Bump @types/node from 22.19.17 to 26.4.0 in /typescript #167
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Mandatory blocking CI matrix (PCS/PF-Core completion plan). | |
| # Job inventory is mirrored in docs/pf-core/release-checklist.md. | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| jobs: | |
| python-tests: | |
| name: Python full tests | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install and test Python | |
| run: | | |
| cd python | |
| pip install -c requirements.lock -e ".[dev]" | |
| pcs capabilities | |
| pytest -q | |
| pcs schema check | |
| pcs pf-core audit-claims | |
| pcs pf-core audit-boundary | |
| pcs pf-core audit-lean-catalog | |
| pcs pf-core audit-lean-no-sorry | |
| pcs examples check | |
| pcs validate-release-chain ../examples/labtrust-release/ | |
| pcs validate-release-chain ../examples/labtrust-release/ --json > /dev/null | |
| pcs validate-release-chain ../examples/labtrust-release/ --out ../examples/labtrust-release/.ci_validation_result.json | |
| pcs validate ../examples/labtrust-release/.ci_validation_result.json | |
| test -f ../examples/labtrust-release/release_manifest.v0.json | |
| pcs validate ../examples/labtrust-release/release_manifest.v0.json | |
| python -m pcs_core.hash_vectors --verify | |
| pcs shared-hash-vectors verify | |
| pcs conformance run --suite all | |
| pcs conformance run --suite multidomain | |
| pcs conformance run --suite all --json > /tmp/conformance_report.json | |
| pcs validate /tmp/conformance_report.json | |
| pcs registry validate ../examples/artifact_registry.valid.json | |
| pcs registry audit | |
| test -f ../examples/tool-use-release/tool_use_trace.valid.json | |
| test -f ../examples/tool-use-release/tool_use_certificate.valid.json | |
| test -f ../examples/tool-use-release/RELEASE_FIXTURE_MANIFEST.json | |
| pcs validate ../examples/workflow_profiles/labtrust_qc_release.valid.json | |
| pcs validate ../examples/workflow_profiles/agent_tool_use_safety.valid.json | |
| pcs validate ../examples/workflow_profiles/scientific_computation_reproducibility.valid.json | |
| pcs validate-release-chain ../examples/tool-use-release/ | |
| test -f ../examples/computation-release/computation_witness.json | |
| test -f ../examples/computation-release/RELEASE_FIXTURE_MANIFEST.json | |
| pcs validate-release-chain ../examples/computation-release/ | |
| pcs conformance run --suite computation | |
| pcs benchmark validate | |
| pcs conformance run --suite benchmark | |
| pcs conformance run --suite benchmark-ingest | |
| pcs conformance run --suite benchmark-report | |
| pcs benchmark run --suite labtrust-qc-release-v0 | |
| pcs benchmark run --suite tool-use-safety-v0 | |
| pcs benchmark run --suite computation-reproducibility-v0 | |
| pcs benchmark run --suite scientific-memory-rendering-v0 | |
| pcs benchmark run --suite formal-trust-kernel-v0 | |
| pcs benchmark run --suite cross-domain-release-chain-v0 | |
| python scripts/materialize_benchmark_examples.py | |
| python scripts/materialize_benchmark_producer_examples.py | |
| python ../scripts/validate_benchmark_ingest_examples.py --release-grade | |
| pcs benchmark validate-ingest --release-grade | |
| pcs validate ../examples/benchmark_registry.valid.json | |
| pcs validate ../examples/benchmark_metric_registry.valid.json | |
| for f in ../examples/benchmark/pcs_bench_report.valid.json ../examples/benchmark/labtrust_benchmark_case.valid.json; do pcs validate "$f"; done | |
