hongmingandClaude Opus 5.5
eeebaca439
CI / test (push) Skipped
CI / provenance (push) Skipped
contract-credentials-binding / Vendored credentials contract byte-identical to molecule-ai-sdk canonical (push) Skipped
contract-verb-binding / Vendored contract byte-identical to molecule-ai-sdk canonical (push) Skipped
lint-infisical-extractor / lint-infisical-extractor (push) Skipped
meta-ci-advisory / meta (advisory) (push) Skipped
Publish to npm / publish (push) Skipped
contract-credentials-binding / Reader-binding credentials test (management client reads contract name) (push) Skipped
contract-verb-binding / Producer-binding verb test (management tool set ⊇ contract) (push) Skipped
CI / provenance (pull_request) Successful in 2s
contract-credentials-binding / Vendored credentials contract byte-identical to molecule-ai-sdk canonical (pull_request) Successful in 2s
contract-verb-binding / Vendored contract byte-identical to molecule-ai-sdk canonical (pull_request) Successful in 2s
lint-infisical-extractor / lint-infisical-extractor (pull_request) Successful in 3s
contract-credentials-binding / Reader-binding credentials test (management client reads contract name) (pull_request) Successful in 12s
meta-ci-advisory / meta (advisory) (pull_request) Successful in 12s
contract-verb-binding / Producer-binding verb test (management tool set ⊇ contract) (pull_request) Successful in 18s
CI / test (pull_request) Successful in 21s
audit-force-merge / audit (pull_request_target) Successful in 5s
Resolve ci.yml: keep this PR's tokenless provenance step (the packument is public; test_workflow_secret_boundary.py requires credential-free PR CI) and main's npm run build:manifest. Resolve package-lock.json: take main's 1.10.0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
74 lines
2.4 KiB
YAML
74 lines
2.4 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
branches: [main]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version: '20'
|
|
|
|
- name: Install dependencies
|
|
run: npm ci
|
|
|
|
- name: Publish tag guard self-test
|
|
run: bash .gitea/scripts/tests/test_publish_tag_guard.sh
|
|
|
|
- name: Package byte-provenance self-tests
|
|
run: |
|
|
bash .gitea/scripts/tests/test_package_byte_boundary.sh
|
|
bash .gitea/scripts/tests/test_published_artifact_provenance.sh
|
|
bash .gitea/scripts/tests/test_provenance_gate.sh
|
|
python3 .gitea/scripts/tests/test_workflow_secret_boundary.py
|
|
|
|
- name: Build
|
|
run: npm run build:manifest
|
|
|
|
- name: Test
|
|
run: npm test
|
|
|
|
- name: Real MCP transport integration tests
|
|
run: npm run test:integration
|
|
|
|
- name: Promote request SDK SSOT sync
|
|
run: bash .gitea/scripts/check-promote-request-vendor-sync.sh
|
|
|
|
# Required release-provenance lane. This is intentionally an ordinary
|
|
# fail-closed job: registry/tag drift reports a red CI status.
|
|
#
|
|
# Every published version requires a matching v<version> tag. A reviewed
|
|
# retroactive recovery additionally requires the exact registry tarball
|
|
# size/SHA-256 and exact tag -> canonical commit -> source tree mapping from
|
|
# contracts/published-package-provenance.json. A tag alone is deliberately
|
|
# not described as artifact-byte provenance.
|
|
#
|
|
# Branch protection must include "CI / provenance" in its required contexts;
|
|
# that server-side setting remains the merge-enforcement SSOT.
|
|
provenance:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
# Need the full v* tag history locally for the provenance comparison.
|
|
fetch-depth: 0
|
|
fetch-tags: true
|
|
persist-credentials: false
|
|
|
|
# The package packument and tarball are public reads. Keep pull-request CI
|
|
# credential-free; provenance-gate.sh fails closed on any HTTP error.
|
|
- name: Published tag + artifact provenance gate (required)
|
|
run: bash .gitea/scripts/provenance-gate.sh
|