pactkit 4.1.3__tar.gz → 4.2.0__tar.gz

pactkit-4.2.0/.github/workflows/release-acceptance.yml

@@ -0,0 +1,330 @@
+name: Release Acceptance
+
+# STORY-slim-20260911b2bbd79889e0 C2/R8 + 2026-09-11 reviews: install the
+# ACTUAL core wheel that is about to ship in a clean environment and prove
+# the package-level surface. The ordinary CI tests the editable checkout;
+# it cannot see packaging-level breaks (missing files in the wheel,
+# dependency misdeclaration). This job can. publish.yml waits for this
+# workflow's conclusion before publishing a tag.
+#
+# Zero-credential split (2026-09-11, first real runner run 34607922520):
+# GITHUB_TOKEN cannot read the private adapter repos, and the owner chose
+# no PAT/secrets. The core wheel + adapter COMBO acceptance therefore runs
+# in each adapter repo's own release-acceptance workflow — it checks out
+# ITSELF (its token suffices) and installs the RELEASED core from PyPI,
+# which the resolver pins for real. Each adapter repo covers classic + its
+# own host; the union covers all three. What remains here is the core-only
+# quality gate: wheel build/install/version, documented extras, wheel-mode
+# prompt snapshots (classic; the host assertion scales with installed
+# adapters), and the classic journey.
+
+on:
+  push:
+    branches: [main]
+    # Same inert-doc set as PactKit CI — spec/acceptance docs are not in the
+    # wheel, so the packaging assertions cannot see them.  Tags always run
+    # (publish gate) regardless of paths.
+    paths-ignore:
+      - "docs/specs/**"
+      - "docs/acceptance/**"
+    tags: ["v*"]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: "daily (3.11 single version) or release (3.10-3.13 full matrix)"
+        type: choice
+        options: [daily, release]
+        default: daily
+
+# STORY-slim-20260917c943d7aaeb7c (CI cost): same rationale as PactKit CI —
+# cancel superseded branch runs.  Tag runs are excluded from the group name
+# so a push to main can never cancel an in-flight tag acceptance that
+# publish.yml is waiting on.
+concurrency:
+  group: release-acceptance-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # R4 (STORY-slim-20260917c18f4a962b70): the acceptance matrix is layered
+  # by event — daily (PR / push main / manual daily) proves the 3.11
+  # baseline cheaply; release (tag v* / manual release) proves the full
+  # supported range.  The assertions are IDENTICAL in both configs — only
+  # the version dimension shrinks (降低版本维度不删验收断言).  PRs and main
+  # both run: a PR green light never skips the final main integration run;
+  # an opened PR's branch pushes fire `synchronize` and rerun this workflow.
+  config:
+    # 2026-09-24: the org `actions` budget is $0 with prevent_further_usage, so
+    # a job that asks for `ubuntu-latest` gets no runner at all (runner_id=0,
+    # seconds to fail) — see the runner migration in the sibling workflow. The
+    # org-level runner carries the `slimmini` label. The budget blocks hosted
+    # jobs for private repos only; public repos are unaffected.
+    runs-on: slimmini
+    outputs:
+      versions: ${{ steps.pick.outputs.versions }}
+      config_name: ${{ steps.pick.outputs.config_name }}
+    steps:
+      - name: Pick the acceptance matrix for this event
+        id: pick
+        run: |
+          if [[ "${{ github.ref }}" == refs/tags/v* ]] \
+             || [[ "${{ inputs.mode }}" == "release" ]]; then
+            echo 'versions=["3.10","3.11","3.12","3.13"]' >> "$GITHUB_OUTPUT"
+            echo "config_name=release (full 3.10-3.13 matrix)" >> "$GITHUB_OUTPUT"
+          else
+            echo 'versions=["3.11"]' >> "$GITHUB_OUTPUT"
+            echo "config_name=daily (3.11 single version)" >> "$GITHUB_OUTPUT"
+          fi
+
+  core-wheel:
+    needs: config
+    # See the `config` job above for why this is not `ubuntu-latest`.
+    runs-on: slimmini
+    strategy:
+      fail-fast: false
+      # R8: the accepted Python range must match what the package claims
+      # (pyproject requires-python >=3.10) — proven IN FULL on release
+      # events; daily events prove the 3.11 baseline only.
