Repository navigation
fix(ci): satisfy the Actions allow-list so workflows can start (+ provenance probe visibility) #20
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| name: DOI publication contracts | |
| on: | |
| pull_request: | |
| paths: ['src/doi/**', 'src/server/**', 'src/analysis/AnalysisConfig.jl', 'test/doi/**', 'test/unit/test_doi*', 'bench/doi/**', 'scripts/link-doi.sh', 'config/schemas/doi*', 'config/templates/doi*', 'Project.toml', 'Manifest.toml', '.github/workflows/doi.yml'] | |
| push: | |
| branches: [main, 'arena/**'] | |
| paths: ['src/doi/**', 'src/server/**', 'src/analysis/AnalysisConfig.jl', 'test/doi/**', 'test/unit/test_doi*', 'bench/doi/**', 'scripts/link-doi.sh', 'config/schemas/doi*', 'config/templates/doi*', 'Project.toml', 'Manifest.toml', '.github/workflows/doi.yml'] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| contracts: | |
| name: DOI contracts (no credentials or live deposits) | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 20 | |
| env: | |
| JULIA_PKG_PRECOMPILE_AUTO: '0' | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| # julia-actions/* is refused by the repository's Actions allow-list | |
| # (startup_failure), so Julia is installed from the official binaries | |
| # with checksum verification instead -- same version and procedure as | |
| # ci.yml's "Set up Julia" step, which test/unit/test_install_pins.jl pins. | |
| - name: Set up Julia | |
| run: | | |
| set -euo pipefail | |
| JULIA_VERSION="1.12.5" | |
| archive="julia-${JULIA_VERSION}-linux-x86_64.tar.gz" | |
| base="https://julialang-s3.julialang.org/bin" | |
| curl --fail --location --retry 3 --retry-all-errors --max-time 600 \ | |
| "${base}/linux/x64/${JULIA_VERSION%.*}/${archive}" \ | |
| -o "${RUNNER_TEMP}/${archive}" | |
| curl --fail --location --retry 3 --retry-all-errors --max-time 120 \ | |
| "${base}/checksums/julia-${JULIA_VERSION}.sha256" \ | |
| -o "${RUNNER_TEMP}/julia-${JULIA_VERSION}.sha256" | |
| grep "${archive}" "${RUNNER_TEMP}/julia-${JULIA_VERSION}.sha256" \ | |
| | (cd "${RUNNER_TEMP}" && sha256sum --check) | |
| mkdir -p "${RUNNER_TEMP}/julia" | |
| tar -xzf "${RUNNER_TEMP}/${archive}" -C "${RUNNER_TEMP}/julia" --strip-components=1 | |
| echo "${RUNNER_TEMP}/julia/bin" >> "${GITHUB_PATH}" | |
| - name: Cache Julia packages | |
| uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 | |
| with: | |
| path: | | |
| ~/.julia/artifacts | |
| ~/.julia/packages | |
| ~/.julia/compiled | |
| ~/.julia/registries | |
| key: julia-depot-${{ runner.os }}-${{ hashFiles('test/doi/Manifest.toml', 'test/doi/Project.toml') }} | |
| restore-keys: | | |
| julia-depot-${{ runner.os }}- | |
| - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2 | |
| with: | |
| bun-version-file: .bun-version | |
| - name: Syntax and source dependency contracts | |
| run: | | |
| julia --startup-file=no config/ci/lint_source.jl | |
| bash -n scripts/link-doi.sh test/doi/check-nickel.sh | |
| command -v zip | |
| command -v jq | |
| command -v flock | |
| - name: Instantiate isolated HTTP-only test environment | |
| run: julia --project=test/doi -e 'using Pkg; Pkg.instantiate()' | |
| - name: Configure temporary contract outputs | |
| run: echo "DOI_CONTRACT_ARTIFACTS=$RUNNER_TEMP/doi-contracts" >> "$GITHUB_ENV" | |
| - name: Publication lifecycle, security, restart and streamed HTTP contracts | |
| run: julia --project=test/doi test/doi/runtests.jl | |
| - name: Install pinned browser and schema tools | |
| working-directory: test/doi | |
| run: | | |
| bun install --frozen-lockfile --ignore-scripts | |
| bunx playwright install --with-deps chromium | |
| - name: Linker, JSON Schema, CFF and projection roundtrips | |
| working-directory: test/doi | |
| run: bun run test | |
| - name: Evidence Mode, typed confirmation and browser recovery | |
| working-directory: test/doi | |
| run: bun run test:browser | |
| - name: Verify Nickel contracts with a checksum-pinned CLI | |
| run: | | |
| curl --fail --location --retry 2 --max-time 120 https://github.com/nickel-lang/nickel/releases/download/1.18.0/nickel-x86_64-linux -o "$RUNNER_TEMP/nickel" | |
| printf '9cba4dd65ae9915ec61f73033aafcff307a377665a83fd8f530df086763318cb %s\n' "$RUNNER_TEMP/nickel" | sha256sum --check | |
| chmod +x "$RUNNER_TEMP/nickel" | |
| NICKEL="$RUNNER_TEMP/nickel" bash test/doi/check-nickel.sh | |
| - name: Publication performance and bounded-memory smoke | |
| run: | | |
| julia --project=test/doi bench/doi/benchmark.jl > "$RUNNER_TEMP/doi-performance.json" | |
| if [[ -f bench/doi/baseline.json ]]; then | |
| bun bench/doi/compare.js bench/doi/baseline.json "$RUNNER_TEMP/doi-performance.json" | |
| else | |
| echo '::warning::First DOI benchmark baseline is not established. Report is informational; no regression verdict is claimed. Review and retain a same-host baseline before enabling the >10% comparison.' | |
| fi | |
| - name: Preserve contract outputs and resolved environment | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: doi-contract-evidence | |
| path: | | |
| test/doi/Manifest.toml | |
| ${{ runner.temp }}/doi-contracts/ | |
| ${{ runner.temp }}/doi-performance.json | |
| if-no-files-found: warn |