ci.yml

# ci.yml — every PR (plan §9). Red = no merge.
name: ci

on:
  pull_request:
  push:
    branches: [main]

env:
  CARGO_TERM_COLOR: always

jobs:
  fmt:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: rustup show # installs the pinned toolchain from rust-toolchain.toml
      - run: cargo fmt --all --check

  clippy:
    # includes the disallowed network API lints from clippy.toml (invariant 5b)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: rustup show
      - run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings

  deny:
    # ADR-0004 license allowlist + network-crate bans + advisories (invariant 5a, 6)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          command: check

  test:
    # unit + fixture tests, c14n idempotence property tests, contract vectors,
    # deterministic-profile pin, and active release-contract guards
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - run: rustup show
      - run: cargo test --locked --workspace --all-features
      - name: fixture manifest validation
        run: python3 fixtures/validate_fixtures.py
      - name: layout evaluator alpha
        run: make layout-evaluator-alpha
      - name: Python surface tests
        run: PYTHONPATH=python python3 -m unittest discover -s python/tests
      - name: npm package integrity tests
        run: npm test --prefix packages/npm/ethos-pdf
      - name: registry package source consistency tests
        run: python3 .github/scripts/test_package_registry_source_consistency.py
      - name: registry claims gate negative tests
        run: python3 .github/scripts/test_claims_gate_registry_surfaces.py
      - name: verify dependency boundary policy tests
        run: python3 .github/scripts/test_check_verify_dependency_boundary.py
      - name: frozen record guard runner tests
        run: python3 .github/scripts/test_run_frozen_record_guards.py
      - name: release state tests
        run: python3 .github/scripts/test_release_state.py
      - name: current release state check
        run: python3 .github/scripts/check_release_state.py --check
      - name: GitHub release metadata checker tests
        run: python3 .github/scripts/test_github_release_metadata.py
      - name: readiness gate tests
        run: python3 .github/scripts/test_readiness_gate.py
      - name: Gate Zero evidence preflight tests
        run: python3 .github/scripts/test_gate_zero_evidence_preflight.py
      - name: determinism workflow tests
        run: python3 .github/scripts/test_determinism_workflow.py
      - name: CI workflow tests
        run: python3 .github/scripts/test_ci_workflow.py
      - name: Milestone B internal check target tests
        run: python3 .github/scripts/test_milestone_b_internal_checks.py
      - name: RAG chunk alpha target tests
        run: python3 .github/scripts/test_rag_chunk_alpha.py
      - name: Security report alpha target tests
        run: python3 .github/scripts/test_security_report_alpha.py
      - name: execution status tests
        run: python3 .github/scripts/test_execution_status.py
      - name: roadmap status tests
        run: python3 .github/scripts/test_roadmap_status.py
      - name: public surface posture tests
        run: python3 .github/scripts/test_public_surface_posture.py
      - name: Evidence anchor v1 contract guard tests
        run: python3 .github/scripts/test_evidence_anchor_v1_contract.py
      - name: App answer release contract target
        run: make app-answer-release-contract PYTHON=python3
      - name: Python public API policy tests
        run: python3 .github/scripts/test_python_public_api_policy.py
      - name: v0.3.0 version activation tests
        run: python3 .github/scripts/test_v0_3_0_version_activation.py
      - name: Validation record source tests
        run: python3 .github/scripts/test_validation_record_source.py
      - name: Milestone D internal contract target tests
        run: python3 .github/scripts/test_milestone_d_internal_contracts.py
      - name: frozen closed-lane record guards
        run: python3 .github/scripts/run_frozen_record_guards.py
      - name: Milestone E package publication approval prep tests
        run: python3 .github/scripts/test_milestone_e_package_publication_approval_prep.py
      - name: Milestone E package publication approval prep validation record tests
        run: python3 .github/scripts/test_milestone_e_package_publication_approval_prep_validation_record.py
      - name: Milestone E package publication prep approval validation record tests
        run: python3 .github/scripts/test_milestone_e_package_publication_prep_approval_validation_record.py
      - name: Milestone E package publication evidence record tests
        run: python3 .github/scripts/test_milestone_e_package_publication_evidence_records.py
      - name: Milestone E package publication metadata readiness tests
        run: python3 .github/scripts/test_milestone_e_package_publication_metadata_readiness.py
      - name: Milestone E package publication dry-run smoke target
        run: make package-publication-dry-run-smoke
      - name: Milestone E package publication dry-run smoke tests
        run: python3 .github/scripts/test_milestone_e_package_publication_dry_run_smoke.py
      - name: Milestone E package publication version/tag policy tests
        run: python3 .github/scripts/test_milestone_e_package_publication_version_tag_policy.py
      - name: Milestone E package publication PDFium boundary tests
        run: python3 .github/scripts/test_milestone_e_package_publication_pdfium_boundary.py
      - name: Milestone E package publication dependency ordering tests
        run: python3 .github/scripts/test_milestone_e_package_publication_dependency_ordering.py
      - name: Milestone E package publication manifest-migration prep tests
        run: python3 .github/scripts/test_milestone_e_package_publication_manifest_migration_prep.py
      - name: Milestone E package publication registry-assembly prep tests
        run: python3 .github/scripts/test_milestone_e_package_publication_registry_assembly_prep.py