| for f in ../examples/benchmark_ingest/*.pcs_bench_ingest.valid.json; do pcs validate "$f"; done | |
| pcs validate ../examples/tool_use_trace.valid.json | |
| pcs validate ../examples/tool_use_certificate.valid.json | |
| ruff check pcs_core tests | |
| ruff format --check pcs_core tests | |
| - name: PF-Core fixture validation | |
| run: | | |
| cd python | |
| pcs validate ../examples/pf-core-valid/tool_use_trace_compiled/pfcore_trace.json | |
| pcs pf-core validate-trace ../examples/pf-core-valid/tool_use_trace_compiled/pfcore_trace.json | |
| - name: PF-Core CertifyEdge check (live or mock) | |
| run: | | |
| cd python | |
| if command -v certifyedge >/dev/null 2>&1; then | |
| echo "CertifyEdge CLI found: $(command -v certifyedge)" | |
| certifyedge --version || true | |
| pcs pf-core certifyedge-check \ | |
| --trace ../examples/pf-core-valid/labtrust_replay/trace.json \ | |
| --property qc_release.temporal.safety \ | |
| --out /tmp/PFCoreCertificate.certifyedge.json || { | |
| echo "WARNING: live CertifyEdge check failed; falling back to mock (dev CI only)" | |
| PCS_CERTIFYEDGE_MOCK=1 pcs pf-core certifyedge-check \ | |
| --trace ../examples/pf-core-valid/labtrust_replay/trace.json \ | |
| --property qc_release.temporal.safety \ | |
| --out /tmp/PFCoreCertificate.certifyedge.json | |
| } | |
| else | |
| echo "WARNING: certifyedge not on PATH; using PCS_CERTIFYEDGE_MOCK=1 (dev CI only)" | |
| PCS_CERTIFYEDGE_MOCK=1 pcs pf-core certifyedge-check \ | |
| --trace ../examples/pf-core-valid/labtrust_replay/trace.json \ | |
| --property qc_release.temporal.safety \ | |
| --out /tmp/PFCoreCertificate.certifyedge.json | |
| fi | |
| - name: Schema drift check (reference) | |
| run: bash scripts/pcs-schema-diff.sh schemas | |
| - name: PF-Core catalog drift check | |
| run: | | |
| cd python | |
| python scripts/gen_pf_core_catalog.py | |
| git diff --exit-code ../python/pcs_core/pf_core_catalog.py \ | |
| ../lean/PFCore/Catalog.lean \ | |
| ../rust/crates/pcs-core/src/pf_core_catalog.rs \ | |
| ../typescript/packages/core/src/pfCoreCatalog.ts | |
| if grep -n '("cap:file-read", Effect.read)' ../lean/PFCore/Action.lean; then | |
| echo "hand-maintained knownCapabilityEffectCatalog entries found in Action.lean" >&2 | |
| exit 1 | |
| fi | |
| if grep -n '("file_reader", \["cap:file-read"\])' ../lean/PFCore/RoleMap.lean; then | |
| echo "hand-maintained runtimeRoleMap entries found in RoleMap.lean" >&2 | |
| exit 1 | |
| fi | |
| if grep -n 'EFFECT_KIND_TO_LEAN: dict\[str, str\] = {' ../python/pcs_core/pf_core_lean_codegen.py; then | |
| echo "manual EFFECT_KIND_TO_LEAN table found in pf_core_lean_codegen.py" >&2 | |
| exit 1 | |
| fi | |
| python-typecheck: | |
| name: Python full-package typecheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Pyright (full package) | |
| run: | | |
| cd python | |
| pip install -c requirements.lock -e ".[dev,quality]" | |
| python ../scripts/verify-certifyedge-pin.py --mode preview | |
| pyright pcs_core | |
| python-coverage: | |
| name: Python branch coverage | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Branch coverage (fail-under from pyproject) | |
| run: | | |
| cd python | |
| pip install -c requirements.lock -e ".[dev,quality]" | |
| # tool.coverage.run.branch=true — full suite with branch data; fail-under on trust-critical modules. | |
