gmail-channel-molecule/.gitea/workflows/ci.yml

name: ci

on:
  push:
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  static:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Run hash-pinned ShellCheck and actionlint
        run: bash tools/static_gate.sh

  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.13"]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
          cache-dependency-path: requirements-test.lock
      - name: Install hash-locked test environment
        env:
          PIP_INDEX_URL: https://pypi.org/simple/
        run: |
          python -m pip install --require-hashes -r requirements-test.lock
          python -m pip install --no-deps --no-build-isolation -e .
          python -m pip check
      - name: Run compile, lint, test, composed UDS, build, and install gate
        run: bash tools/test_gate.sh

  runtime-supervisor-e2e:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
          cache: pip
          cache-dependency-path: requirements-runtime-e2e.lock
      - name: Run exact published runtime supervisor boundary
        run: |
          physical_temp="$(mktemp -d "$RUNNER_TEMP/gmail-runtime-root.XXXXXX")"
          temp_alias="${physical_temp}.symlink"
          ln -s "$physical_temp" "$temp_alias"
          cleanup_temp_alias() {
            rm -f "$temp_alias"
            rm -rf "$physical_temp"
          }
          trap cleanup_temp_alias EXIT HUP INT TERM
          RUNNER_TEMP="$temp_alias" bash tools/runtime_supervisor_gate.sh

  sdk-contract:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
      - name: Install immutable SDK and hash-locked contract environment
        env:
          PIP_INDEX_URL: https://pypi.org/simple/
        run: |
          sdk_lock="$RUNNER_TEMP/molecule-sdk.lock"
          (umask 077
            printf '%s\n' \
              'molecule-ai-sdk==0.5.4 --hash=sha256:17898e0801c96c0eaf282750b03b348c0a82d6f7724ff4548e3d2633ce26802a' \
              > "$sdk_lock"
          )
          python -m pip install --require-hashes -r requirements-test.lock
          python -m pip install --no-deps --require-hashes \
            --index-url https://git.moleculesai.app/api/packages/molecule-ai/pypi/simple/ \
            -r "$sdk_lock"
          python -m pip check
      - name: Validate clean tracked plugin bundle against SDK channel API v1
        run: bash tools/sdk_contract_gate.sh

  security:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
          persist-credentials: false
      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
        with:
          python-version: "3.11"
      - name: Run verified full-history gitleaks and OSV gate
        run: bash tools/security_gate.sh