fable-session/.github/workflows/ci.yml at main · getaskclaw/fable-session · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
# CI for fable-session. Deliberately owner/URL-free: the workflow only uses
# marketplace actions by name and never references a repository URL. All
# actions are pinned to verified tag SHAs. Fetching build tooling
# (setup-python, pip, PyYAML, build, the offline-smoke wheelhouse seed) is
# allowed in dedicated preparation steps; the tests themselves are
# deterministic and offline, and the offline install smoke never touches an
# index during its install phase.
name: ci

on:
  push:
  pull_request:

# Least-privilege workflow permissions — CI only ever reads the
# repository. No job widens this; nothing in CI writes contents,
# packages, or attestations.
permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      # checkout v4 (pinned tag SHA). fetch-depth 0: the full-history
      # readiness scan must see every reachable commit, not a shallow tip.
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0

      # setup-python v5 (pinned tag SHA).
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"

      - name: Compile all sources
        run: python3 -m compileall -q src tests

      - name: Install test dependency (PyYAML, workflow validation only; pinned tested version)
        run: python3 -m pip install --quiet PyYAML==6.0.2

      - name: Run the full unit test suite
        run: python3 -m unittest discover -s tests -v

      - name: Public-readiness scan of the tracked tree
        run: python3 tests/public_readiness_check.py

      - name: Public-readiness scan of the FULL history
        run: python3 tests/full_history_readiness_check.py

      - name: Whitespace hygiene (git diff --check against the empty tree)
        run: git diff --check "$(git hash-object -t tree /dev/null)" HEAD

      - name: Pre-seed the offline-smoke wheelhouse (network allowed HERE only)
        run: |
          mkdir -p /tmp/fable-wheelhouse
          python3 -m pip download --quiet --dest /tmp/fable-wheelhouse --no-deps "setuptools==83.0.0"

      - name: Offline install smoke (no index during the install phase)
        run: FABLE_SESSION_WHEELHOUSE=/tmp/fable-wheelhouse python3 tests/offline_install_smoke.py

      # Pinned, tested build toolchain (the seed above satisfies the
      # pyproject `setuptools>=77` floor); --no-isolation keeps the build
      # on exactly these versions instead of a floating isolated env.
      - name: Build the wheel and sdist (pinned toolchain)
        run: |
          python3 -m pip install --quiet build==1.5.1 setuptools==83.0.0 wheel==0.47.0
          python3 -m build --no-isolation

      - name: Install the built wheel and smoke the CLI
        run: |
          python3 -m pip install --quiet dist/*.whl
          fable-session --version
          fable-session --version | grep -F "0.3.0b1"
          fable-session --help
          fable-session run --help
          fable-session audit --help
          fable-session watch --help
          python3 -c "from importlib.metadata import distribution; eps = distribution('fable-session').entry_points; banned = {'fs', 'claude-context-run', 'claude-context-audit-models', 'claude-session-watchdog'}; assert not any(ep.name in banned for ep in eps), 'removed/forbidden console names must never ship'"