+      matrix:
+        python-version: ${{ fromJSON(needs.config.outputs.versions) }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Isolated environment
+        run: |
+          python -m venv "$RUNNER_TEMP/pactkit-venv"
+          echo "$RUNNER_TEMP/pactkit-venv/bin" >> "$GITHUB_PATH"
+
+      - name: Verify the environment is isolated
+        run: |
+          test "$(command -v python)" = "$RUNNER_TEMP/pactkit-venv/bin/python"
+          test "$(command -v pip)" = "$RUNNER_TEMP/pactkit-venv/bin/pip"
+          python -c "import sys; print('isolated venv:', sys.prefix)"
+
+      - name: Build the core wheel
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build --wheel --outdir dist/ .
+          python -m build --sdist --outdir dist/ .
+
+      # STORY-slim-20260917beaa87bc5d27: the dev repo is private and the
+      # public mirror is curated docs only — for a procurement review the
+      # PyPI artifacts ARE the source of record for license and code.  A
+      # packaging regression that drops LICENSE from the wheel/sdist would
+      # otherwise surface as a customer-side legal question, not a red build.
+      - name: Built artifacts carry LICENSE and sources (procurement)
+        run: |
+          python -m pip install --upgrade pip build > /dev/null 2>&1 || true
+          WHEEL=$(ls dist/pactkit-*.whl)
+          SDIST=$(ls dist/pactkit-*.tar.gz)
+          python - "$WHEEL" "$SDIST" <<'PY'
+          import sys, tarfile, zipfile
+          wheel, sdist = sys.argv[1], sys.argv[2]
+          names = zipfile.ZipFile(wheel).namelist()
+          assert any(n.endswith("LICENSE") for n in names), "wheel is missing LICENSE"
+          py = [n for n in names if n.endswith(".py")]
+          assert len(py) >= 90, f"wheel source count suspicious: {len(py)} files"
+          tarnames = tarfile.open(sdist).getnames()
+          assert any(n.endswith("LICENSE") for n in tarnames), "sdist is missing LICENSE"
+          assert any(n.endswith("src/pactkit/__init__.py") for n in tarnames), "sdist is missing sources"
+          print(f"LICENSE + sources verified: wheel {len(py)} .py, sdist ok")
+          PY
+
+      - name: The runner provides a per-job temp directory
+        run: |
+          # Every path below lives under $RUNNER_TEMP, not /tmp. On a hosted
+          # runner /tmp is a fresh VM per run, so a leftover venv was
+          # impossible; on a persistent self-hosted runner it survives, and
+          # the AC11 assertion below would then be checking a venv built by an
+          # earlier run — a clean-environment guarantee that quietly stopped
+          # holding. Assert the runner supplies the directory rather than
+          # discovering it as a stray `/accept`.
+          test -n "$RUNNER_TEMP" \
+            || { echo "::error::RUNNER_TEMP is unset — this job needs a runner that provides one"; exit 1; }
+
+      - name: Install from the wheel into a clean environment (AC11)
+        run: |
+          python -m venv "$RUNNER_TEMP/accept"
+          # Direct wheel path: the package under acceptance comes from the
+          # local dist/ (never PyPI, never editable); third-party deps
+          # (pyyaml) resolve from the index.
+          "$RUNNER_TEMP/accept/bin/pip" install dist/pactkit-*.whl
+          ! "$RUNNER_TEMP/accept/bin/pip" list | grep -q '\-e '
+          "$RUNNER_TEMP/accept/bin/pactkit" version
+
+      - name: Base wheel + documented extras resolve (AC11)
+        run: |
+          python -m venv "$RUNNER_TEMP/extras"
+          # The extras README documents must actually resolve from the built
+          # wheel. Adapter extras are deliberately excluded here: they pin
+          # the released core from the index, which during release prep is
+          # older than this build (core-first publish order).
