tsa-integration.yml

# SPDX-License-Identifier: AGPL-3.0-or-later
name: tsa-integration

on:
  schedule:
    - cron: "23 5 * * 1" # weekly, Monday 05:23 UTC
  workflow_dispatch:

permissions:
  contents: read

jobs:
  public-tsa:
    name: stamp + verify against real public RFC 3161 authorities
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - name: Install uv (pinned)
        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          version: "0.11.19"
          enable-cache: true
      - name: Lockfile drift (CQ-09)
        # Must precede `uv sync` and any `uv run`: a bare `uv run` silently relocks,
        # repairing the very drift a later check would look for. The sync below asks
        # for `--locked`, not `--frozen`; `--frozen` installs from uv.lock without
        # reading pyproject.toml, so it cannot see the two disagree and exits 0 on a
        # drifted lock.
        run: uv lock --check
      - name: Sync environment
        run: uv sync --locked
      - name: Stamp + verify against public TSAs (only a hash is sent, never content)
        run: make integration