spark-cli/.github/workflows/ci.yml at master · Esc1200/spark-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: CI

on:
  push:
    branches:
      - master
  pull_request:
  workflow_dispatch:

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  browser-use-dependency-compatibility:
    name: browser-use-dependencies (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    timeout-minutes: 20
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.11", "3.12", "3.13"]
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: ${{ matrix.python-version }}

      - name: Prove browser-use dependency compatibility
        run: |
          python -m pip install --upgrade pip
          python -m pip install '.[browser-use]'
          python -m pip check
          python -c "import browser_use, litellm"

  test-and-audit:
    name: test-and-audit
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Set up Python
        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
        with:
          python-version: "3.11"

      - name: Install test tools
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e .
          python -m pip install pytest pip-audit

      - name: Run tests
        run: python -m pytest -q

      - name: Verify installer release metadata
        run: python -m spark_cli.cli verify --installers --json

      - name: Audit Python dependencies
        run: pip-audit --progress-spinner off .

      - name: Verify module provenance
        run: python -m spark_cli.cli verify --provenance --json

      - name: Verify registry pins
        run: python -m spark_cli.cli verify --registry-pins --json

      - name: Assert expected unverified private pins
        run: |
          python -m spark_cli.cli verify --registry-pins --json | python -c "import json,sys; d=json.load(sys.stdin); n=int(d.get('unverified', 0)); assert n <= 3, f'unexpected unverified pins: {n}'; print('unverified:', n)"

      - name: release_policy_binding_gate
        run: python scripts/harness_checks/release_policy_binding_gate.py --root . --range "${{ github.event.pull_request.base.sha && format('{0}..{1}', github.event.pull_request.base.sha, github.sha) || 'HEAD' }}"

      - name: gate_evidence_separation
        run: python scripts/harness_checks/gate_evidence_separation.py --root . --range "${{ github.event.pull_request.base.sha && format('{0}..{1}', github.event.pull_request.base.sha, github.sha) || 'HEAD' }}"

  windows-installer-dry-run:
    name: windows-installer-dry-run
    runs-on: windows-latest
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false

      - name: Parse and dry-run the PowerShell installer
        shell: pwsh
        run: |
          $prefix = Join-Path $env:RUNNER_TEMP ("spark-r30-v3-dry-run-" + [guid]::NewGuid().ToString("N"))
          $output = & ./scripts/install.ps1 -DryRun -Prefix $prefix -SkipSetup -NoAutostart -SkipUserPath *>&1 | Out-String
          if ($output -notmatch [regex]::Escape("spark-cli-public-installer-2026-08-08-r30-v3")) {
            throw "PowerShell installer dry-run did not report the expected immutable release."
          }
          if (Test-Path -LiteralPath $prefix) {
            throw "PowerShell installer dry-run wrote to its target prefix."
          }

  secret-scan:
    name: secret-scan
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          persist-credentials: false
          fetch-depth: 0

      - name: Run gitleaks
        uses: gitleaks/gitleaks-action@ff98106e4c7b2bc287b24eaf42907196329070c7 # v2.3.9, Node 24 forced by workflow env
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}