Merge pull request #44 from OpenAdaptAI/codex/flow-1351-admission-sum… #125
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Profile consistency | |
| on: | |
| schedule: | |
| - cron: "19 7 * * *" | |
| workflow_dispatch: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| reject-lifecycle-app: | |
| permissions: {} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Reject the lifecycle App | |
| env: | |
| ACTOR: ${{ github.actor }} | |
| TRIGGERING_ACTOR: ${{ github.triggering_actor }} | |
| run: | | |
| test "$ACTOR" != 'openadapt-lifecycle[bot]' | |
| test "$TRIGGERING_ACTOR" != 'openadapt-lifecycle[bot]' | |
| validate-profile: | |
| needs: reject-lifecycle-app | |
| if: >- | |
| github.actor != 'openadapt-lifecycle[bot]' && | |
| github.triggering_actor != 'openadapt-lifecycle[bot]' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install the pinned profile test dependencies | |
| run: python3 -m pip install --requirement requirements/profile-consistency.txt | |
| - name: Test Production lifecycle admission failures | |
| run: python3 -m unittest discover -s tests -p 'test_*.py' | |
| - name: Validate the content-addressed evidence registry | |
| run: python3 scripts/validate_evidence_registry.py | |
| - name: Refuse evidence-registry rollback | |
| if: github.event_name == 'pull_request' || github.event_name == 'push' | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }} | |
| run: | | |
| if git cat-file -e "$BASE_SHA:evidence-registry.json"; then | |
| git show "$BASE_SHA:evidence-registry.json" > "$RUNNER_TEMP/previous-evidence-registry.json" | |
| python3 scripts/validate_evidence_registry.py \ | |
| --previous-registry "$RUNNER_TEMP/previous-evidence-registry.json" | |
| fi | |
| - name: Refuse Production release-ledger rollback | |
| if: github.event_name == 'pull_request' || github.event_name == 'push' | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.before }} | |
| run: | | |
| if git cat-file -e "$BASE_SHA:production-lifecycle-admissions.json"; then | |
| git show "$BASE_SHA:production-lifecycle-admissions.json" > "$RUNNER_TEMP/previous-production-lifecycle-admissions.json" | |
| elif git cat-file -e "$BASE_SHA:production-lifecycle-policy.json"; then | |
| echo "REFUSED: the trusted base has policy but no admission ledger" >&2 | |
| exit 1 | |
| else | |
| printf '{"admissions":[]}\n' > "$RUNNER_TEMP/previous-production-lifecycle-admissions.json" | |
| fi | |
| if git cat-file -e "$BASE_SHA:production-workflow-admissions.json"; then | |
| git show "$BASE_SHA:production-workflow-admissions.json" > "$RUNNER_TEMP/previous-production-workflow-admissions.json" | |
| else | |
| printf '%s\n' '{"$schema":"schemas/production-workflow-admissions.schema.json","schema_version":"openadapt.production-workflow-admissions/v1","policy_sha256":"sha256:e1444a08ce6b16736168cce027ce9d48abb2e0e246fc0cd79c0772fa8e423e11","admissions":[]}' > "$RUNNER_TEMP/previous-production-workflow-admissions.json" | |
| fi | |
| python3 scripts/validate_production_lifecycle.py \ | |
| --history-only \ | |
| --previous-admissions "$RUNNER_TEMP/previous-production-lifecycle-admissions.json" \ | |
| --previous-workflow-admissions "$RUNNER_TEMP/previous-production-workflow-admissions.json" | |
| - name: Validate product truth and links | |
| run: python3 scripts/check_profile.py | |
| - name: Bind every published benchmark figure to its artifact | |
| # --allow-recorded-drift keeps a dated, reviewed drift record from | |
| # blocking every unrelated change. Each record is still printed, still | |
| # names an owner, and still fails this step once its expiry date passes. | |
| run: python3 scripts/check_benchmark_claims.py --allow-recorded-drift | |
| - name: Re-fetch the pinned benchmark artifacts | |
| if: github.event_name == 'schedule' | |
| run: python3 scripts/check_benchmark_claims.py --online --allow-recorded-drift | |
| report-expired-admission: | |
| needs: [reject-lifecycle-app, validate-profile] | |
| if: >- | |
| ${{ always() && needs.validate-profile.result == 'failure' && | |
| (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') && | |
| github.actor != 'openadapt-lifecycle[bot]' && | |
| github.triggering_actor != 'openadapt-lifecycle[bot]' }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| issues: write | |
| steps: | |
| - name: File or update the Production lifecycle failure | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| TITLE="Production lifecycle admission needs attention" | |
| BODY="The scheduled evidence-gated lifecycle check failed: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} | |
| An admission record or its current evidence is invalid. Consumers derive Production from the latest exact signed release and must fail closed." | |
| EXISTING=$(gh issue list --repo "${{ github.repository }}" --state open \ | |
| --search "in:title \"$TITLE\"" --json number --jq '.[0].number // empty') | |
| if [ -n "$EXISTING" ]; then | |
| gh issue comment "$EXISTING" --repo "${{ github.repository }}" --body "$BODY" | |
| else | |
| gh issue create --repo "${{ github.repository }}" --title "$TITLE" --body "$BODY" | |
| fi |