| coverage run -m pytest -q | |
| coverage report --fail-under=0 | |
| coverage report \ | |
| --include='pcs_core/external_attestation.py,pcs_core/pf_core_bundle.py,pcs_core/pf_core_certifyedge.py,pcs_core/safe_paths.py,pcs_core/hash.py,pcs_core/artifact_integrity.py,pcs_core/certifyedge_pin.py' \ | |
| --fail-under=70 | |
| rust: | |
| name: Rust fmt/clippy/tests/fuzz-smoke | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: dtolnay/rust-toolchain@4d407b29186a635f0cc27475ef0bc0ae605a8866 # 1.86 | |
| with: | |
| components: rustfmt, clippy | |
| - name: Format + Clippy + tests | |
| run: | | |
| cd rust | |
| cargo fmt --check | |
| cargo clippy --locked --all-targets -- -D warnings | |
| cargo test --locked | |
| cargo test --locked hash_vectors | |
| - name: Fuzz smoke (proptest property targets) | |
| run: | | |
| cd rust | |
| # Full cargo-fuzz / libfuzzer is scaffolded (rust/FUZZING.md); CI smoke is proptest. | |
| cargo test --locked proptest_digest_hex_shape | |
| typescript: | |
| name: TypeScript lint/tests/property-vectors | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: "22" | |
| - name: Lint + tests + property / hash vectors | |
| run: | | |
| cd typescript | |
| npm ci | |
| npm run lint | |
| npm test | |
| npm run test:hash-vectors -w @pcs/core | |
| lean-pcs: | |
| name: Lean PCS build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - name: Install elan (checksum verified) | |
| run: bash scripts/install-elan-verified.sh | |
| - name: lake build PCS | |
| run: | | |
| export PATH="$HOME/.elan/bin:$PATH" | |
| cd lean | |
| lake build PCS | |
| lean-pf-core: | |
| name: Lean PF-Core build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install elan (checksum verified) | |
| run: bash scripts/install-elan-verified.sh | |
| - name: lake build PFCore + lean-check + proof binding | |
| run: | | |
| export PATH="$HOME/.elan/bin:$PATH" | |
| cd lean | |
| lake build PFCore | |
| cd ../python | |
| pip install -c requirements.lock -e . | |
| pcs capabilities | |
| pcs pf-core lean-check \ | |
| --trace ../examples/pf-core-valid/tool_use_trace_compiled/pfcore_trace.json \ | |
| --out /tmp/pfcore-ci-cert.json \ | |
| --result-out /tmp/pfcore-ci-lean-check.json | |
| pcs pf-core verify-proof-binding \ | |
| --certificate /tmp/pfcore-ci-cert.json \ | |
| --trace ../examples/pf-core-valid/tool_use_trace_compiled/pfcore_trace.json | |
| pcs pf-core validate-contracts \ | |
| ../examples/pf-core-valid/contract_checked/trace.json \ | |
| --contracts-dir ../examples/pf-core-valid/contract_checked | |
| certificate-mode-e2e: | |
| name: Certificate-mode end-to-end | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Certificate mode + mode-evidence suites | |
| run: | | |
| cd python | |
| pip install -c requirements.lock -e ".[dev]" | |
| pytest -q \ | |
| tests/test_pf_core_certificate_mode_status.py \ | |
| tests/test_pf_core_certificate_mode_codegen.py \ | |
| tests/test_pf_core_certificate_mode_resolution_vectors.py \ | |
| tests/test_pf_core_handoff_evidence.py \ | |
| tests/test_pf_core_contract_evidence.py \ | |
| tests/test_pf_core_effect_frame_evidence.py \ | |
| tests/test_pf_core_transition_evidence.py \ | |
| tests/test_pf_core_compositional.py | |
| cross-language-differential: | |
| name: Cross-language differential | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - uses: dtolnay/rust-toolchain@4d407b29186a635f0cc27475ef0bc0ae605a8866 # 1.86 | |
| - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: "22" | |
| - name: Python/Rust/TS differential + shared vectors | |
| run: | | |
| cd python | |
| pip install -c requirements.lock -e ".[dev]" | |
| pytest -q \ | |
| tests/test_pf_core_cross_language.py \ | |
| tests/test_pf_core_phase4_differential.py \ | |
| tests/test_pf_core_hash_vector_parity.py \ | |
| tests/test_canonical_hash_release.py \ | |
| tests/test_shared_hash_vectors.py \ | |
| tests/test_verifier_assurance_cross_language.py | |
| pcs shared-hash-vectors verify | |
| pcs conformance run --suite pf-core-cross-language | |
| pcs conformance run --suite verifier-assurance | |
| cd ../rust | |
| cargo test --locked pf_core -- --nocapture | |
| cargo test --locked hash_vectors | |
| cargo test --locked va_ -- --nocapture | |
| cd ../typescript | |
| npm ci | |
| npm test | |
| npm run test:hash-vectors -w @pcs/core | |
| semantic-projection-replay: | |
| name: Semantic-projection replay | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install elan (checksum verified) | |
| run: bash scripts/install-elan-verified.sh | |
| - name: PCS + PF-Core projection replay | |
| run: | | |
| export PATH="$HOME/.elan/bin:$PATH" | |
| cd python | |
| pip install -c requirements.lock -e ".[dev]" | |
| pytest -q \ | |
| tests/test_pcs_projection_binding.py \ | |
| tests/test_phase3_envelope_binding.py \ | |
| tests/test_pf_core_phase4_tcb.py \ | |
| tests/test_pf_core_bundle.py | |
| theorem-manifest-replay: | |
| name: Theorem-manifest replay | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install elan (checksum verified) | |
| run: bash scripts/install-elan-verified.sh | |
| - name: Theorem manifest binding + replay | |
| run: | | |
| export PATH="$HOME/.elan/bin:$PATH" | |
| cd python | |
| pip install -c requirements.lock -e ".[dev]" | |
| pytest -q tests/test_pf_core_theorem_manifest_binding.py | |
| scientific-payload-mutation: | |
| name: Scientific payload mutation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: ResultArtifact payload byte verification + mutations | |
| run: | | |
| cd python | |
| pip install -c requirements.lock -e ".[dev]" | |
| pytest -q \ | |
| tests/test_result_artifact_payload.py \ | |
| tests/test_computation_validate.py \ | |
| tests/test_computation_release_chain.py | |
| signature-key-revocation: | |
| name: Signature and key-revocation | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: ArtifactIntegrity Ed25519 + revocation | |
| run: | | |
| cd python | |
| pip install -c requirements.lock -e ".[dev]" | |
| pytest -q \ | |
| tests/test_artifact_integrity.py \ | |
| tests/test_certifyedge_pin.py \ | |
| tests/test_external_attestation.py \ | |
| tests/test_release_gates.py | |
| preview-release: | |
| name: Preview release workflow | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install elan (checksum verified) | |
| run: bash scripts/install-elan-verified.sh | |
| - name: Verify CertifyEdge pin (preview) | |
| run: python3 scripts/verify-certifyedge-pin.py --mode preview | |
| - name: Preview lean-check → bundle → validate → absence | |
| run: | | |
| set -euo pipefail | |
| export PATH="$HOME/.elan/bin:$PATH" | |
| export PCS_RELEASE_MODE=preview | |
| cd python | |
| pip install -c requirements.lock -e ".[dev,quality]" | |
| pcs pf-core lean-check \ | |
