ci.yml

# SPDX-License-Identifier: AGPL-3.0-or-later
name: ci

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  gate:
    name: lint · types · tests (the merge gate)
    runs-on: ubuntu-latest
    steps:
      # P1-3 (SEC-04): runtime egress monitoring. Starts in `audit` mode (log,
      # don't block) so a real allowlist can be derived from real traffic
      # before flipping to `block`. Note: even in audit mode this step reports
      # run metadata to StepSecurity's own service (`disable-telemetry` only
      # takes effect under `egress-policy: block`) — a deliberate, documented
      # trade-off for a privacy-first repo, not an oversight.
      - name: Harden Runner (audit mode)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install uv (pinned)
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          version: "0.11.19"
          enable-cache: true
      - name: Lockfile drift (CQ-09)
        # Must precede `uv sync` and any `uv run`: a bare `uv run` silently relocks,
        # repairing the very drift a later check would look for. The sync below asks
        # for `--locked`, not `--frozen`; `--frozen` installs from uv.lock without
        # reading pyproject.toml, so it cannot see the two disagree and exits 0 on a
        # drifted lock.
        run: uv lock --check
      - name: Sync environment (Python 3.14, locked)
        run: uv sync --locked
      - name: Show interpreter
        run: uv run python -c "import sys; print('Python', sys.version)"
      # `make verify` includes the coverage gates: 85% overall plus the scoped
      # 95% per-module floor on the evidence-integrity core (crypto/vault/tsa/
      # verify.py) — see the `cov` target and CODE-QUALITY-STANDARD.
      - name: Run the full gate (ruff + mypy --strict + pytest + coverage floors 85%/95%)
        run: make verify
      - name: Upload coverage
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: coverage-xml
          path: coverage.xml
          if-no-files-found: ignore

  secrets:
    name: secret scanning (gitleaks)
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner (audit mode)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit
      - name: Checkout (full history — gitleaks needs it to scan the diff/range)
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0
          persist-credentials: false
      - name: Run gitleaks (fails the build on any finding; redacts secrets in logs)
        uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          # No GITLEAKS_LICENSE: this repo is under a personal account, not an
          # organization, so gitleaks-action does not require a license key.
          # Default config; non-zero exit fails the job. This is not a blanket
          # mute, but it is not "no mute" either, as this comment used to claim:
          # `.gitleaksignore` is present and honored, and holds a small set of
          # per-finding fingerprints, each with a stated, hand-verified reason
          # (synthetic RFC 3161 tokens in committed demo/golden packets). Any
          # finding not fingerprinted there still fails this gate.

  verifier-portability:
    name: verifier subset compiles on older Pythons
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      # The Apache-2.0 verifier subset must byte-compile on interpreters older than the
      # project's 3.14 dev target so legal-aid embedders can vendor it (see NOTICE,
      # verify.py docstring). This is the CI counterpart to the BUG-01 guard test
      # (test_verifier_subset_avoids_py314_only_except_syntax): it catches PEP 758
      # parenthesis-free `except A, B:` and any other 3.14-only syntax before merge.
      # Floor is 3.12: canonical.py uses PEP 695 `type` statements (3.12+), so 3.9–3.11
      # cannot parse the subset regardless of the except form.
      matrix:
        python-version: ["3.12", "3.13"]
    steps:
      - name: Harden Runner (audit mode)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install uv (pinned)
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          version: "0.11.19"
          enable-cache: true
      - name: Provision Python ${{ matrix.python-version }}
        env:
          PYTHON_VERSION: ${{ matrix.python-version }}
        run: uv python install "$PYTHON_VERSION"
      - name: Byte-compile the verifier subset (stdlib parse only, no deps)
        env:
          PYTHON_VERSION: ${{ matrix.python-version }}
        run: >
          uv run --python "$PYTHON_VERSION" --no-project
          python -m py_compile
          src/habitable/canonical.py
          src/habitable/crypto.py
          src/habitable/errors.py
          src/habitable/evidence.py
          src/habitable/timeline.py
          src/habitable/tsa.py
          src/habitable/verify.py

  audit:
    name: dependency vulnerability audit
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner (audit mode)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install uv (pinned)
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          version: "0.11.19"
          enable-cache: true
      - name: Lockfile drift (CQ-09)
        # Must precede `uv sync` and any `uv run`: a bare `uv run` silently relocks,
        # repairing the very drift a later check would look for. The sync below asks
        # for `--locked`, not `--frozen`; `--frozen` installs from uv.lock without
        # reading pyproject.toml, so it cannot see the two disagree and exits 0 on a
        # drifted lock.
        run: uv lock --check
      - name: Sync environment
        run: uv sync --locked
      - name: Audit dependencies (pip-audit)
        run: uv run pip-audit

  build:
    name: build wheel + sdist
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner (audit mode)
        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
        with:
          egress-policy: audit
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install uv (pinned)
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          version: "0.11.19"
      - name: Build distributions reproducibly
        run: make repro
      - name: Smoke-test the installed wheel and packaged app
        run: |
          uv venv --python 3.14 /tmp/habitable-wheel-smoke
          uv pip install --python /tmp/habitable-wheel-smoke/bin/python dist/*.whl
          /tmp/habitable-wheel-smoke/bin/python scripts/smoke_test_installed_wheel.py
      - name: Upload distributions
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: dist
          path: dist/*