      - name: Milestone E package publication real-version-selection prep tests
        run: python3 .github/scripts/test_milestone_e_package_publication_real_version_selection_prep.py
      - name: Milestone E package publication tag-creation prep tests
        run: python3 .github/scripts/test_milestone_e_package_publication_tag_creation_prep.py
      - name: Milestone E package publication manifest-activation prep tests
        run: python3 .github/scripts/test_milestone_e_package_publication_manifest_activation_prep.py
      - name: Milestone E package publication registry-assembly activation prep tests
        run: python3 .github/scripts/test_milestone_e_package_publication_registry_assembly_activation_prep.py
      - name: Milestone E package publication decision-bundle validation record tests
        run: python3 .github/scripts/test_milestone_e_package_publication_decision_bundle_validation_record.py
      - name: Milestone E package publication pre-approval gap ledger tests
        run: python3 .github/scripts/test_milestone_e_package_publication_pre_approval_gap_ledger.py
      - name: Milestone E package publication approval resolution-plan tests
        run: python3 .github/scripts/test_milestone_e_package_publication_approval_resolution_plan.py
      - name: Milestone E package publication decision-input packet tests
        run: python3 .github/scripts/test_milestone_e_package_publication_decision_input_packet.py
      - name: Milestone E package publication approval-readiness review tests
        run: python3 .github/scripts/test_milestone_e_package_publication_approval_readiness_review.py
      - name: Milestone E package publication manifest-activation diff review tests
        run: python3 .github/scripts/test_milestone_e_package_publication_manifest_activation_diff_review.py
      - name: Milestone E package publication registry-assembly evidence review tests
        run: python3 .github/scripts/test_milestone_e_package_publication_registry_assembly_evidence_review.py
      - name: Milestone E package publication public installation wording review tests
        run: python3 .github/scripts/test_milestone_e_package_publication_public_installation_wording_review.py
      - name: Milestone E package publication approval decision template tests
        run: python3 .github/scripts/test_milestone_e_package_publication_approval_decision_template.py
      - name: Milestone E package publication approval decision record tests
        run: python3 .github/scripts/test_milestone_e_package_publication_approval_decision_record.py
      - name: Milestone E package publication candidate activation evidence tests
        run: python3 .github/scripts/test_milestone_e_package_publication_candidate_activation_evidence.py
      - name: Milestone E package publication approval decision refresh tests
        run: python3 .github/scripts/test_milestone_e_package_publication_approval_decision_refresh.py
      - name: Milestone E package publication manifest activation applied tests
        run: python3 .github/scripts/test_milestone_e_package_publication_manifest_activation_applied.py
      - name: Milestone E package publication current registry-equivalent assembly tests
        run: python3 .github/scripts/test_milestone_e_package_publication_current_registry_assembly.py
      - name: Milestone E package publication final approval request tests
        run: python3 .github/scripts/test_milestone_e_package_publication_final_approval_request.py
      - name: Milestone E package publication final approval decision tests
        run: python3 .github/scripts/test_milestone_e_package_publication_final_approval_decision.py
      - name: Milestone E package publication publish-flag activation request tests
        run: python3 .github/scripts/test_milestone_e_package_publication_activation_request.py
      - name: Milestone E package publication activation applied tests
        run: python3 .github/scripts/test_milestone_e_package_publication_activation_applied.py
      - name: Milestone E package publication tag binding refresh tests
        run: python3 .github/scripts/test_milestone_e_package_publication_tag_binding_refresh.py
      - name: Milestone E package publication operator preflight tests
        run: python3 .github/scripts/test_milestone_e_package_publication_operator_preflight.py
      - name: Milestone E package publication manual registry evidence request tests
        run: python3 .github/scripts/test_milestone_e_package_publication_manual_registry_evidence_request.py
      - name: Milestone E package publication manual registry evidence supplied tests
        run: python3 .github/scripts/test_milestone_e_package_publication_manual_registry_evidence_supplied.py
      - name: Milestone E package publication registry action authorization request tests
        run: python3 .github/scripts/test_milestone_e_package_publication_registry_action_authorization_request.py
      - name: Milestone E package publication registry action approval tests
        run: python3 .github/scripts/test_milestone_e_package_publication_registry_action_approval.py
      - name: Milestone E package publication registry action evidence tests
        run: python3 .github/scripts/test_milestone_e_package_publication_registry_action_evidence.py
      - name: Milestone E package publication dependent registry action approval tests
        run: python3 .github/scripts/test_milestone_e_package_publication_dependent_registry_action_approval.py
      - name: Milestone E package publication dependent registry action evidence tests
        run: python3 .github/scripts/test_milestone_e_package_publication_dependent_registry_action_evidence.py
      - name: Milestone E package publication public installation availability tests
        run: python3 .github/scripts/test_milestone_e_package_publication_public_installation_availability.py
      - name: Gate Zero harness tests
        run: python3 benchmarks/harness/test_run_gate_zero.py

