verify.yml

name: verify

on:
  push:
    branches: [main, master]
  pull_request:

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      # uv sync --frozen is the lockfile-drift check: CI refuses to resolve anything the
      # committed uv.lock does not already pin, so the toolchain that gates a merge is the
      # toolchain the lockfile says it is.
      - name: Install
        run: |
          python -m pip install "uv==0.12.1"
          uv sync --frozen
      - name: Verify (lint, format check, strict typecheck, tests with coverage floor)
        run: make verify

  # Grading the committed 600-institution capture on every push proves the pipeline still runs
  # end to end without spending a single API call. It also pins the findings: if a change to the
  # rules moves the mean or drops an implausible value, it shows up here as a diff in the log
  # rather than a month later in a scheduled run nobody was reading.
  replay:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"
      - name: Install
        run: python -m pip install -e .
      - name: Grade the committed capture
        run: python -m disclosed.cli grade --source data/sample.json --out /tmp/report.json
      # The national artifact is committed, so the site can be rebuilt with its national page
      # without fetching anything. This is also the check that the two never disagree about
      # scope: `site` refuses nothing, but a sample report rendered beside a national artifact
      # must still say on its front page that its own figures are not national ones.
      - name: Build the site from it
        run: >
          python -m disclosed.cli site
          --report /tmp/report.json --national data/national.json
          --out /tmp/site --generated "${GITHUB_SHA}"
      # The committed dataset.csv is what anyone citing this project will download, so it must
      # never fall behind the report it claims to describe. A test asserts they match; this
      # proves the export still runs end to end.
      - name: Export the dataset and its schema
        run: >
          python -m disclosed.cli dataset
          --report /tmp/report.json --out /tmp/export/dataset.csv