| --trace ../examples/pf-core-valid/tool_use_trace_compiled/pfcore_trace.json \ | |
| --out /tmp/pfcore-preview-cert.json \ | |
| --result-out /tmp/pfcore-preview-lean-check.json | |
| rm -rf /tmp/pfcore-preview-bundle | |
| mkdir -p /tmp/pfcore-preview-bundle | |
| pcs pf-core bundle-release \ | |
| --trace ../examples/pf-core-valid/tool_use_trace_compiled/pfcore_trace.json \ | |
| --cert /tmp/pfcore-preview-cert.json \ | |
| --lean-check-result /tmp/pfcore-preview-lean-check.json \ | |
| --out /tmp/pfcore-preview-bundle | |
| pcs pf-core validate-bundle /tmp/pfcore-preview-bundle | |
| python3 - <<'PY' | |
| import json | |
| from pathlib import Path | |
| root = Path("/tmp/pfcore-preview-bundle") | |
| manifest = json.loads((root / "manifest.json").read_text(encoding="utf-8")) | |
| lean_rel = manifest.get("lean_check_result_path") | |
| if not lean_rel: | |
| raise SystemExit("FAIL: preview bundle missing lean_check_result_path") | |
| if not (root / lean_rel).is_file(): | |
| raise SystemExit(f"FAIL: lean-check result missing at {lean_rel}") | |
| print(f"OK preview lean-check-result in bundle: {lean_rel}") | |
| PY | |
| pcs pf-core attest-bundle \ | |
| --bundle /tmp/pfcore-preview-bundle \ | |
| --property qc_release.temporal.safety \ | |
| --allow-absence || true | |
| pcs pf-core validate-external-attestation \ | |
| --bundle /tmp/pfcore-preview-bundle \ | |
| --allow-absence | |
| pcs pf-core validate-bundle /tmp/pfcore-preview-bundle | |
| mkdir -p ../dist/pf-core-preview-bundle | |
| cp -a /tmp/pfcore-preview-bundle/. ../dist/pf-core-preview-bundle/ | |
| - name: Upload preview release bundle | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: pcs-core-ci-preview-bundle | |
| path: dist/pf-core-preview-bundle/ | |
| retention-days: 7 | |
| stable-release-dry-run: | |
| name: Stable release dry-run | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install elan (checksum verified) | |
| run: bash scripts/install-elan-verified.sh | |
| - name: In-repo stable dry-run (live checker gated on pin/secrets) | |
| env: | |
| PF_CORE_CERTIFYEDGE_CLI_SECRET: ${{ secrets.PF_CORE_CERTIFYEDGE_CLI }} | |
| run: | | |
| set -euo pipefail | |
| export PATH="$HOME/.elan/bin:$PATH" | |
| cd python | |
| pip install -c requirements.lock -e ".[dev,quality]" | |
| # Always-blocking in-repo portion: lean-check → bundle → validate. | |
| pcs pf-core lean-check \ | |
| --trace ../examples/pf-core-valid/tool_use_trace_compiled/pfcore_trace.json \ | |
| --out /tmp/pfcore-stable-cert.json \ | |
| --result-out /tmp/pfcore-stable-lean-check.json | |
| rm -rf /tmp/pfcore-stable-bundle | |
| pcs pf-core bundle-release \ | |
| --trace ../examples/pf-core-valid/tool_use_trace_compiled/pfcore_trace.json \ | |
| --cert /tmp/pfcore-stable-cert.json \ | |
| --lean-check-result /tmp/pfcore-stable-lean-check.json \ | |
| --out /tmp/pfcore-stable-bundle | |
| pcs pf-core validate-bundle /tmp/pfcore-stable-bundle | |
| # Reject mock as release attestation (controlled negative). | |
| export PF_CORE_CERTIFYEDGE_MODE=mock | |
| if pcs pf-core certifyedge-check \ | |
| --trace ../examples/pf-core-valid/certifyedge_mock/trace.json \ | |
| --property qc_release.temporal.safety \ | |
| --out /tmp/PFCoreCertificate.certifyedge.mock.json; then | |
| attestation="$(python3 -c 'import json; c=json.load(open("/tmp/PFCoreCertificate.certifyedge.mock.json")); print(next((str(i.get("proof_ref") or "") for i in c.get("obligations") or [] if isinstance(i, dict)), ""))')" | |
