Repository navigation
test(recovery): expose bounded startup phases on publication fixture … #165
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Disposable Windows context recovery | |
| on: | |
| push: | |
| branches: | |
| - acceptance/context-recovery/** | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| source-gates: | |
| runs-on: windows-latest | |
| timeout-minutes: 90 | |
| defaults: | |
| run: | |
| shell: pwsh | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install verified source dependencies | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| npm ci | |
| if ($LASTEXITCODE -ne 0) { throw 'Source dependencies failed.' } | |
| npm ci --prefix plugins/hpm-local-evidence --ignore-scripts | |
| if ($LASTEXITCODE -ne 0) { throw 'Local evidence build dependencies failed.' } | |
| rustup default stable | |
| if ($LASTEXITCODE -ne 0) { throw 'Native build toolchain failed.' } | |
| - name: Require unified source gates | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| npm run verify | |
| if ($LASTEXITCODE -ne 0) { throw 'Unified verification failed.' } | |
| npm audit --audit-level=high | |
| if ($LASTEXITCODE -ne 0) { throw 'Dependency audit failed.' } | |
| context-recovery: | |
| needs: source-gates | |
| runs-on: windows-latest | |
| timeout-minutes: 90 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| scenario: [n08, n09] | |
| defaults: | |
| run: | |
| shell: pwsh | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install verified source dependencies | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| npm ci | |
| if ($LASTEXITCODE -ne 0) { throw 'Source dependencies failed.' } | |
| npm ci --prefix plugins/hpm-local-evidence --ignore-scripts | |
| if ($LASTEXITCODE -ne 0) { throw 'Local evidence build dependencies failed.' } | |
| rustup default stable | |
| if ($LASTEXITCODE -ne 0) { throw 'Native build toolchain failed.' } | |
| - name: Build runner-local payload and fixed review plan | |
| env: | |
| SCENARIO: ${{ matrix.scenario }} | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| node scripts/prepare-context-hosted-run.js $env:SCENARIO | |
| if ($LASTEXITCODE -ne 0) { throw 'Fixed payload preparation failed.' } | |
| - name: Run fixed scenario under original bounded Job | |
| env: | |
| SCENARIO: ${{ matrix.scenario }} | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| ./scripts/qualify-context-hosted.ps1 -Case $env:SCENARIO | |
| - name: Record bounded outcome | |
| if: always() | |
| env: | |
| SCENARIO: ${{ matrix.scenario }} | |
| JOB_STATUS: ${{ job.status }} | |
| run: | | |
| @( | |
| 'Context scenario: ' + $env:SCENARIO + '; job result: ' + $env:JOB_STATUS | |
| 'Exact source checkout: ' + $env:GITHUB_SHA | |
| 'When their preparation stages run, payload, synthetic credentials, original evidence, DPAPI keys and certificates are generated only on this disposable runner.' | |
| 'No private local acceptance directory or old installer artifact is an input. No payload, key, database or request body is uploaded.' | |
| if ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n09') { | |
| 'Passed scope: six cases: committed metadata, clear ACK, save ACK, revoke ACK, same-format backup rollback after revoke and interruption with the upstream public final held; forced kill and same-directory restart under the original bounded Job.' | |
| } elseif ($env:JOB_STATUS -ceq 'success' -and $env:SCENARIO -ceq 'n08') { | |
| 'Passed scope: six mutation/hold cases with business-output and authenticated committed-state checks under the original bounded Job.' | |
| } | |
| 'Not qualified: commit/publication in progress, historical-layout backup migration, installation lifecycle, full N08/N09, 24-hour capacity, real providers or production activation.' | |
| ) >> $env:GITHUB_STEP_SUMMARY | |
| egress-diagnostic: | |
| runs-on: windows-latest | |
| timeout-minutes: 5 | |
| defaults: | |
| run: | |
| shell: pwsh | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| - name: Diagnose fixed egress rule expressions without launching payload | |
| run: ./scripts/context-hosted/shared/egress-rule-diagnostic.ps1 |