Skip to content

Strict provenance mode: refuse, not warn, on inferred contracts #241

Strict provenance mode: refuse, not warn, on inferred contracts

Strict provenance mode: refuse, not warn, on inferred contracts #241

Workflow file for this run

name: CI
on:
push:
pull_request:
# cancel superseded runs on the same ref (e.g. rapid pushes)
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
jobs:
test:
name: test (py${{ matrix.python-version }})
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
python-version: ["3.10", "3.11", "3.12", "3.13"]
steps:
- uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v6
with:
enable-cache: true
- uses: actions/setup-go@v5 # for the Go adapter tests (else they skip)
with:
go-version: 'stable'
- uses: actions/setup-node@v4 # for the TypeScript adapter tests (else they skip)
with:
node-version: '22' # >= 22.6 for .ts type-stripping in node:test
- uses: actions/setup-java@v4 # for the Java adapter tests (else they skip; mvn ships on the runner)
with:
distribution: 'temurin'
java-version: '21'
- name: Install the TypeScript toolchain
run: npm ci # provides the `typescript` the tshash helper resolves
- name: Sync deps
run: uv sync --frozen --python ${{ matrix.python-version }}
- name: Run tests
# hash-stability suites are load-bearing; e2e spawns the real stdio server
# (measured too, via coverage's subprocess patching). The floor sits ~5
# points under what a full-toolchain run scores, so it catches regressions
# without tripping on minor per-version branch differences.
run: uv run --python ${{ matrix.python-version }} pytest -q --cov=hashloom --cov-report=term --cov-fail-under=85
benchmark:
name: benchmark (>5x DoD guard)
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: astral-sh/setup-uv@v6
with:
enable-cache: true
- name: Sync deps
run: uv sync --frozen
- name: Token-reduction benchmark
# exits nonzero below the 5x definition-of-done line
run: uv run python bench/benchmark.py