agent-bounties/.github/workflows/ci.yml at main · ghzhost/agent-bounties · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  sdlc-recovery:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Validate bounded self-healing contract
        run: |
          python scripts/test_self_heal.py -v
          python scripts/self_heal.py validate-policy \
            --policy ops/self-healing-policy.json
          python scripts/self_heal.py bench \
            --policy ops/self-healing-policy.json \
            --fixtures ops/fixtures/recovery-cases.json \
            --output target/operations/recovery-bench.json

      - name: Upload RecoveryBench evidence
        uses: actions/upload-artifact@v7.0.1
        with:
          name: recovery-bench-${{ github.run_id }}
          path: target/operations/recovery-bench.json
          if-no-files-found: error
          retention-days: 30

  ruleset-drift:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - name: Ruleset drift checker offline fixtures
        run: python scripts/test_ruleset_drift_check.py -v

  full-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@1.88.0
        with:
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2

      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"

      - uses: actions/setup-node@v7
        with:
          node-version: "22"
          cache: "npm"
          cache-dependency-path: crates/sdk-typescript/package-lock.json

      - uses: foundry-rs/foundry-toolchain@v1

      - name: Run full repository gate
        shell: bash
        run: |
          set -o pipefail
          mkdir -p target/ci
          bash scripts/check.sh 2>&1 | tee target/ci/full-check.log

      - name: Upload full-check log
        if: always()
        uses: actions/upload-artifact@v7.0.1
        with:
          name: full-check-log-${{ github.run_id }}
          path: target/ci/full-check.log
          if-no-files-found: warn
          retention-days: 7

  postgres-sync:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: agent_bounties
          POSTGRES_PASSWORD: agent_bounties
          POSTGRES_DB: agent_bounties
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U agent_bounties"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 12
    env:
      AGENT_BOUNTIES_TEST_DATABASE_URL: postgres://agent_bounties:agent_bounties@localhost:5432/agent_bounties
    steps:
      - uses: actions/checkout@v4

      - uses: dtolnay/rust-toolchain@1.88.0
      - uses: Swatinem/rust-cache@v2

      - name: Verify Postgres test configuration
        run: test -n "$AGENT_BOUNTIES_TEST_DATABASE_URL"

      - name: Run Postgres sync regressions
        run: |
          cargo test -p db tests::x402_relay_attempt_is_idempotent_and_lease_bounded -- --ignored --exact --nocapture
          cargo test -p api github_issue_api_sync_postgres -- --ignored --nocapture
          cargo test -p api tests::bounty_status_reads_base_events_from_postgres_after_cross_process_indexing -- --ignored --exact --nocapture
          cargo test -p mcp-server tests::mcp_bounty_status_reads_scoped_postgres_after_cross_process_funding -- --ignored --exact --nocapture