ci.yml

# CI runs exactly the Makefile targets `make verify` runs locally, in the same order.
# Green locally means green here; there is no CI-only gate and no local-only gate.
#
# ── THERE IS NO PAGES WORKFLOW, AND THAT IS THE DESIGN ───────────────────────────────────
# There used to be. It uploaded `dist/` with actions/deploy-pages, and it could never have
# run: this repository's owner has an **account-wide GitHub Actions spending limit**, so a
# workflow-driven Pages build is not a deployment path, it is a promise nobody can keep.
#
# The published site is therefore served **from the branch**, not from CI: the artifacts are
# committed under `docs/` (the only non-root source path branch-based Pages will serve), the
# site needs no build step, and enabling it is a repository *setting* rather than a job —
# Settings → Pages → Source: "Deploy from a branch" → `main` / `/docs`.
#
# The same reasoning governs this file. **Do not assume it ever runs.** `make verify` is the
# gate; this workflow is a convenience that re-runs it. And because the bytes GitHub Pages
# serves are the bytes in the commit — with no CI step in between to re-check them — the
# safety gate runs against the *committed* published output too, not only against freshly
# generated bytes: see `test_the_committed_published_feed_holds_the_safety_property`.
name: ci

on:
  push:
    branches: [main]
  pull_request:
  schedule:
    # Weekly, so a newly-disclosed dependency vulnerability (stage 4) surfaces even
    # when nobody has pushed. Note this does NOT run `sentinel watch` — the watch is an
    # operational job with a persistent snapshot store, not a build step.
    - cron: "17 6 * * 1"

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    name: verify
    permissions:
      contents: read
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false

      - name: Install uv
        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
        with:
          version: "0.11.28"
          python-version: "3.12"
          enable-cache: true

      # The full merge gate: lint · typecheck · tests+coverage(>=90) · pip-audit ·
      # sources-validate · no-unreviewed-in-feed + no-unlabelled-source · no-auto-classification.
      #
      # The suite makes NO network calls: the fetcher is injected and the tests pass it
      # fixtures — and so is the prompt, which is why the interactive `sentinel verify` loop
      # is tested here without a terminal. If a future change makes CI depend on a state
      # government's website being up, that is a bug in the test, not a flaky runner.
      - name: Run the local verification gate
        run: make verify