Tighten verify base autodetection and workflow input checks (#242) #764
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| - name: Set up Python | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| - name: Install | |
| run: python -m pip install -e ".[dev]" | |
| - name: Lint | |
| run: python -m ruff check . | |
| - name: Compile | |
| run: python -m compileall -q src tests | |
| - name: Verify generated schemas are up to date | |
| run: python scripts/generate_schemas.py --check | |
| - name: Trust-model invariant lint (static, no user code execution) | |
| run: python -m pytest tests/test_adapter_static_only.py -q | |
| # Fails fast and visibly before the full suite when an adapter | |
| # under src/agents_shipgate/inputs/ introduces exec/eval/__import__/ | |
| # compile or a dynamic-import surface (importlib/runpy/subprocess). | |
| # The companion live-load tests in tests/test_fixture_no_import.py | |
| # run as part of the main Test step below. | |
| - name: Test | |
| # v0.21 (E7): bumped from 75 → 85. Actual aggregate coverage on | |
| # current main is ~88%, so the gate is +10pp tighter with ~3pp | |
| # headroom for day-to-day movement. The bump catches the next | |
| # time a refactor lands materially less-covered code without | |
| # a corresponding test pass. | |
| # | |
| # Excludes the `perf` marker — the latency budget tests run as | |
| # a separate step below (after the main suite finishes so their | |
| # timing isn't disturbed by parallel test load). | |
| # | |
| # The static adapter invariant lint runs in its own fail-fast | |
| # step above, so keep it out of the coverage pass to avoid | |
| # doing the same AST sweep twice on every PR. | |
| run: python -m pytest -n auto -m "not perf" --ignore=tests/test_adapter_static_only.py --cov=agents_shipgate --cov-report=term-missing --cov-fail-under=85 | |
| - name: Latency budget | |
| # Runs the `benchmark/perf/scenarios/` synthetic scans and | |
| # asserts median wallclock stays under the per-scenario budget | |
| # in `benchmark/perf/budgets.yaml`. Budgets are deliberately | |
| # generous (~10-20x measured local time) so this catches | |
| # catastrophic regressions, not noise. On failure the test | |
| # output shows a per-phase breakdown via `_perf` — start there | |
| # before profiling. See `benchmark/perf/README.md` for tuning. | |
| run: python -m pytest tests/test_latency_budget.py -m perf -v | |
| - name: Build package | |
| run: | | |
| python -m build | |
| python -m twine check dist/* | |
| - name: Dependency audit | |
| run: python -m pip_audit . | |
| - name: Generate SBOM | |
| run: cyclonedx-py environment --pyproject pyproject.toml -o sbom.json | |
| - name: Upload SBOM | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a | |
| with: | |
| name: sbom | |
| path: sbom.json |