Joseph Magly
c352f34843
Make the contributor, CI, package, and tagged-release contracts agree with the shared BT6 baseline while preserving T3MP3ST's project-specific integrity checks. Exclude workspace-only material from published packages and keep local-agent detection tests host-independent.\n\nCloses #159
81 lines
2.6 KiB
YAML
81 lines
2.6 KiB
YAML
name: T3MP3ST CI
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches:
|
|
- main
|
|
tags:
|
|
- "v*"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: t3mp3st-ci-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 20
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
- run: npm ci
|
|
- run: npm run lint
|
|
- run: npm run typecheck
|
|
- run: npm test
|
|
# Enforce the 100% coverage gate on the new multi-language ingest files
|
|
# (vitest exits non-zero if a per-file threshold is missed).
|
|
- run: npm run test:coverage
|
|
- run: npm run doctor
|
|
# Honesty gates: prove the headline numbers re-derive and that no
|
|
# challenge-fitting has crept in. Public contributors / CI can verify.
|
|
- run: npm run verify-claims
|
|
- run: npm run test:no-fitting
|
|
- run: npm run test:no-self-fitting
|
|
# The provenance gate itself, in the compiled engine path (builds first).
|
|
- run: npm run test:gate
|
|
# The operator doctrine / prompt-pack contract must hold.
|
|
- run: npm run prompt:audit
|
|
# Non-network smoke: core traps run deterministically; server/live tiers
|
|
# auto-skip when no server/LLM is present (they are absent in CI).
|
|
- run: npm run smoke
|
|
|
|
release:
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
needs: test
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
ref: ${{ github.sha }}
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: 22
|
|
cache: npm
|
|
- run: npm ci
|
|
- run: npm run test:release
|
|
- run: npm audit --audit-level=high
|
|
- run: npm run pack:dry-run
|
|
- run: npm pack --json > pack-result.json
|
|
- name: Record release checksums
|
|
run: |
|
|
package_file="$(node -e "const fs=require('fs'); const p=JSON.parse(fs.readFileSync('pack-result.json')); process.stdout.write(p[0].filename)")"
|
|
sha256sum "$package_file" > SHA256SUMS
|
|
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
|
|
with:
|
|
name: tested-package-${{ github.sha }}
|
|
path: |
|
|
*.tgz
|
|
SHA256SUMS
|
|
pack-result.json
|
|
if-no-files-found: error
|
|
retention-days: 14
|