verify.yml

name: verify

on:
  push:
    branches: [main, master]
  pull_request:
  # Dispatched by the daily snapshot job on its staging ref, so the commit it is about to push
  # to master carries this workflow's `verify` and `replay` checks -- the ones master requires
  # -- earned by the workflow itself rather than recorded by the job (ADR 0003).
  workflow_dispatch:

permissions:
  contents: read

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      # `uv sync --frozen` was here, described as the lockfile-drift check. It is not one, and
      # this was measured rather than reasoned about. On a copy of this project with a
      # dependency added to pyproject.toml and uv.lock left untouched, under the same
      # uv 0.12.1 this workflow pins:
      #
      #   uv lock --check    exit 1   ("the lockfile is not up-to-date with pyproject.toml")
      #   uv sync --locked   exit 1   (same)
      #   uv sync --frozen   exit 0   (installed the stale set and said nothing)
      #
      # `--frozen` means "install from the lock without consulting pyproject.toml at all", so
      # it cannot notice the two disagreeing; that is the whole point of the flag. It is the
      # right flag for a deploy and the wrong one for a gate.
      #
      # The check is separated from the install so the failure names itself. Note also why
      # `make verify` runs .venv/bin/python rather than `uv run`: a bare `uv run` re-locks
      # silently, so a gate invoked that way repairs the drift it was asked to detect and then
      # passes.
      - name: Install uv
        run: python -m pip install "uv==0.12.1"
      - name: Check the lockfile against pyproject.toml
        run: uv lock --check
      - name: Install exactly what the lockfile pins
        run: uv sync --locked
      - name: Verify (lint, format check, strict typecheck, tests with coverage floor)
        run: make verify

  # Grading the committed 600-institution capture on every push proves the pipeline still runs
  # end to end without spending a single API call. It also pins the findings: if a change to the
  # rules moves the mean or drops an implausible value, it shows up here as a diff in the log
  # rather than a month later in a scheduled run nobody was reading.
  replay:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.12"
      - name: Install
        run: python -m pip install -e .
      - name: Grade the committed capture
        run: python -m disclosed.cli grade --source data/sample.json --out /tmp/report.json
      # The national artifact is committed, so the site can be rebuilt with its national page
      # without fetching anything. This is also the check that the two never disagree about
      # scope: `site` refuses nothing, but a sample report rendered beside a national artifact
      # must still say on its front page that its own figures are not national ones.
      - name: Build the site from it
        run: >
          python -m disclosed.cli site
          --report /tmp/report.json --national data/national.json
          --out /tmp/site --generated "${GITHUB_SHA}"
      # The committed dataset.csv is what anyone citing this project will download, so it must
      # never fall behind the report it claims to describe. A test asserts they match; this
      # proves the export still runs end to end.
      - name: Export the dataset and its schema
        run: >
          python -m disclosed.cli dataset
          --report /tmp/report.json --out /tmp/export/dataset.csv