CodeCouncil/.github/workflows/ci.yml at main · adigo-pro/CodeCouncil · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
name: CI

on:
  push:
  pull_request:

jobs:
  python:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.12"]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      # Project is stdlib-only; no pip install needed. Node is present so
      # tests/test_jail.py (the path-jail security boundary) actually runs
      # instead of self-skipping -- jail.mjs has zero npm dependencies, so
      # a bare `node` on PATH is all it needs.
      #
      # Same reasoning for bubblewrap: it is the Linux mechanism behind
      # core/sandbox.py, and without it tests/test_sandbox.py's
      # exploit-regression class has no sandbox to assert against. That class
      # now ERRORS rather than skipping when no mechanism exists, so this step
      # is what keeps the HIGH-severity guard (model-authored scripts must not
      # reach credentials or the network) actually enforced in CI.
      - name: Install bubblewrap (Linux OS sandbox for model-authored scripts)
        run: |
          sudo apt-get update
          sudo apt-get install -y bubblewrap
          # Ubuntu 24.04 restricts unprivileged user namespaces by default,
          # which bwrap requires; without this it fails with
          # "Creating new namespace failed: Operation not permitted".
          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true
          # Fail fast and loudly here rather than as a confusing test error.
          bwrap --ro-bind / / --unshare-net -- /bin/true
          echo "bwrap functional"
      - run: python3 -m unittest discover -s tests

  ui:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: npm
          cache-dependency-path: ui/package-lock.json
      - working-directory: ui
        run: npm ci
      - working-directory: ui
        run: npx tsc --noEmit
      - working-directory: ui
        run: npm run build

  bench-selftest:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      # Zero API spend, no secrets: proves every A/B safety scorer still
      # discriminates its good ref from its bad ref before anyone trusts a
      # live benchmark run against it.
      - run: python3 -m evals.ab.run --selftest

  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pipx run --spec 'ruff==0.15.22' ruff check .

  installer:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run install.sh against this checkout
        run: |
          export CODECOUNCIL_HOME="$RUNNER_TEMP/cc-home"
          export CODECOUNCIL_REPO_URL="file://$GITHUB_WORKSPACE"
          sh install.sh
          test -x "$HOME/.local/bin/codecouncil"
          test -f "$HOME/.codecouncil/env"
      - name: Launcher runs and prints usage
        run: |
          export CODECOUNCIL_HOME="$RUNNER_TEMP/cc-home"
          "$HOME/.local/bin/codecouncil" --help
      - name: Re-run is idempotent (update path)
        run: |
          export CODECOUNCIL_HOME="$RUNNER_TEMP/cc-home"
          export CODECOUNCIL_REPO_URL="file://$GITHUB_WORKSPACE"
          sh install.sh