| if echo "${attestation}" | grep -q '^mock://'; then | |
| echo "OK mock path remains available for dev but is not accepted as release attestation" | |
| fi | |
| fi | |
| unset PF_CORE_CERTIFYEDGE_MODE | |
| # Live controlled checker: only when pin verifies in release mode and CLI resolves. | |
| LIVE_READY=0 | |
| if python3 ../scripts/verify-certifyedge-pin.py --mode release; then | |
| set +e | |
| bash ../scripts/provision-certifyedge.sh | |
| prov_status=$? | |
| set -e | |
| if [ -f ../.tools/certifyedge/provision.env ]; then | |
| set -a | |
| # shellcheck source=/dev/null | |
| . ../.tools/certifyedge/provision.env | |
| set +a | |
| fi | |
| if [ -n "${PF_CORE_CERTIFYEDGE_CLI_SECRET:-}" ] && [ -f "${PF_CORE_CERTIFYEDGE_CLI_SECRET}" ]; then | |
| export PF_CORE_CERTIFYEDGE_CLI="${PF_CORE_CERTIFYEDGE_CLI_SECRET}" | |
| fi | |
| if [ -n "${PF_CORE_CERTIFYEDGE_CLI:-}" ] && [ -f "${PF_CORE_CERTIFYEDGE_CLI}" ]; then | |
| LIVE_READY=1 | |
| elif [ "${prov_status}" -eq 0 ] && [ -n "${PF_CORE_CERTIFYEDGE_CLI:-}" ] && [ -f "${PF_CORE_CERTIFYEDGE_CLI}" ]; then | |
| LIVE_READY=1 | |
| fi | |
| else | |
| echo "::notice::Stable live CertifyEdge dry-run gated: pin not release-ready (org secrets / pinned artifact)." | |
| fi | |
| if [ "${LIVE_READY}" = "1" ]; then | |
| export PF_CORE_CERTIFYEDGE_MODE=live | |
| export PF_CORE_CERTIFYEDGE_REQUIRE_LIVE=1 | |
| pcs pf-core attest-bundle \ | |
| --bundle /tmp/pfcore-stable-bundle \ | |
| --property qc_release.temporal.safety \ | |
| --require-live | |
| pcs pf-core validate-external-attestation \ | |
| --bundle /tmp/pfcore-stable-bundle \ | |
| --require-live | |
| echo "OK stable dry-run with controlled live checker" | |
| else | |
| echo "::notice::Skipping live attest-bundle; in-repo dry-run (bundle+mock-reject) passed." | |
| echo "Enable via pinned pins/certifyedge.json + secrets.PF_CORE_CERTIFYEDGE_CLI (see docs/pf-core/certifyedge-ci.md)." | |
| fi | |
| # Report org/infra gates without failing PR CI (release.yml is fail-closed). | |
| if pcs release check-gates --mode release; then | |
| echo "OK stable org/infra release gates closed" | |
| else | |
| echo "::notice::Stable org/infra gates still open (CertifyEdge pin / TrustedKeyRegistry / provenance). See docs/pf-core/operator-release-gates.md. release.yml fails closed." | |
| fi | |
| provenance-verification: | |
| name: Provenance verification | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| id-token: write | |
| attestations: write | |
| actions: read | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Build provenance binding (digest subjects) | |
| run: | | |
| set -euo pipefail | |
| cd python | |
| pip install -c requirements.lock -e "." | |
| pip install build | |
| cd .. | |
| export PCS_PROVENANCE_REQUIRE_SIGNED=0 | |
| export PCS_PROVENANCE_BUILD_SBOM=1 | |
| bash scripts/build-release-provenance.sh dist/provenance | |
| test -f dist/provenance/ReleaseProvenanceBinding.v0.json | |
| test -f dist/provenance/subjects-attest.sha256 | |
| python3 - <<'PY' | |
| import json | |
| from pathlib import Path | |
| from pcs_core.validate import validate_artifact | |
| binding = json.loads(Path("dist/provenance/ReleaseProvenanceBinding.v0.json").read_text(encoding="utf-8")) | |
| validate_artifact(binding, "ReleaseProvenanceBinding.v0", release_grade=False) | |
