Distribution: close the imports chain via catalog; ship the re-derivation kit #218
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ARCO Demo Run | |
| # Production pipeline run. Executes the full ARCO classification chain | |
| # (load ontology -> reason -> SHACL -> SPARQL -> emit certificate) on | |
| # every push and pull request to main, and publishes the latest output | |
| # to GitHub Pages on merge to main. | |
| # | |
| # What this gates (any failure fails the build): | |
| # - "ALL CHECKS PASSED" signal in the pipeline output. | |
| # - Four regression test scripts return 0: | |
| # * test_gate_removal.py (each Annex III 1(a) and 5(b) gate is independently necessary) | |
| # * test_scenarios.py (multi-scenario classification correctness) | |
| # * test_kiosk_html_no_false_concretization.py (L4.7 regression) | |
| # * test_adversarial_mechanism.py (decoy and ghost classification mechanism) | |
| # - Five expected artifact files exist in runs/demo/: | |
| # certificate.txt, summary.json, evidence.json, shacl_report.txt, | |
| # determination_view.html. | |
| # | |
| # What this publishes: | |
| # - runs/demo/ uploaded as a downloadable workflow artifact on every run. | |
| # - On main branch only: the contents of runs/demo/ also deploy to | |
| # GitHub Pages, so the latest certificate is one click away without | |
| # cloning the repo. | |
| # Pages URL: https://amosk21.github.io/ARCO/ (root redirects to | |
| # determination_view.html via a generated index.html). | |
| # | |
| # Independent OWL 2 DL cross-check runs in robot-validate.yml (HermiT | |
| # under the OWL 2 DL profile, separate workflow). Both must pass for a | |
| # clean CI. | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| jobs: | |
| arco-demo: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.10" | |
| - name: Install dependencies | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| - name: Run ARCO pipeline | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| mkdir -p runs/demo | |
| python -u 03_TECHNICAL_CORE/scripts/run_pipeline.py 2>&1 | tee runs/demo/demo.log | |
| - name: Assert pipeline passed | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if grep -q "ALL CHECKS PASSED" runs/demo/demo.log; then | |
| echo "Pipeline pass signal found in console output." | |
| else | |
| echo "FAIL: 'ALL CHECKS PASSED' not found in pipeline output." | |
| exit 1 | |
| fi | |
| - name: Run gate-removal regression tests | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| python -u 03_TECHNICAL_CORE/scripts/test_gate_removal.py | |
| - name: Run multi-scenario regression tests | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| python -u 03_TECHNICAL_CORE/scripts/test_scenarios.py | |
| - name: Run kiosk HTML no-false-concretization regression test (L4.7) | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| python -u 03_TECHNICAL_CORE/scripts/test_kiosk_html_no_false_concretization.py | |
| - name: Run adversarial-mechanism regression tests | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| python -u 03_TECHNICAL_CORE/scripts/test_adversarial_mechanism.py | |
| - name: Run canonical-IRI version-pin conformance test | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| python -u 03_TECHNICAL_CORE/scripts/test_canonical_iris.py | |
| - name: Verify artifact files exist | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| for f in certificate.txt summary.json evidence.json shacl_report.txt determination_view.html reasoned_graph.ttl; do | |
| if [ ! -f "runs/demo/$f" ]; then | |
| echo "FAIL: runs/demo/$f not found." | |
| exit 1 | |
| fi | |
| done | |
| echo "All artifact files present." | |
| - name: Publish result summary | |
| if: always() | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| echo "## ARCO Demo Result" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| if [ -f runs/demo/demo.log ]; then | |
| if grep -q "ALL CHECKS PASSED" runs/demo/demo.log; then | |
| echo "**Overall:** PASS" >> "$GITHUB_STEP_SUMMARY" | |
| elif grep -q "SOME CHECKS FAILED" runs/demo/demo.log; then | |
| echo "**Overall:** FAIL" >> "$GITHUB_STEP_SUMMARY" | |
| else | |
| echo "**Overall:** (unknown, check log)" >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "### Artifacts" >> "$GITHUB_STEP_SUMMARY" | |
| for f in runs/demo/*; do | |
| echo "- \`$(basename $f)\`" >> "$GITHUB_STEP_SUMMARY" | |
| done | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "**[View determination →](https://amosk21.github.io/ARCO/determination_view.html)**" >> "$GITHUB_STEP_SUMMARY" | |
| else | |
| echo "**Overall:** (no demo.log found)" >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| - name: Upload demo artifacts | |
| if: always() | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: arco-demo-artifacts | |
| path: runs/demo/ | |
| if-no-files-found: error | |
| - name: Add Pages root redirect | |
| if: github.ref == 'refs/heads/main' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| cat > runs/demo/index.html <<'EOF' | |
| <!DOCTYPE html> | |
| <html lang="en"> | |
| <head> | |
| <meta charset="utf-8"> | |
| <meta http-equiv="refresh" content="0; url=determination_view.html"> | |
| <link rel="canonical" href="determination_view.html"> | |
| <title>ARCO determination</title> | |
| </head> | |
| <body> | |
| <p>Redirecting to the <a href="determination_view.html">ARCO determination view</a>. If you are not redirected, follow the link.</p> | |
| </body> | |
| </html> | |
| EOF | |
| echo "Wrote runs/demo/index.html (root redirect to determination_view.html)." | |
| - name: Upload Pages artifact | |
| if: github.ref == 'refs/heads/main' | |
| uses: actions/upload-pages-artifact@v3 | |
| with: | |
| path: runs/demo/ | |
| deploy-pages: | |
| needs: arco-demo | |
| if: github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| environment: | |
| name: github-pages | |
| url: ${{ steps.deployment.outputs.page_url }} | |
| steps: | |
| - name: Deploy to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@v4 |