grift-cli 0.5.9__tar.gz → 0.7.2__tar.gz

grift_cli-0.7.2/.github/workflows/ci.yml

@@ -0,0 +1,456 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12"]
+    steps:
+      # Full history: the checked-in scenario registry binds its evidence to
+      # the source-tree commit that produced it, and the unit tests verify
+      # that binding by reading the recorded commit from this clone.
+      #
+      # Checked out under `sender/` so the public intake can sit beside it as a
+      # real sibling. actions/checkout refuses a path outside the workspace, so
+      # the alternative -- receiver inside the working tree -- would leave an
+      # untracked repository in the tree the tests analyse.
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          path: sender
+      # tests/test_v070_intake_contract.py compares this repository's PURPOSES
+      # against the schema the public intake actually enforces, and skips when
+      # the receiver is absent. It was absent here, so the comparison never ran
+      # in CI -- which is how v0.7.0 shipped a purpose the intake rejects.
+      # Pinned to the same immutable SHA as the intake-contract-parity job.
+      - uses: actions/checkout@v4
+        with:
+          repository: Cor-Incorporated/tep-contributions
+          ref: 173fac600f3ce64e6df1ca86565f427a391810cc
+          path: tep-contributions
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install
+        working-directory: sender
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+      - name: Unit tests
+        working-directory: sender
+        run: python -m pytest tests -m "not golden"
+      # A skipped cross-repository test is indistinguishable from a passing one
+      # in the job summary. This step fails the build on the skip itself, so a
+      # checkout that stops resolving is loud instead of silently green.
+      - name: The intake comparison must run, not skip
+        working-directory: sender
+        env:
+          INTAKE_RUN_LOG: ${{ runner.temp }}/intake-not-skipped.log
+        run: |
+          set -euo pipefail
+          python -m pytest tests/test_v070_intake_contract.py -rs -q \
+            | tee "$INTAKE_RUN_LOG"
+          if grep -q "SKIPPED" "$INTAKE_RUN_LOG"; then
+            echo "::error::the public intake checkout is not visible to" \
+              "tests/test_v070_intake_contract.py; the purpose comparison did" \
+              "not run" >&2
+            grep "SKIPPED" "$INTAKE_RUN_LOG" >&2
+            exit 1
+          fi
+
+  p0-falsify:
+    # The P0 falsification suite is the norms gate: it proves that missing
+    # input is reported as a reasoned not_observed instead of a refusal or a
+    # fabricated zero. It ran only in publish.yml, so v0.7.0 and v0.7.1 both
+    # shipped with `grift actor <actor with no commits>` exiting 2, and the
+    # failure was first seen in the release run (34069987423) rather than on
+    # the pull request that caused it. Running it here moves that discovery
+    # left of the tag.
+    #
+    # H5-PAIR: publish.yml baseline pin ↔ this job's baseline pin;
+    # mutation=changing one pin alone is red in
+    # tests/test_publish_baseline_pin.py.
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      # Same immutable commit and same env var name as publish.yml, so a green
+      # CI run and a green release run mean the same thing.
+      # tests/test_publish_baseline_pin.py links the pins in the two files.
+      - name: Checkout frozen v0.5.9 compatibility baseline
+        uses: actions/checkout@v4
+        with:
+          repository: Cor-Incorporated/grift-cli
+          ref: 6711a3cdcb71f2a2a84276ac5e7a5abd4a7bf79f
+          path: .release-baselines/grift-cli-v059
+          fetch-depth: 1
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+      - name: P0 falsification suite
+        env:
+          GRIFT_V059_ROOT: ${{ github.workspace }}/.release-baselines/grift-cli-v059
+        run: |
+          set -euo pipefail
+          mkdir -p p0-evidence
+          test "$(git -C "$GRIFT_V059_ROOT" rev-parse HEAD)" = \
+            "6711a3cdcb71f2a2a84276ac5e7a5abd4a7bf79f"
+          python tests/fixtures/v060/run_p0_falsify.py
+          cp /tmp/grift-v060-falsify/p0-results.json p0-evidence/p0-results.json
+      - name: Upload P0 falsification evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: p0-falsify-${{ github.event.pull_request.head.sha || github.sha }}
+          path: p0-evidence/
+          if-no-files-found: error
+
+  intake-contract-parity:
+    # H5-guard: yes
+    # H5-NEGATIVE: six of eight real sender->receiver cases must fail closed
+    # (masked/raw public door, digest, replay, authority, GitLab linkage).
