feat: audit-driven hardening pass (Critical/High/Medium) + v0.3.0 #39
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # .github/workflows/test.yml | |
| name: test | |
| on: | |
| push: | |
| branches: [develop, master] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: test-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| pytest: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| matrix: | |
| os: [ubuntu-latest, macos-latest, windows-latest] | |
| python-version: ["3.9", "3.12"] | |
| exclude: | |
| - os: macos-latest | |
| python-version: "3.9" | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: pip install pytest pytest-cov | |
| - name: Run tests | |
| run: python -m pytest tests/unit tests/integration -v --cov=skills/adr-toolkit/scripts --cov-branch --cov-report=term-missing --cov-fail-under=85 | |
| type-check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install mypy | |
| run: pip install mypy | |
| - name: Type-check the fully-typed core modules | |
| run: >- | |
| mypy | |
| skills/adr-toolkit/scripts/core/atomic_io.py | |
| skills/adr-toolkit/scripts/core/telemetry.py | |
| skills/adr-toolkit/scripts/core/contracts.py | |
| --strict | |
| version-drift: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Check manifest versions and descriptions are in sync | |
| run: python scripts/sync_version.py --check | |
| examples-drift: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Verify examples workflows execution and parity | |
| run: python scripts/verify_examples.py --check | |
| pr-title-check: | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Validate PR Title Conventional Commits Format | |
| run: | | |
| TITLE="${{ github.event.pull_request.title }}" | |
| echo "Checking PR Title: $TITLE" | |
| REGEX="^(feat|fix|docs|style|refactor|perf|test|chore|ci)(\([a-z0-9-]+\))?!?: .+" | |
| if [[ ! "$TITLE" =~ $REGEX ]]; then | |
| echo "❌ PR Title does not match Conventional Commits format." | |
| echo "Expected format: type(scope): description (e.g. feat(cli): add discover command)" | |
| exit 1 | |
| fi | |
| echo "✓ PR Title matches Conventional Commits format." | |
| harness-parity: | |
| # Installs the real Codex CLI and Gemini CLI and drives their own plugin | |
| # commands against this repo, the same way a contributor would. Manifest | |
| # JSON shape is already covered by tests/unit/test_*_adapter.py; this job | |
| # instead proves discovery -> install -> list -> the installed skill | |
| # package's script layer still runs, so an upstream CLI change or a | |
| # manifest edit that breaks real installation fails CI instead of | |
| # surfacing later as a user-reported install failure. Antigravity CLI | |
| # (agy) has no public package registry distribution, so it stays a | |
| # manually verified adapter only -- see adapters/antigravity/README.md. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Install Codex CLI | |
| run: npm install -g @openai/codex@0.151.0 | |
| - name: Install Gemini CLI | |
| run: npm install -g @google/gemini-cli@0.46.0 | |
| - name: Verify Codex CLI adapter end to end | |
| run: | | |
| set -euo pipefail | |
| export CODEX_HOME="$(mktemp -d)" | |
| REPO_ROOT="$(pwd)" | |
| codex plugin marketplace add "$REPO_ROOT" | |
| INSTALLED_PATH="$(codex plugin add adr-toolkit@adr-toolkit-marketplace --json | jq -r '.installedPath')" | |
| codex plugin list | |
| SCRATCH="$(mktemp -d)" | |
| cd "$SCRATCH" && git init -q | |
| python3 "$INSTALLED_PATH/skills/adr-toolkit/scripts/adr.py" preflight --json | jq -e '.ok == true' | |
| python3 "$INSTALLED_PATH/skills/adr-toolkit/scripts/adr.py" init --dir docs/decisions --json | jq -e '.ok == true' | |
| python3 "$INSTALLED_PATH/skills/adr-toolkit/scripts/adr.py" validate --dir docs/decisions --json | jq -e '.ok == true' | |
| - name: Verify Gemini CLI adapter end to end | |
| run: | | |
| set -euo pipefail | |
| REPO_ROOT="$(pwd)" | |
| mkdir -p adapters/gemini-cli/skills | |
| ln -s "$REPO_ROOT/skills/adr-toolkit" adapters/gemini-cli/skills/adr-toolkit | |
| export HOME="$(mktemp -d)" | |
| gemini extensions validate "$REPO_ROOT/adapters/gemini-cli" | |
| printf 'y\ny\n' | gemini extensions install "$REPO_ROOT/adapters/gemini-cli" --consent | |
| gemini extensions list | |
| INSTALLED_PATH="$HOME/.gemini/extensions/adr-toolkit" | |
| SCRATCH="$(mktemp -d)" | |
| cd "$SCRATCH" && git init -q | |
| python3 "$INSTALLED_PATH/skills/adr-toolkit/scripts/adr.py" preflight --json | jq -e '.ok == true' | |
| python3 "$INSTALLED_PATH/skills/adr-toolkit/scripts/adr.py" init --dir docs/decisions --json | jq -e '.ok == true' | |
| python3 "$INSTALLED_PATH/skills/adr-toolkit/scripts/adr.py" validate --dir docs/decisions --json | jq -e '.ok == true' |