ci: layered L0–L3 scaffold trust (uvx from PyPI)

.github/workflows/ci-extensions.yml

@@ -0,0 +1,78 @@
+name: CI Extensions (L2)
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened]
+  schedule:
+    - cron: "0 0 * * 0"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  generate:
+    name: Generate extension matrix
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set.outputs.matrix }}
+      count: ${{ steps.set.outputs.count }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Generate L2 matrix
+        id: set
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            BASE="origin/${BASE_REF}"
+            git fetch origin "${BASE_REF}" --depth=1 || true
+            python scripts/ci/generate-matrix.py --layer extensions --changed-only --base-ref "$BASE"
+          else
+            python scripts/ci/generate-matrix.py --layer extensions
+          fi
+
+  extensions:
+    name: ${{ matrix.cell.id }}
+    needs: generate
+    if: needs.generate.outputs.count != '0'
+    strategy:
+      fail-fast: false
+      matrix:
+        cell: ${{ fromJson(needs.generate.outputs.matrix) }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Scaffold check (one extension via uvx/PyPI)
+        env:
+          CI: "true"
+          CPA_SKIP_GIT: "1"
+        run: |
+          ADDON_ARGS=()
+          for url in ${{ join(matrix.cell.addons, ' ') }}; do
+            ADDON_ARGS+=(--addon-url "$url")
+          done
+          python scripts/ci/run-scaffold-check.py \
+            --template-url "${{ matrix.cell.templateUrl }}" \
+            --workdir "${{ runner.temp }}/cpa-l2" \
+            "${ADDON_ARGS[@]}"

.github/workflows/ci-integrity.yml

@@ -0,0 +1,35 @@
+name: CI Integrity (L0)
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened]
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 0 * * 0"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  integrity:
+    name: Registry + profiles
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Validate templates.json (on-disk paths + categories)
+        run: python scripts/ci/validate-registry.py
+
+      - name: Validate curated CI profiles
+        run: python scripts/ci/generate-matrix.py --layer validate-profiles

.github/workflows/ci-profiles.yml

@@ -0,0 +1,85 @@
+name: CI Profiles (L3)
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened]
+  schedule:
+    - cron: "0 0 * * 0"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  generate:
+    name: Generate profile matrix
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set.outputs.matrix }}
+      count: ${{ steps.set.outputs.count }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Generate L3 matrix
+        id: set
+        env:
+          BASE_REF: ${{ github.base_ref }}
+        run: |
+          if [ "${{ github.event_name }}" = "pull_request" ]; then
+            BASE="origin/${BASE_REF}"
+            git fetch origin "${BASE_REF}" --depth=1 || true
+            python scripts/ci/generate-matrix.py --layer profiles --changed-only --base-ref "$BASE"
+          else
+            python scripts/ci/generate-matrix.py --layer profiles
+          fi
+
+  profiles:
+    name: ${{ matrix.cell.id }}
+    needs: generate
+    if: needs.generate.outputs.count != '0'
+    strategy:
+      fail-fast: false
+      matrix:
+        cell: ${{ fromJson(needs.generate.outputs.matrix) }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Scaffold check (curated profile via uvx/PyPI)
+        env:
+          CI: "true"
+          CPA_SKIP_GIT: "1"
+          PROFILE_SETS: ${{ toJson(matrix.cell.sets) }}
+        run: |
+          EXTRA=()
+          while IFS= read -r line; do
+            [ -n "$line" ] && EXTRA+=(--set "$line")
+          done < <(python -c 'import json,os; s=json.loads(os.environ.get("PROFILE_SETS") or "{}"); [print(f"{k}={v}") for k,v in s.items()]')
+
+          ADDON_ARGS=()
+          for url in ${{ join(matrix.cell.addons, ' ') }}; do
+            ADDON_ARGS+=(--addon-url "$url")
+          done
+          python scripts/ci/run-scaffold-check.py \
+            --template-url "${{ matrix.cell.templateUrl }}" \
+            --workdir "${{ runner.temp }}/cpa-l3" \
+            "${ADDON_ARGS[@]}" \
+            "${EXTRA[@]}"

.github/workflows/ci-templates.yml

@@ -0,0 +1,65 @@
+name: CI Templates (L1)
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened]
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 0 * * 0"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  generate:
+    name: Generate template matrix
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.set.outputs.matrix }}
+      count: ${{ steps.set.outputs.count }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Generate L1 matrix
+        id: set
+        run: python scripts/ci/generate-matrix.py --layer templates
+
+  templates:
+    name: ${{ matrix.cell.id }}
+    needs: generate
+    if: needs.generate.outputs.count != '0'
+    strategy:
+      fail-fast: false
+      matrix:
+        cell: ${{ fromJson(needs.generate.outputs.matrix) }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Scaffold check (template alone via uvx/PyPI)
+        env:
+          CI: "true"
+          CPA_SKIP_GIT: "1"
+        run: |
+          python scripts/ci/run-scaffold-check.py \
+            --template-url "${{ matrix.cell.templateUrl }}" \
+            --workdir "${{ runner.temp }}/cpa-l1"