+    # H5-LEDGER: every case and both immutable commits are written to
+    # guard-ledger.jsonl and uploaded even when the gate fails.
+    # H5-RETIRE: retire only after the public intake is versioned in the same
+    # release artifact and three consecutive exact-SHA replacement runs pass.
+    # H5-PAIR: immutable checkout refs ↔ expected-SHA runtime enforcement;
+    # mutation=floating ref, shallow checkout, or omitted expected SHA is red.
+    if: github.event_name != 'schedule'
+    needs: test
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+    env:
+      SENDER_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+      COMPANION_SHA: 173fac600f3ce64e6df1ca86565f427a391810cc
+    steps:
+      - name: Checkout immutable sender
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          path: sender
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Checkout immutable intake receiver
+        uses: actions/checkout@v4
+        with:
+          repository: Cor-Incorporated/tep-contributions
+          ref: 173fac600f3ce64e6df1ca86565f427a391810cc
+          path: receiver
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Run real sender to receiver parity under socket denial
+        working-directory: sender
+        env:
+          INTAKE_EVIDENCE: ${{ runner.temp }}/intake-contract-evidence
+        run: |
+          set -euo pipefail
+          mkdir -p "$INTAKE_EVIDENCE"
+          python scripts/intake_contract_parity.py \
+            --companion-root ../receiver \
+            --expected-sender-sha "$SENDER_SHA" \
+            --expected-companion-sha "$COMPANION_SHA" \
+            --require-companion-clean \
+            --result "$INTAKE_EVIDENCE/result.json" \
+            --ledger "$INTAKE_EVIDENCE/guard-ledger.jsonl" \
+            | tee "$INTAKE_EVIDENCE/run.log"
+      - name: Upload intake parity evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: intake-contract-parity-${{ github.event.pull_request.head.sha || github.sha }}
+          path: ${{ runner.temp }}/intake-contract-evidence/
+          if-no-files-found: error
+
+  exact-pr-head:
+    # The normal pull_request jobs intentionally test GitHub's merge ref.
+    # This independent gate proves the same suite on the immutable PR head.
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Bind execution to the exact PR head
+        env:
+          EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          EXACT_HEAD_EVIDENCE: ${{ runner.temp }}/exact-head-evidence
+        run: |
+          set -euo pipefail
+          actual_head_sha="$(git rev-parse HEAD)"
+          test "$actual_head_sha" = "$EXPECTED_HEAD_SHA"
+          mkdir -p "$EXACT_HEAD_EVIDENCE"
+          python - << 'PY'
+          import json
+          import os
+          import subprocess
+          from pathlib import Path
+
+          actual = subprocess.check_output(
+              ["git", "rev-parse", "HEAD"], text=True
+          ).strip()
+          expected = os.environ["EXPECTED_HEAD_SHA"]
+          Path(os.environ["EXACT_HEAD_EVIDENCE"]).joinpath("head.json").write_text(
+              json.dumps(
+                  {
+                      "schema_version": "grift-exact-head-v1",
+                      "expected_head_sha": expected,
+                      "actual_head_sha": actual,
+                      "status": "VERIFIED" if actual == expected else "MISMATCH",
+                  },
+                  sort_keys=True,
+              )
+              + "\n",
+              encoding="utf-8",
+          )
+          PY
+      - name: Install exact-head test dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+      - name: Unit tests on exact PR head
+        run: python -m pytest tests -m "not golden"
+      - name: Analyze and verify the exact PR head
+        env:
+          EXPECTED_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          EXACT_HEAD_EVIDENCE: ${{ runner.temp }}/exact-head-evidence
+        run: |
+          set -euo pipefail
+          collection="$EXACT_HEAD_EVIDENCE/self-analysis"
+          grift repo . \
+            --rev "$EXPECTED_HEAD_SHA" \
+            --actors \
+            --format both \
+            --out "$collection" \
+            > "$EXACT_HEAD_EVIDENCE/repo.log"
+          grift verify "$collection" --repo . \
+            | tee "$EXACT_HEAD_EVIDENCE/verify.log"
+          python - << 'PY'
+          import hashlib
+          import json
+          import os
+          from pathlib import Path
+
+          root = Path(os.environ["EXACT_HEAD_EVIDENCE"])
+          manifest_path = root / "self-analysis" / "collection-manifest.json"
+          index_path = root / "self-analysis" / "actor-index.json"
+          manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+          index = json.loads(index_path.read_text(encoding="utf-8"))
+          expected = os.environ["EXPECTED_HEAD_SHA"]
+          actual = manifest["target"]["oid"]["value"]
+          if actual != expected:
+              raise SystemExit(
+                  f"self-analysis target mismatch: expected {expected}, got {actual}"
+              )
+          proof = {
+              "schema_version": "grift-exact-head-self-analysis-v1",
