ci.yml

# SPDX-License-Identifier: Apache-2.0
name: ci

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  lint-and-compile:
    name: Lint + byte-compile
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: false

      - uses: actions/setup-python@v5
        with:
          python-version: '3.10'

      - name: Install lint tooling
        run: |
          python -m pip install --upgrade pip
          pip install ruff

      - name: ruff (lint)
        run: |
          ruff check .

      - name: py_compile every Python file
        run: |
          set -e
          # Compile every .py in the tree except the submodule and .git.
          mapfile -t files < <(git ls-files '*.py' | grep -v '^limxsdk-lowlevel/')
          if [ ${#files[@]} -eq 0 ]; then
            echo "no python files to compile"; exit 0
          fi
          python -m py_compile "${files[@]}"

  submodule-status:
    name: Submodule pin sanity
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: false

      - name: .gitmodules present and pinned
        run: |
          set -e
          test -f .gitmodules
          if ! grep -q 'path = limxsdk-lowlevel' .gitmodules; then
            echo "::error::.gitmodules missing limxsdk-lowlevel entry"
            exit 1
          fi
          if ! grep -q 'url = https://github.com/limxdynamics/limxsdk-lowlevel.git' .gitmodules; then
            echo "::error::limxsdk-lowlevel URL changed; requires SDK owner sign-off"
            exit 1
          fi
          # Report the pinned commit so reviewers see it in the CI log.
          git ls-tree HEAD limxsdk-lowlevel || true

  provenance:
    name: Model / weight / binary deny-list
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: false

      - name: Forbid weight / SDK / bag formats other than the grandfathered ONNX
        run: |
          set -e
          # Weight and SDK-binary formats we never ship in this repo.
          if git ls-files | grep -iE '\.(pt|pth|ckpt|safetensors|so|dll|dylib|lib|whl|bag|mcap)$'; then
            echo "::error::Repository must not contain PyTorch checkpoints, SDK binaries, or bag files"
            exit 1
          fi

      - name: ONNX files must live under controllers/model/**
        run: |
          set -e
          stray=$(git ls-files '*.onnx' | grep -v '^controllers/model/' || true)
          if [ -n "$stray" ]; then
            echo "::error::ONNX files outside controllers/model/ are not permitted:"
            echo "$stray"
            exit 1
          fi

      - name: Every checked-in ONNX has a THIRD_PARTY_NOTICES row and MODEL_CARD entry
        run: |
          set -e
          missing=0
          while IFS= read -r f; do
            [ -z "$f" ] && continue
            if ! grep -qF "$f" THIRD_PARTY_NOTICES.md; then
              echo "::error file=$f::missing row in THIRD_PARTY_NOTICES.md"
              missing=$((missing+1))
            fi
            if ! grep -qF "$f" MODEL_CARD.md; then
              echo "::error file=$f::missing entry in MODEL_CARD.md"
              missing=$((missing+1))
            fi
          done < <(git ls-files '*.onnx')
          if [ $missing -ne 0 ]; then exit 1; fi

  private-ip-scan:
    name: Private-IP scan (allowlisted)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: false

      - name: Scan for private IPs outside the annotated allowlist
        run: |
          set -e
          # Allowlist:
          #   127.0.0.1                  — loopback default in main.py
          #   10.192.1.2                 — appears only in Markdown prose that
          #                                references the sibling tron2-rl-deploy-ros
          #                                repo (per its SECURITY.md). This repo does
          #                                not embed the literal in source; the shipped
          #                                placeholder token is <robot-ip>.
          #   0.0.0.0                    — placeholder
          # Any OTHER RFC1918 / RFC6598 address is treated as a leak.
          pattern='([^0-9]|^)(10\.[0-9]+\.[0-9]+\.[0-9]+|192\.168\.[0-9]+\.[0-9]+|172\.(1[6-9]|2[0-9]|3[01])\.[0-9]+\.[0-9]+|100\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])\.[0-9]+\.[0-9]+)'
          allow='(127\.0\.0\.1|10\.192\.1\.2|0\.0\.0\.0)'
          bad=0
          while IFS= read -r f; do
            [ -z "$f" ] && continue
            # Extract IP-shaped tokens; drop allowlisted ones; report the rest.
            hits=$(grep -oE "$pattern" "$f" 2>/dev/null \
                     | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' \
                     | grep -vE "^$allow$" || true)
            if [ -n "$hits" ]; then
              echo "::error file=$f::private IP not on allowlist: $hits"
              bad=$((bad+1))
            fi
          done < <(git ls-files | grep -Ev '^(limxsdk-lowlevel/|LICENSE$|\.github/workflows/ci\.yml$)')
          if [ $bad -ne 0 ]; then exit 1; fi

  docs-scan:
    name: License / TODO scan + EXIF sanity
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: false

      - name: License / TODO / proprietary scan
        run: |
          set -e
          if grep -rniE 'proprietary|confidential|todo: license|unknown license' \
               README.md THIRD_PARTY_NOTICES.md MODEL_CARD.md \
               CHANGELOG.md CONTRIBUTING.md SECURITY.md; then
            echo "::error::Unresolved license / provenance markers in top-level docs"
            exit 1
          fi

      - name: Install exiftool
        run: sudo apt-get update && sudo apt-get install -y libimage-exiftool-perl

      - name: EXIF sanity for doc/ media
        run: |
          set -e
          bad=0
          shopt -s nullglob
          for f in doc/*.jpg doc/*.jpeg doc/*.png doc/*.gif doc/*.GIF; do
            [ -f "$f" ] || continue
            hits=$(exiftool "$f" 2>/dev/null | grep -iE '(gps|serial|author|artist|owner|copyright)' || true)
            if [ -n "$hits" ]; then
              echo "::error file=$f::EXIF discloses:"
              echo "$hits"
              bad=$((bad+1))
            fi
          done
          if [ $bad -ne 0 ]; then exit 1; fi