fix: window-enum contract test path + bump MCP_VERSION 0.0.178 → 0.0.179 #636
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Secret scan — blocks commits that leak keys/tokens. Uses gitleaks; for a | |
| # public repo the default GITHUB_TOKEN is sufficient (no license key needed). | |
| secret-scan: | |
| name: Secret scan (gitleaks) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| # gitleaks-action needs pull-requests: write to post review comments on | |
| # PRs. Without it the scan still runs and fails on leaks, but PR | |
| # annotations silently don't appear. | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| with: | |
| # Full history so gitleaks can scan past commits, not just the diff. | |
| fetch-depth: 0 | |
| - uses: gitleaks/gitleaks-action@v3 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| config-path: .github/gitleaks.toml | |
| build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - run: npm ci | |
| - name: Lint | |
| run: npm run lint | |
| - name: Typecheck | |
| run: npx tsc --noEmit | |
| - name: Canonical test (11/11, Υ 18436.98) | |
| run: node --test __tests__/ingest/canonical.test.mjs | |
| - name: Anti-gaming claim tests (RS.06 dead code, Benford vacuous, SIGNA ceiling, contamination bypass) | |
| run: node --test __tests__/ingest/rs06-wiring.test.mjs __tests__/ingest/benford-vacuous.test.mjs __tests__/scoring/signa-ceiling.test.mjs __tests__/ingest/contamination-bypass.test.mjs | |
| - name: Hardening tests (Jensen fix, codename guard, throttle TOCTOU, baseline labels, board exclusion) | |
| run: node --test __tests__/data/the-field-jensen.test.mjs __tests__/ingest/codename-guard-bypass.test.mjs __tests__/ingest/throttle-toctou.test.mjs __tests__/data/baseline-labels.test.mjs __tests__/data/the-field-board-exclusion.test.mjs __tests__/ingest/tightened-plausibility.test.mjs | |
| - name: Test coverage report | |
| run: npm run test:coverage | |
| - name: Upload coverage report | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: coverage-report | |
| path: coverage/ | |
| retention-days: 14 | |
| - name: UI component tests (vitest) | |
| run: npm run test:ui | |
| - name: Build | |
| run: npm run build | |
| # Cross-repo contract test — catches platform-enum drift between the web app | |
| # and the MCP server. The codex landing was triple-blocked because these enums | |
| # drifted (one repo accepted a platform the other didn't). This job checks out | |
| # the MCP repo and diffs the two enums. Fails if they don't match. | |
| cross-repo-contract: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: 22 | |
| - name: Checkout sigrank-mcp (the other half of the contract) | |
| uses: actions/checkout@v7 | |
| with: | |
| repository: SunrisesIllNeverSee/sigrank-mcp | |
| path: _sigrank-mcp | |
| # Public repo — no token needed. If it goes private, add a PAT secret. | |
| # token: ${{ secrets.CROSS_REPO_PAT }} | |
| - name: Cross-repo platform-enum contract test | |
| run: node __tests__/contract/platform-enum-contract.test.mjs ${{ github.workspace }}/_sigrank-mcp | |
| - name: Cross-repo window-enum contract test | |
| run: node __tests__/contract/window-enum-contract.test.mjs ${{ github.workspace }}/_sigrank-mcp | |
| - name: Cross-repo MCP version + platform-count drift test | |
| run: node __tests__/contract/mcp-version-drift.test.mjs ${{ github.workspace }}/_sigrank-mcp |