task-spec/.github/workflows/ci.yml at main · DRoqueProgrammer/task-spec · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
# CI runs the same boundary a contributor runs locally: `make check`.
# Credential-free by design — no secrets or real-engine executors. The
# separately dispatched engine-evidence workflow owns retained provider runs.
name: check

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: check-${{ github.ref }}
  cancel-in-progress: true

jobs:
  check:
    name: make check (${{ matrix.os }})
    runs-on: ${{ matrix.os }}
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest]
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false

      - name: Install shellcheck (macOS)
        # ubuntu-latest ships shellcheck; macOS runners do not, and the gate's
        # --shellcheck-evals lint hard-requires it. Pinned by SHA-256.
        if: runner.os == 'macOS'
        run: |
          set -euo pipefail
          ver="v0.10.0"
          arch="$(uname -m)"
          case "$arch" in
            arm64)  asset="darwin.aarch64"; sha="bbd2f14826328eee7679da7221f2bc3afb011f6a928b848c80c321f6046ddf81" ;;
            x86_64) asset="darwin.x86_64";  sha="ef27684f23279d112d8ad84e0823642e43f838993bbb8c0963db9b58a90464c2" ;;
            *) echo "unsupported arch: $arch" >&2; exit 1 ;;
          esac
          curl -fsSL -o /tmp/shellcheck.tar.xz \
            "https://github.com/koalaman/shellcheck/releases/download/${ver}/shellcheck-${ver}.${asset}.tar.xz"
          echo "${sha}  /tmp/shellcheck.tar.xz" | shasum -a 256 -c -
          tar -xJf /tmp/shellcheck.tar.xz -C /tmp
          sudo install -m 0755 "/tmp/shellcheck-${ver}/shellcheck" /usr/local/bin/shellcheck
          shellcheck --version

      - name: Install pyyaml (schema-fidelity consumer test)
        # tests/test-portability-e2e.sh Step 6 runs docs/examples/consume-task-spec.py,
        # which requires PyYAML. Pinned for determinism.
        run: python3 -m pip install --disable-pip-version-check --quiet --break-system-packages pyyaml==6.0.2

      - name: make check (includes isolated install-to-accept demo)
        run: make check