+          WHEEL=$(ls dist/pactkit-*.whl)
+          "$RUNNER_TEMP/extras/bin/pip" install "$WHEEL[lint,visualize]"
+          "$RUNNER_TEMP/extras/bin/pactkit" version
+
+      - name: Prompt-body snapshots from the wheel (AC10/R7)
+        env:
+          PACTKIT_SNAPSHOT_FROM_WHEEL: "1"
+          # The runner is persistent, so /tmp is shared across jobs: a pytest
+          # tmp_path under it can walk up into host markers an earlier job left
+          # behind. runner.temp is created and cleaned per job. Step-level, not
+          # workflow-level — the `runner` context is not available there and
+          # GitHub rejects the whole file for it.
+          TMPDIR: ${{ runner.temp }}
+        run: |
+          # Wheel mode: the deploy subprocesses must import the WHEEL — no
+          # checkout PYTHONPATH, provenance asserted (site-packages origin),
+          # and every installed host participates in the comparison (this
+          # core-only environment compares classic; each adapter repo's
+          # acceptance adds its own host). A skip fails the step. The empty
+          # `-c` ini keeps the checkout's pyproject (pythonpath=src) from
+          # shadowing the installed wheel.
+          "$RUNNER_TEMP/accept/bin/pip" install pytest
+          printf '[pytest]\n' > "$RUNNER_TEMP/acceptance-pytest.ini"
+          cd "$RUNNER_TEMP"
+          "$RUNNER_TEMP/accept/bin/pytest" \
+            "$GITHUB_WORKSPACE/tests/unit/test_c1_body_snapshots.py" \
+            -c "$RUNNER_TEMP/acceptance-pytest.ini" -p no:cacheprovider \
+            --junitxml="$RUNNER_TEMP/snap-results.xml" -q \
+            || { echo "::error::prompt-body snapshot comparison failed"; exit 1; }
+          # The heredoc is quoted, so the path is passed as an argument rather
+          # than interpolated.
+          "$RUNNER_TEMP/accept/bin/python" - "$RUNNER_TEMP/snap-results.xml" <<'EOF'
+          import sys
+          import xml.etree.ElementTree as ET
+
+          root = ET.parse(sys.argv[1]).getroot()
+          skipped = sum(int(s.get("skipped", 0)) for s in root.iter("testsuite"))
+          errors = sum(int(s.get("errors", 0)) for s in root.iter("testsuite"))
+          if skipped or errors:
+              print(f"::error::snapshot step: {skipped} skipped, {errors} errors — "
+                    "skip is failure under release acceptance")
+              sys.exit(1)
+          print("snapshots: 0 skipped, 0 errors")
+          EOF
+
+      - name: Classic journey from the wheel (AC12, CLI layer)
+        run: |
+          # The CLI is invoked by ABSOLUTE PATH from the acceptance venv
+          # (review round 2, F3): a bare `pactkit` would resolve against
+          # whatever the runner has preinstalled — or nothing at all.
+          # OpenCode/Codex journeys run in their own adapter repos'
+          # acceptance workflows (zero-credential split).
+          PACTKIT="$RUNNER_TEMP/accept/bin/pactkit"
+          command -v "$PACTKIT" >/dev/null 2>&1 \
+            || { echo "::error::acceptance venv has no pactkit entry point"; exit 1; }
+          export HOME="$RUNNER_TEMP/journey-home"
+          export XDG_CONFIG_HOME="$RUNNER_TEMP/journey-home/.config"
+          rm -rf "$HOME" "$RUNNER_TEMP/journey-proj"
+          mkdir -p "$HOME" "$RUNNER_TEMP/journey-proj"
+          cd "$RUNNER_TEMP/journey-proj"
+          git init -q .