  verify-portability:
    # Invariant 4: ethos-verify compiles against the grounding trait module alone and
    # its dependency tree never contains parser internals.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: rustup show
      - run: cargo check --locked -p ethos-verify
      - run: cargo check --locked -p ethos-grounding-opendataloader-json
      - name: no parser internals in the verify tree
        run: python3 .github/scripts/check_verify_dependency_boundary.py
      - name: grounding feature really is minimal
        run: |
          # the trait module must build without serde_json/sha2/thiserror
          cargo check --locked -p ethos-doc-core --no-default-features --features grounding
          cargo check --locked -p ethos-doc-core --no-default-features --features verify-types

  schema-validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - run: pip install "jsonschema>=4.18"
      - run: python3 schemas/validate_examples.py
      - run: python3 schemas/test_security_report_validation.py
      - run: python3 schemas/test_table_model_validation.py
      - name: Gate Zero result schema validation
        run: |
          python3 - <<'PY'
          import json
          from pathlib import Path
          from jsonschema import Draft202012Validator

          schema = json.loads(Path("benchmarks/gate-zero/result.schema.json").read_text())
          Draft202012Validator.check_schema(schema)
          PY
      - run: python3 fixtures/validate_fixtures.py

  no-network-runtime:
    # Invariant 5c: the base CLI functions with zero network egress. Runs the CLI inside
    # a no-net namespace; any egress attempt fails hard. Extends to full parses when the
    # engine lands.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: rustup show
      - run: cargo build --locked -p ethos-cli
      - name: run CLI under network-denied namespace
        run: |
          sudo unshare -n -- ./target/debug/ethos fingerprint schemas/examples/document.example.json
          sudo unshare -n -- ./target/debug/ethos rag chunk schemas/examples/document.example.json > /tmp/chunks.jsonl
          test -s /tmp/chunks.jsonl

  claims-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - run: python3 .github/scripts/test_public_surface_posture.py
      - run: python3 .github/scripts/claims_gate.py
      - run: python3 .github/scripts/public_boundary_claims_gate.py
      - run: python3 .github/scripts/check_release_boundary_paths.py
      - run: python3 .github/scripts/validation_record_integrity.py

  dco:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: check DCO sign-offs
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            python3 .github/scripts/check_dco.py "${{ github.event.pull_request.base.sha }}" "${{ github.event.pull_request.head.sha }}"
          else
            python3 .github/scripts/check_dco.py "${{ github.event.before }}" "${{ github.sha }}"
          fi