feat: accept retrieval evidence before cache publication #218
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| env: | |
| ARGUS_AUTOLOAD_DOTENV: "false" | |
| ARGUS_DISABLE_SECRET_RESOLUTION: "true" | |
| ARGUS_EGRESS_TYPE: "unknown" | |
| ARGUS_RESIDENTIAL_POLICY: "off" | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13"] | |
| steps: | |
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install uv | |
| run: python -m pip install uv==0.11.26 | |
| - name: Sync dependencies | |
| run: uv sync --frozen --python ${{ matrix.python-version }} --extra dev --extra mcp | |
| - name: Run tests | |
| run: uv run --python ${{ matrix.python-version }} pytest tests/ -v --tb=short | |
| postgres-ledger: | |
| runs-on: ubuntu-latest | |
| services: | |
| postgres: | |
| image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777 | |
| env: | |
| POSTGRES_DB: argus_restore_ci_authority | |
| POSTGRES_USER: postgres | |
| POSTGRES_PASSWORD: postgres | |
| ports: | |
| - 5432:5432 | |
| options: >- | |
| --health-cmd "pg_isready -U postgres -d argus_restore_ci_authority" | |
| --health-interval 5s | |
| --health-timeout 5s | |
| --health-retries 10 | |
| env: | |
| ARGUS_AUTOLOAD_DOTENV: "false" | |
| ARGUS_DISABLE_SECRET_RESOLUTION: "true" | |
| ARGUS_EGRESS_TYPE: "unknown" | |
| ARGUS_RESIDENTIAL_POLICY: "off" | |
| ARGUS_TEST_POSTGRES_URL: postgresql+psycopg2://postgres:postgres@127.0.0.1:5432/argus_restore_ci_authority | |
| ARGUS_TEST_ALLOW_PROVISIONING: disposable-only | |
| ARGUS_TEST_PSQL: /usr/bin/psql | |
| steps: | |
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 | |
| - name: Set up Python 3.12 | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install uv | |
| run: python -m pip install uv==0.11.26 | |
| - name: Sync dependencies | |
| run: uv sync --frozen --python 3.12 --extra dev --extra mcp | |
| - name: Verify canonical provider fixture attestations | |
| run: >- | |
| uv run --python 3.12 | |
| python scripts/generate_provider_fixture_attestations.py --check | |
| - name: Install PostgreSQL client | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y postgresql-client | |
| test -x "$ARGUS_TEST_PSQL" | |
| "$ARGUS_TEST_PSQL" --version | |
| - name: Migrate PostgreSQL schema | |
| run: | | |
| ARGUS_DB_URL="$ARGUS_TEST_POSTGRES_URL" \ | |
| uv run --python 3.12 alembic upgrade head | |
| - name: Generate and verify PostgreSQL schema contract | |
| run: | | |
| uv run --python 3.12 \ | |
| python scripts/generate_argus_schema_contract.py \ | |
| --database-url "$ARGUS_TEST_POSTGRES_URL" \ | |
| --schema-head 0009_retrieval_evidence | |
| uv run --python 3.12 \ | |
| python scripts/generate_argus_schema_contract.py \ | |
| --database-url "$ARGUS_TEST_POSTGRES_URL" \ | |
| --schema-head 0009_retrieval_evidence \ | |
| --check | |
| - name: Upload PostgreSQL schema contract | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: argus-schema-0009 | |
| path: argus/recovery/argus_schema_0009.json | |
| if-no-files-found: error | |
| - name: Run PostgreSQL ledger contract | |
| run: | | |
| uv run --python 3.12 pytest \ | |
| tests/test_search_ledger.py \ | |
| tests/test_provider_spend.py \ | |
| tests/test_maya_outbox.py \ | |
| tests/test_api.py::TestSearchEndpoint::test_postgresql_constraint_failure_returns_503_and_rolls_back_ledger \ | |
| tests/test_operation_ledger.py::test_postgresql_extraction_and_session_contract \ | |
| tests/test_operation_ledger.py::test_postgresql_concurrent_session_creation_and_query_allocation \ | |
