CounterLab/.github/workflows/quality.yml at main · ALikesToCode/CounterLab · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
name: CounterLab quality

on:
  push:
  pull_request:

permissions:
  contents: read

concurrency:
  group: quality-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    runs-on: ubuntu-24.04
    timeout-minutes: 35
    env:
      COREPACK_HOME: ${{ github.workspace }}/.cache/corepack
      PIP_CACHE_DIR: ${{ github.workspace }}/.cache/pip
      PNPM_HOME: ${{ github.workspace }}/.cache/pnpm-home
      PNPM_STORE_DIR: ${{ github.workspace }}/.pnpm-store
      TMPDIR: ${{ github.workspace }}/.cache/tmp
      XDG_CACHE_HOME: ${{ github.workspace }}/.cache/xdg-cache
      XDG_CONFIG_HOME: ${{ github.workspace }}/.cache/xdg-config
      XDG_DATA_HOME: ${{ github.workspace }}/.cache/xdg-data

    steps:
      - name: Check out exact source
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          persist-credentials: false

      - name: Set up Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
        with:
          node-version: 22.23.0

      - name: Set up Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
        with:
          python-version: 3.13.14

      - name: Prepare contained tool state
        run: |
          mkdir -p "$COREPACK_HOME" "$PIP_CACHE_DIR" "$PNPM_HOME/bin" "$PNPM_STORE_DIR" "$TMPDIR" "$XDG_CACHE_HOME" "$XDG_CONFIG_HOME" "$XDG_DATA_HOME"
          corepack prepare "$(node -p 'require("./package.json").packageManager')" --activate
          corepack enable --install-directory "$PNPM_HOME/bin" pnpm

      - name: Install pinned JavaScript dependencies
        run: |
          "$PNPM_HOME/bin/pnpm" install --frozen-lockfile --store-dir "$PNPM_STORE_DIR"

      - name: Install pinned Python dependencies
        run: |
          python -m venv .venv
          .venv/bin/python -m pip install --disable-pip-version-check --only-binary=:all: -r requirements.lock.txt

      - name: Type-check repository, web, and Worker
        run: ./scripts/run-contained-pnpm.sh typecheck

      - name: Verify repository formatting
        run: ./scripts/run-contained-pnpm.sh exec prettier --check .

      - name: Run TypeScript authority and UI tests
        run: ./scripts/run-contained-pnpm.sh test:ts

      - name: Run Python kernel and runner tests
        env:
          PYTHONDONTWRITEBYTECODE: "1"
          PYTHONPATH: services/kernel/src:services/runner/src
        run: .venv/bin/python -m pytest services/kernel/tests services/runner/tests -p no:cacheprovider -q

      - name: Verify deterministic generated contracts and sample evidence
        run: |
          ./scripts/run-contained-pnpm.sh contracts:generate
          ./scripts/run-contained-pnpm.sh sample-boundary:generate
          ./scripts/run-contained-pnpm.sh claims:generate
          ./scripts/run-contained-pnpm.sh engines:check-bindings
          git diff --exit-code

      - name: Validate release scripts and scan secrets
        run: |
          bash -n scripts/release-check.sh scripts/deploy-qualified.sh scripts/build-source-bound-runner.sh scripts/production-smoke.sh scripts/verify-scientific-engines.sh
          .venv/bin/python scripts/secret-scan.py

      - name: Build production Worker and assets
        run: ./scripts/run-contained-pnpm.sh --filter @counterlab/web build

      - name: Verify built security headers
        run: cmp apps/web/public/_headers apps/web/dist/client/_headers