| print("OK provenance binding schema") | |
| PY | |
| - name: Attest build provenance (best-effort on PR CI) | |
| id: attest_prov | |
| continue-on-error: true | |
| uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0 | |
| with: | |
| subject-checksums: dist/provenance/subjects-attest.sha256 | |
| - name: Finalize + consumer-style verify | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| set -euo pipefail | |
| PROV_OK="${{ steps.attest_prov.outcome }}" | |
| if [ "${PROV_OK}" = "success" ]; then | |
| bash scripts/finalize-provenance-attestation.sh dist/provenance signed "" \ | |
| "${{ steps.attest_prov.outputs.attestation-id }}" \ | |
| "${{ steps.attest_prov.outputs.attestation-url }}" | |
| export PCS_PROVENANCE_REQUIRE_SIGNED=1 | |
| else | |
| REASON="PR CI attest-build-provenance outcome=${PROV_OK} (often gated on private-repo GHEC / org OIDC)." | |
| bash scripts/finalize-provenance-attestation.sh dist/provenance gated "${REASON}" "" "" | |
| export PCS_PROVENANCE_REQUIRE_SIGNED=0 | |
| echo "::notice::Signed provenance gated on org attestation capability; digest binding still verified." | |
| fi | |
| bash scripts/verify-release-provenance.sh dist/provenance | |
| pf-core-adapter: | |
| name: PF-Core adapter parity | |
| runs-on: ubuntu-latest | |
| continue-on-error: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/master' }} | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: PF-Core provability-fabric-core adapter parity | |
| run: bash scripts/run-pf-core-adapter-ci.sh | |
| validate-cli-contract: | |
| name: Validate CLI contract | |
| runs-on: ubuntu-latest | |
| needs: python-tests | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Required CLI commands | |
| run: | | |
| cd python | |
| pip install -c requirements.lock -e . | |
| pcs capabilities | |
| pcs release check-gates --mode preview | |
| pcs validate ../examples/science_claim_bundle.certified.valid.json | |
| pcs validate ../examples/signed_science_claim_bundle.valid.json | |
| pcs validate ../examples/labtrust/signed_science_claim_bundle.valid.json | |
| pcs validate ../examples/tool_use_trace.valid.json | |
| pcs validate ../examples/tool_use_certificate.valid.json | |
| pcs hash ../examples/science_claim_bundle.certified.valid.json | |
| pcs examples check | |
| pcs validate-release-chain ../examples/labtrust-release/ | |
| pcs validate-release-chain ../examples/tool-use-release/ | |
| pcs validate-release-chain ../examples/computation-release/ | |
| pcs conformance run --suite workflow-profile | |
| pcs conformance run --suite tool-use | |
| pcs conformance run --suite computation | |
| pcs conformance run --suite multidomain | |
| # Single required-check aggregator for branch protection convenience. | |
| ci-matrix-gate: | |
| name: CI matrix gate | |
| runs-on: ubuntu-latest | |
| needs: | |
| - python-tests | |
| - python-typecheck | |
| - python-coverage | |
| - rust | |
| - typescript | |
| - lean-pcs | |
| - lean-pf-core | |
| - certificate-mode-e2e | |
| - cross-language-differential | |
| - semantic-projection-replay | |
| - theorem-manifest-replay | |
| - scientific-payload-mutation | |
| - signature-key-revocation | |
| - preview-release | |
| - stable-release-dry-run | |
| - provenance-verification | |
| - validate-cli-contract | |
| steps: | |
| - name: All mandatory CI matrix jobs passed | |
| run: echo "OK CI matrix gate" |