| tests/test_operation_ledger.py::test_postgresql_concurrent_sanitized_session_url_inserts_are_idempotent \ | |
| tests/test_recovery_database.py \ | |
| tests/test_schema_contract_generator.py \ | |
| tests/test_postgres_provisioning.py \ | |
| -v --tb=short | |
| - name: Verify PostgreSQL provider-readiness authority | |
| run: | | |
| mkdir -p artifacts | |
| uv run --python 3.12 \ | |
| python scripts/verify_provider_readiness_postgres.py \ | |
| --output artifacts/provider-readiness-postgres.json | |
| - name: Upload PostgreSQL provider-readiness evidence | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: provider-readiness-postgres | |
| path: artifacts/provider-readiness-postgres.json | |
| if-no-files-found: error | |
| production-config: | |
| runs-on: ubuntu-latest | |
| env: | |
| ARGUS_AUTOLOAD_DOTENV: "false" | |
| ARGUS_DISABLE_SECRET_RESOLUTION: "true" | |
| ARGUS_ENV: production | |
| ARGUS_EGRESS_TYPE: datacenter | |
| ARGUS_RESIDENTIAL_POLICY: fallback | |
| steps: | |
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install uv | |
| run: python -m pip install uv==0.11.26 | |
| - name: Sync frozen production dependencies | |
| run: uv sync --frozen --extra dev --extra mcp | |
| - name: Verify production-like configuration | |
| run: uv run pytest tests/test_production_config.py -v --tb=short | |
| image-build: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 | |
| - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3 | |
| - name: Build production image | |
| uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5 | |
| with: | |
| context: . | |
| push: false | |
| load: true | |
| tags: argus-browser-canary:${{ github.sha }} | |
| build-args: | | |
| VCS_REF=${{ github.sha }} | |
| - name: Run 1 GiB browser admission canary | |
| run: | | |
| docker run --rm --init \ | |
| --network none \ | |
| --memory 1g --memory-swap 1g --pids-limit 256 --shm-size 256m \ | |
| --read-only --tmpfs /tmp:rw,noexec,nosuid,size=256m \ | |
| --security-opt no-new-privileges:true \ | |
| --security-opt seccomp=./docker/playwright-seccomp.json \ | |
| --volume "$PWD/scripts/browser_canary.py:/canary/browser_canary.py:ro" \ | |
| "argus-browser-canary:${{ github.sha }}" \ | |
| python /canary/browser_canary.py --memory-limit-mib 1024 | |
| - name: Run 512 MiB missing-browser regression | |
| run: | | |
| docker run --rm --init \ | |
| --network none \ | |
| --memory 512m --memory-swap 512m --pids-limit 256 --shm-size 128m \ | |
| --read-only \ | |
| --tmpfs /tmp:rw,noexec,nosuid,size=128m \ | |
| --tmpfs /ms-playwright:rw,noexec,nosuid,size=1m \ | |
| --security-opt no-new-privileges:true \ | |
| --security-opt seccomp=./docker/playwright-seccomp.json \ | |
| --volume "$PWD/scripts/browser_canary.py:/canary/browser_canary.py:ro" \ | |
| "argus-browser-canary:${{ github.sha }}" \ | |
| python /canary/browser_canary.py \ | |
| --expect-missing --memory-limit-mib 512 | |
| freshness: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0 | |
| - name: Install uv | |
| run: python3 -m pip install uv==0.11.26 | |
| - name: Check llms.txt freshness | |
| run: | | |
| README_TS=$(git log -1 --format=%ct -- README.md) | |
| LLMS_TS=$(git log -1 --format=%ct -- llms.txt) | |
| LLMSFULL_TS=$(git log -1 --format=%ct -- llms-full.txt) | |
| if [ "$LLMS_TS" -lt "$README_TS" ] || [ "$LLMSFULL_TS" -lt "$README_TS" ]; then | |
| echo "::warning::llms.txt or llms-full.txt is older than README.md — update them before release" | |
| fi | |
| - name: Check version sync | |
| run: python3 scripts/verify_release_contract.py |