Fix parallel execution ordering and address release audit findings. #392
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.11' | |
| - name: Install package | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -e '.[dev]' | |
| - name: Lint | |
| run: ruff check ovk tests benchmarks/formal_pr_bench | |
| - name: Test | |
| run: pytest | |
| - name: Validate intent templates | |
| run: python scripts/validate_templates.py | |
| - name: Score all benchmark cases | |
| run: python benchmarks/formal_pr_bench/score_all_lanes.py | |
| - name: Score expanded benchmark and publish leaderboard | |
| run: | | |
| ovk bench --expanded --leaderboard .verification/formal-pr-bench-leaderboard.json | |
| - name: Pilot program | |
| run: ovk pilot | |
| - name: Exercise ovk check on multi-surface PR | |
| run: | | |
| ovk check \ | |
| --changed-files examples/multi_surface/pr_combined.diff \ | |
| --output-dir .ovk-check-test \ | |
| --advisory | |
| - name: Release preflight | |
| run: ovk release-preflight | |
| - name: External smoke checklist | |
| run: python scripts/external_smoke_checklist.py | |
| - name: Multi-lane verify bundle | |
| run: | | |
| ovk verify \ | |
| --manifest examples/verification_manifests/full_mvp.json \ | |
| --output-dir ovk-full-bundle \ | |
| --advisory | |
| - name: Validate release bundle outputs | |
| run: ovk validate-outputs ovk-full-bundle | |
| - name: Signed envelope smoke | |
| env: | |
| OVK_SIGNING_KEY: ci-signing-smoke-key | |
| run: | | |
| ovk release-bundle \ | |
| --lane infrastructure \ | |
| --input examples/infrastructure_exposure/input_private_sensitive_resource.json \ | |
| --output-dir ovk-signed-bundle | |
| test -f ovk-signed-bundle/ovk-attestation-envelope.json | |
| grep -q '"signature"' ovk-signed-bundle/ovk-attestation-envelope.json | |
| - name: Exercise self-protection CI path | |
| run: | | |
| ovk ci \ | |
| --github-event examples/github_events/pull_request_bot.json \ | |
| --metadata examples/no_agent_self_approval/metadata_missing_required_checks.json \ | |
| --changed-files examples/no_agent_self_approval/changed_files_workflow.txt \ | |
| --check-metadata examples/no_agent_self_approval/check_metadata_github_shape_removed.json \ | |
| --evidence-output ovk-evidence.json \ | |
| --markdown-output ovk-pr-comment.md \ | |
| --attestation-output ovk-attestation.json \ | |
| --manifest-output ovk-artifact-manifest.json \ | |
| --quality-output ovk-evidence-quality.json \ | |
| --advisory | |
| - name: Exercise auth-obligation with quality output | |
| run: | | |
| ovk auth-obligation \ | |
| examples/auth_regression/input_admin_protected.json \ | |
| --evidence-output ovk-auth-evidence.json \ | |
| --markdown-output ovk-auth-comment.md \ | |
| --attestation-output ovk-auth-attestation.json \ | |
| --manifest-output ovk-auth-artifact-manifest.json \ | |
| --quality-output ovk-auth-evidence-quality.json \ | |
| --advisory | |
| - name: Exercise ci-secrets with quality output | |
| run: | | |
| ovk ci-secrets \ | |
| examples/ci_secrets/input_secrets_safe.json \ | |
| --evidence-output ovk-ci-secrets-evidence.json \ | |
| --markdown-output ovk-ci-secrets-comment.md \ | |
| --attestation-output ovk-ci-secrets-attestation.json \ | |
| --manifest-output ovk-ci-secrets-artifact-manifest.json \ | |
| --quality-output ovk-ci-secrets-evidence-quality.json \ | |
| --advisory | |
| - name: Exercise deployment-state with quality output | |
| run: | | |
| ovk deployment-state \ | |
| examples/deployment_state/input_valid_approval_path.json \ | |
| --evidence-output ovk-deployment-evidence.json \ | |
| --markdown-output ovk-deployment-comment.md \ | |
| --attestation-output ovk-deployment-attestation.json \ | |
| --manifest-output ovk-deployment-artifact-manifest.json \ | |
| --quality-output ovk-deployment-evidence-quality.json \ | |
| --advisory | |
| - name: Dogfood composite action (full MVP manifest) | |
| uses: ./ | |
| with: | |
| mode: advisory | |
| verification-manifest: examples/verification_manifests/full_mvp.json | |
| bundle-output-dir: ovk-action-dogfood-bundle | |
| - name: Validate dogfood release bundle | |
| run: ovk validate-outputs ovk-action-dogfood-bundle | |
| - name: Upload OVK artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: ovk-ci-artifacts | |
| path: | | |
| ovk-evidence.json | |
| ovk-pr-comment.md | |
| ovk-attestation.json | |
| ovk-artifact-manifest.json | |
| ovk-evidence-quality.json | |
| ovk-auth-evidence-quality.json | |
| ovk-ci-secrets-evidence-quality.json | |
| ovk-deployment-evidence-quality.json | |
| ovk-action-dogfood-bundle/** | |
| .verification/formal-pr-bench-leaderboard.json | |
| action_strict_dogfood: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| checks: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Strict emit-check on known-bad diff | |
| id: ovk | |
| uses: ./ | |
| with: | |
| mode: strict | |
| use-check: "true" | |
| emit-check: "true" | |
| changed-files: examples/ci_secrets/workflow_secrets_on_pr.diff | |
| post-comment: "false" | |
| - name: Assert strict block and observable check | |
| run: | | |
| test "${{ steps.ovk.outcome }}" = "failure" | |
| test "${{ steps.ovk.outputs.recommendation }}" = "block" | |
| test "${{ steps.ovk.outputs.exit_code }}" = "1" | |
| package: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Build sdist and wheel | |
| run: | | |
| python -m pip install --upgrade pip build twine | |
| python scripts/sync_package_data.py | |
| python -m build | |
| twine check dist/* |