excerpt

Failed check: ci/test (3.12)

Failed job steps

Check annotations

Failed log signal summary

Failed log excerpt

Failed check: ci/test (3.13)

Failed job steps

Check annotations

Failed log signal summary

Failed log excerpt

Failed check: ci/test (3.14)

Failed job steps

Check annotations

Failed log signal summary

Changed-File Evidence Map

Uh oh!

opencode-agent Bot left a comment

Choose a reason for hiding this comment

Pull request overview

Findings

1. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_has_deterministic_rfc4122_document_identity

2. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_matches_pinned_actions_attest_cyclonedx_contract

3. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_api_rejects_manifest_lock_drift

4. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_writer_rejects_missing_document_identity

5. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_writer_rejects_stale_identity_after_mutation

6. HIGH tests/test_attestable_release_sbom.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_attestable_sbom_cli_writes_byte_stable_json

7. HIGH tests/test_prepare_release_evidence.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_prepare_release_evidence_emits_one_verified_six_file_set

8. HIGH tests/test_prepare_release_evidence.py:1 - Failed GitHub Check needs a source-backed pytest fix for test_prepare_release_evidence_is_repeatable_for_identical_archives

9. HIGH tests/test_release_sbom.py:135 - Failed GitHub Check needs a source-backed pytest fix for test_manifest_is_bound_to_hash_locked_runtime_subset

Failed GitHub Check Evidence

Line-specific repair contract

Failed check: ci/test (3.10)

Failed job steps

Check annotations

Failed log signal summary

Failed log excerpt

Failed check: ci/test (3.11)

Failed job steps

Check annotations

Failed log signal summary

Failed log excerpt

Failed check: ci/test (3.12)

Failed job steps

dependabot Bot commented on behalf of github Aug 23, 2026 •

edited by devin-ai-integration Bot

Loading

opencode-agent Bot commented Aug 24, 2026 •

edited

Loading