Fuse provider evidence deterministically #227

Workflow file for this run

	name: CI

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]

	jobs:
	test:
	runs-on: ubuntu-latest
	env:
	ARGUS_AUTOLOAD_DOTENV: "false"
	ARGUS_DISABLE_SECRET_RESOLUTION: "true"
	ARGUS_EGRESS_TYPE: "unknown"
	ARGUS_RESIDENTIAL_POLICY: "off"
	strategy:
	matrix:
	python-version: ["3.11", "3.12", "3.13"]
	steps:
	- uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0

	- name: Set up Python ${{ matrix.python-version }}
	uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
	with:
	python-version: ${{ matrix.python-version }}

	- name: Install uv
	run: python -m pip install uv==0.11.26

	- name: Sync dependencies
	run: uv sync --frozen --python ${{ matrix.python-version }} --extra dev --extra mcp

	- name: Run tests
	run: uv run --python ${{ matrix.python-version }} pytest tests/ -v --tb=short

	postgres-ledger:
	runs-on: ubuntu-latest
	services:
	postgres:
	image: postgres:16-alpine@sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777
	env:
	POSTGRES_DB: argus_test
	POSTGRES_USER: postgres
	POSTGRES_PASSWORD: postgres
	ports:
	- 5432:5432
	options: >-
	--health-cmd "pg_isready -U postgres -d argus_test"
	--health-interval 5s
	--health-timeout 5s
	--health-retries 10
	env:
	ARGUS_AUTOLOAD_DOTENV: "false"
	ARGUS_DISABLE_SECRET_RESOLUTION: "true"
	ARGUS_EGRESS_TYPE: "unknown"
	ARGUS_RESIDENTIAL_POLICY: "off"
	ARGUS_TEST_POSTGRES_URL: postgresql+psycopg2://postgres:postgres@127.0.0.1:5432/argus_test
	ARGUS_TEST_ALLOW_PROVISIONING: disposable-only
	ARGUS_TEST_PSQL: /usr/bin/psql
	steps:
	- uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0

	- name: Set up Python 3.12
	uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
	with:
	python-version: "3.12"

	- name: Install uv
	run: python -m pip install uv==0.11.26

	- name: Sync dependencies
	run: uv sync --frozen --python 3.12 --extra dev --extra mcp

	- name: Install PostgreSQL client
	run: \|
	sudo apt-get update
	sudo apt-get install -y postgresql-client
	test -x "$ARGUS_TEST_PSQL"
	"$ARGUS_TEST_PSQL" --version

	- name: Run PostgreSQL ledger contract
	run: \|
	uv run --python 3.12 pytest \
	tests/test_search_ledger.py \
	tests/test_provider_spend.py \
	tests/test_maya_outbox.py \
	tests/test_api.py::TestSearchEndpoint::test_postgresql_constraint_failure_returns_503_and_rolls_back_ledger \
	tests/test_operation_ledger.py::test_postgresql_extraction_and_session_contract \
	tests/test_operation_ledger.py::test_postgresql_concurrent_session_creation_and_query_allocation \
	tests/test_operation_ledger.py::test_postgresql_concurrent_sanitized_session_url_inserts_are_idempotent \
	tests/test_recovery_database.py::test_postgresql_restore_verifier_uses_disposable_database \
	tests/test_recovery_database.py::test_postgresql_atlas_restore_inventory_detects_count_drift \
	tests/test_postgres_provisioning.py \
	-v --tb=short

	production-config:
	runs-on: ubuntu-latest
	env:
	ARGUS_AUTOLOAD_DOTENV: "false"
	ARGUS_DISABLE_SECRET_RESOLUTION: "true"
	ARGUS_ENV: production
	ARGUS_EGRESS_TYPE: datacenter
	ARGUS_RESIDENTIAL_POLICY: fallback
	steps:
	- uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0

	- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
	with:
	python-version: "3.12"

	- name: Install uv
	run: python -m pip install uv==0.11.26

	- name: Sync frozen production dependencies
	run: uv sync --frozen --extra dev --extra mcp

	- name: Verify production-like configuration
	run: uv run pytest tests/test_production_config.py -v --tb=short

	image-build:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0

	- uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3

	- name: Build production image
	uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
	with:
	context: .
	push: false
	load: true
	tags: argus-browser-canary:${{ github.sha }}
	build-args: \|
	VCS_REF=${{ github.sha }}

	- name: Run 1 GiB browser admission canary
	run: \|
	docker run --rm --init \
	--network none \
	--memory 1g --memory-swap 1g --pids-limit 256 --shm-size 256m \
	--read-only --tmpfs /tmp:rw,noexec,nosuid,size=256m \
	--security-opt no-new-privileges:true \
	--security-opt seccomp=./docker/playwright-seccomp.json \
	--volume "$PWD/scripts/browser_canary.py:/canary/browser_canary.py:ro" \
	"argus-browser-canary:${{ github.sha }}" \
	python /canary/browser_canary.py --memory-limit-mib 1024

	- name: Run 512 MiB missing-browser regression
	run: \|
	docker run --rm --init \
	--network none \
	--memory 512m --memory-swap 512m --pids-limit 256 --shm-size 128m \
	--read-only \
	--tmpfs /tmp:rw,noexec,nosuid,size=128m \
	--tmpfs /ms-playwright:rw,noexec,nosuid,size=1m \
	--security-opt no-new-privileges:true \
	--security-opt seccomp=./docker/playwright-seccomp.json \
	--volume "$PWD/scripts/browser_canary.py:/canary/browser_canary.py:ro" \
	"argus-browser-canary:${{ github.sha }}" \
	python /canary/browser_canary.py \
	--expect-missing --memory-limit-mib 512

	freshness:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0

	- name: Install uv
	run: python3 -m pip install uv==0.11.26

	- name: Check llms.txt freshness
	run: \|
	README_TS=$(git log -1 --format=%ct -- README.md)
	LLMS_TS=$(git log -1 --format=%ct -- llms.txt)
	LLMSFULL_TS=$(git log -1 --format=%ct -- llms-full.txt)

	if [ "$LLMS_TS" -lt "$README_TS" ] \|\| [ "$LLMSFULL_TS" -lt "$README_TS" ]; then
	echo "::warning::llms.txt or llms-full.txt is older than README.md — update them before release"
	fi

	- name: Check version sync
	run: python3 scripts/verify_release_contract.py

Navigation Menu

Fuse provider evidence deterministically #227

Workflow file

Fuse provider evidence deterministically #227

Uh oh!

Workflow file for this run