+              "status": "VERIFIED",
+              "expected_head_sha": expected,
+              "analyzed_oid": manifest["target"]["oid"],
+              "full_actor_count": index["population"]["actor_count"],
+              "selected_actor_count": index["selection"]["selected_count"],
+              "manifest_sha256": hashlib.sha256(manifest_path.read_bytes()).hexdigest(),
+              "actor_index_sha256": hashlib.sha256(index_path.read_bytes()).hexdigest(),
+          }
+          (root / "self-analysis.json").write_text(
+              json.dumps(proof, sort_keys=True) + "\n",
+              encoding="utf-8",
+          )
+          PY
+      - name: Upload exact-head evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: exact-pr-head-${{ github.event.pull_request.head.sha }}
+          path: ${{ runner.temp }}/exact-head-evidence/
+          if-no-files-found: error
+
+  golden:
+    if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+      - name: Golden corpus (G1-G5 + schema/export parity)
+        env:
+          TEP_GOLDEN: "1"
+        run: python -m pytest -m golden
+
+  v060-golden:
+    # Declaration: the closed fixture/hash manifest and D0-D4 drift policy.
+    # Enforcement: execute the installed CLI against a newly materialized Git
+    # repository, then verify and compare every registered output artifact.
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    needs: test
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+      - name: Replay v0.6 CLI golden fixture
+        run: |
+          set -euo pipefail
+          mkdir -p golden-evidence
+          python scripts/v060_golden.py \
+            --result golden-evidence/v060-golden-result.json \
+            | tee golden-evidence/v060-golden.log
+      - name: Verify sanitized public scenario digest registry
+        run: |
+          set -euo pipefail
+          python scripts/v060_scenario_matrix.py \
+            --verify-registry \
+            --digest-only \
+            --output-root evidence/v060/scenarios-public \
+            | tee golden-evidence/v060-public-registry.log
+      - name: Upload v0.6 golden evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: v060-golden-${{ github.sha }}
+          path: golden-evidence/
+          if-no-files-found: error
+
+  action-dogfood:
+    # Read-only proof boundary: invoke the shipped composite action for
+    # scope=repo, install-source=checkout, comment=false; exercise the complete
+    # history preflight; and require non-empty report artifacts. This job does
+    # not prove the PyPI install or PR-comment paths. Those remain separate
+    # post-publish/trusted-workflow gates.
+    # RETIRE: remove the local input guard only after 3 consecutive successful
+    # pinned-PyPI canary runs and a replacement-guard PR records their run URLs.
+    if: github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Verify action input guard and write its ledger
+        run: |
+          set -euo pipefail
+          python scripts/action_contract_guard.py \
+            --ledger action-evidence/guard-ledger.jsonl
+      - name: Run the composite action against this repo
+        uses: ./
+        with:
+          scope: repo
+          install-source: checkout
+          # PR-controlled code never receives a write token. Comment delivery
+          # must be exercised by a trusted post-workflow, not this job.
+          comment: false
+      - name: Assert the action produced the expected artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -s .grift/report.md
+          test -s .grift/report.json
+          test -s .grift/shared-block.md
+          python3 - << 'EOF'
+          import json
+          report = json.load(open('.grift/report.json'))
+          assert report['schema_version'] == 'report-v1'
+          print(
+              'action-dogfood: composite action ran, '
+              'report-v1 OK, shared block OK'
+          )
+          EOF
+      - name: Upload action guard evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: action-guard-${{ github.sha }}
+          path: action-evidence/guard-ledger.jsonl
+          if-no-files-found: error
+
+  package-smoke:
+    # Declaration: pyproject sdist/wheel allowlists. Enforcement: this job
+    # builds from a deliberately dirty source tree, inventories every member,
+    # and installs the two artifacts in independent clean virtualenvs.
+    if: github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install package verification dependencies
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+      - name: Dirty-source build and clean-install smoke
+        run: |
+          set -euo pipefail
+          mkdir -p package-evidence
+          python scripts/package_smoke.py \
+            --out package-dist \
+            --ledger package-evidence/guard-ledger.jsonl \
+            | tee package-evidence/package-smoke.log
+      - name: Upload package guard evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: package-guard-${{ github.sha }}
+          path: |
+            package-dist/
+            package-evidence/
+          if-no-files-found: error