Repository navigation
synchronize-read-lock-test-cleanup-observation #97
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Disposable Windows context recovery | |
| on: | |
| push: | |
| branches: | |
| - acceptance/context-recovery/** | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| source-gates: | |
| runs-on: windows-latest | |
| timeout-minutes: 90 | |
| defaults: | |
| run: | |
| shell: pwsh | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install verified source dependencies | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| npm ci | |
| if ($LASTEXITCODE -ne 0) { throw 'Source dependencies failed.' } | |
| npm ci --prefix plugins/hpm-local-evidence --ignore-scripts | |
| if ($LASTEXITCODE -ne 0) { throw 'Local evidence build dependencies failed.' } | |
| rustup default stable | |
| if ($LASTEXITCODE -ne 0) { throw 'Native build toolchain failed.' } | |
| - name: Require unified source gates | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| npm run verify | |
| if ($LASTEXITCODE -ne 0) { throw 'Unified verification failed.' } | |
| npm audit --audit-level=high | |
| if ($LASTEXITCODE -ne 0) { throw 'Dependency audit failed.' } | |
| context-recovery: | |
| needs: source-gates | |
| runs-on: windows-latest | |
| timeout-minutes: 90 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| scenario: [n08, n09] | |
| defaults: | |
| run: | |
| shell: pwsh | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install verified source dependencies | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| npm ci | |
| if ($LASTEXITCODE -ne 0) { throw 'Source dependencies failed.' } | |
| npm ci --prefix plugins/hpm-local-evidence --ignore-scripts | |
| if ($LASTEXITCODE -ne 0) { throw 'Local evidence build dependencies failed.' } | |
| rustup default stable | |
| if ($LASTEXITCODE -ne 0) { throw 'Native build toolchain failed.' } | |
| - name: Build runner-local payload and fixed review plan | |
| env: | |
| SCENARIO: ${{ matrix.scenario }} | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| node scripts/prepare-context-hosted-run.js $env:SCENARIO | |
| if ($LASTEXITCODE -ne 0) { throw 'Fixed payload preparation failed.' } | |
| - name: Run fixed scenario under original bounded Job | |
| env: | |
| SCENARIO: ${{ matrix.scenario }} | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| ./scripts/qualify-context-hosted.ps1 -Case $env:SCENARIO | |
| - name: Record bounded outcome | |
| if: always() | |
| env: | |
| SCENARIO: ${{ matrix.scenario }} | |
| JOB_STATUS: ${{ job.status }} | |
| run: | | |
| @( | |
| 'Context scenario: ' + $env:SCENARIO + '; job result: ' + $env:JOB_STATUS | |
| 'Exact source checkout: ' + $env:GITHUB_SHA | |
| 'When their preparation stages run, payload, synthetic credentials, original evidence, DPAPI keys and certificates are generated only on this disposable runner.' | |
| 'No private local acceptance directory or old installer artifact is an input. No payload, key, database or request body is uploaded.' | |
| if ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09') { | |
| 'Passed scope: four cases: committed metadata, clear ACK, save ACK and revoke ACK; forced kill and same-directory restart under the original bounded Job.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n08') { | |
| 'Passed scope: six mutation/hold cases with business-output and authenticated committed-state checks under the original bounded Job.' | |
| } | |
| 'Not qualified: commit/publication in progress, backup rollback, installation lifecycle, full N08/N09, 24-hour capacity, real providers or production activation.' | |
| ) >> $env:GITHUB_STEP_SUMMARY | |
| egress-diagnostic: | |
| runs-on: windows-latest | |
| timeout-minutes: 5 | |
| defaults: | |
| run: | |
| shell: pwsh | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| - name: Diagnose fixed egress rule expressions without launching payload | |
| run: ./scripts/context-hosted/shared/egress-rule-diagnostic.ps1 |