+          git config user.email journey@example.invalid
+          git config user.name journey
+
+          fail() { echo "::error::journey: $1"; exit 1; }
+          root="$HOME/.claude"
+          "$PACTKIT" version
+          "$PACTKIT" init --format classic > init.log 2>&1 \
+            || { cat init.log; fail "classic init failed"; }
+          [ -f "$root/.pactkit-deployed.json" ] || fail "no deployment manifest"
+          entry="$root/skills/project-plan/SKILL.md"
+          [ -f "$entry" ] || fail "method entry point missing ($entry)"
+
+          mkdir -p "$root/rules"
+          printf '# My team conventions\n- ours, not PactKit\x27s\n' > "$root/rules/my-team.md"
+          "$PACTKIT" update --format classic > update.log 2>&1 \
+            || { cat update.log; fail "classic update failed"; }
+          [ -f "$root/rules/my-team.md" ] || fail "user rule file lost by update"
+
+          "$PACTKIT" uninstall --target "$root" > uninstall.log 2>&1 \
+            || { cat uninstall.log; fail "classic uninstall failed"; }
+          [ -f "$root/rules/my-team.md" ] || fail "user file deleted by uninstall"
+          [ ! -f "$root/skills/pactkit-board/scripts/board.py" ] \
+            || fail "manifest-owned file survived uninstall"
+          echo "classic journey OK (CLI layer)"
+          # Real-host runtime sessions are NOT exercised here — recorded as
+          # UNVERIFIED per R8: 自动化 CLI/产物检查与真实宿主运行记录 MUST
+          # 分开标注.
+
+      # R8 (STORY-slim-20260917c18f4a962b70): every CI summary states the
+      # event, SHA, verification config, Python/host coverage and the
+      # actual run/skip reasons — a green core-only acceptance must never
+      # read as "all hosts verified".
+      - name: CI summary (R8)
+        if: always()
+        run: |
+          ALL='${{ needs.config.outputs.versions }}'
+          {
+            echo "## Release Acceptance — ${{ needs.config.outputs.config_name }}"
+            echo ""
+            echo "| field | value |"
+            echo "|---|---|"
+            echo "| event | \`${{ github.event_name }}\` |"
+            echo "| ref | \`${{ github.ref }}\` |"
+            echo "| sha | \`${{ github.sha }}\` |"
+            echo "| config | ${{ needs.config.outputs.config_name }} |"
+            echo "| versions this config | $ALL |"
+            echo "| this runner | ${{ matrix.python-version }} |"
+            echo "| host coverage | core-only: classic prompt snapshots compared; opencode/codex/copilot adapters are NOT verified here (each adapter repo's own release-acceptance covers them) |"
+            echo "| skip policy | a skip in the snapshot step fails the step (skip = failure, never a pass) |"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  credentials:
+    # The same whole-checkout scan the standalone `Credentials` workflow runs
+    # on every push, repeated here because this workflow is the gate publish.yml
+    # waits on: a tag whose tree carries a credential must not reach PyPI, and
+    # "the push-time job was green" is not evidence about the tagged tree.
+    #
+    # Coverage differs from the local hook on purpose and the difference is
+    # reported, not merged: the hook scans STAGED files (what this commit
+    # changes), this scans the CHECKOUT (what the tag actually contains).
+    runs-on: slimmini
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+
+      - name: Isolated environment
+        run: |
+          python -m venv "$RUNNER_TEMP/pactkit-venv"
+          echo "$RUNNER_TEMP/pactkit-venv/bin" >> "$GITHUB_PATH"
+
+      - name: Install PactKit
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+
+      - name: The scan has something to scan and something to compare against
+        run: |
+          test -f .secrets.baseline || { echo "no .secrets.baseline — nothing to compare against"; exit 1; }
+          count=$(git ls-files | wc -l | tr -d ' ')
+          echo "tracked files: $count"
+          test "$count" -gt 0
+
+      - name: The scan catches a synthetic finding
+        run: |
+          python3 -c "import pathlib,secrets,sys; pathlib.Path(sys.argv[1]).write_text('X = \"' + secrets.token_hex(32) + '\"\n')" "$RUNNER_TEMP/synthetic.py"
+          if pactkit commit-gate --secrets-entry --baseline .secrets.baseline "$RUNNER_TEMP/synthetic.py"; then
+            echo "::error::the credential scan did not catch a synthetic high-entropy string"
+            exit 1
+          fi
+          echo "the scan caught the synthetic finding, as it must"
+
+      - name: Credential scan (whole checkout)
+        run: |
+          # `.secrets.baseline` is excluded: its `hashed_secret` values are sha1
+          # hex strings, so scanning it adds an entry per existing entry.
+          git ls-files | grep -v '^\.secrets\.baseline$' | tr '\n' '\0' \
+            | xargs -0 pactkit commit-gate --secrets-entry --baseline .secrets.baseline