demo.yml

name: demo

# Distinct title so it isn't confused with the ci workflow on the same commit.
run-name: demo — ${{ github.head_ref || github.ref_name }}

# The tutorial (#84) is the first artifact whose correctness depends on three
# repositories at once: this one, forgejo-warden and the published reference.
# This job runs its six steps against forgejo-warden's own Docker Compose
# sandbox, with the policy cut out of the tutorial page by scripts/demo.sh,
# so the page and the job cannot drift apart. Like corpus.yml it has no
# pull_request or push trigger: it pulls a container image and a second
# repository, and either being unavailable would fail the main gate on a
# change that has nothing to do with it.
on:
  workflow_dispatch:
  schedule:
    # Mondays, early UTC, after the corpus run.
    - cron: '41 6 * * 1'

concurrency:
  group: demo-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  # write: the job commits docs/data/smoke.json, the record the evidence page renders (#146).
  contents: write

env:
  # forgejo-warden at the commit the tutorial was last run against. Move it
  # when the tutorial changes or warden's loader does.
  WARDEN_REF: 86dc640600314ef01793a42b59893ac59d01f66a
  WARDEN_DIR: .forgejo-warden

jobs:
  demo:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6

      - name: Check out forgejo-warden
        uses: actions/checkout@v6
        with:
          repository: INTENTIUS/forgejo-warden
          ref: ${{ env.WARDEN_REF }}
          path: ${{ env.WARDEN_DIR }}

      - uses: actions/setup-node@v6
        with:
          node-version: '24'

      # warden's dependencies include the published @intentius/tsad-reference,
      # which is the evaluator the tutorial runs on.
      - name: Install and build forgejo-warden
        working-directory: ${{ env.WARDEN_DIR }}
        run: |
          npm ci
          npm run build

      # bootstrap.sh appends FORGEJO_E2E_URL and FORGEJO_E2E_TOKEN to
      # $GITHUB_ENV when it runs under Actions, so later steps inherit them.
      - name: Stand up the sandbox
        working-directory: ${{ env.WARDEN_DIR }}
        run: bash e2e/bootstrap.sh

      - name: The six steps
        env:
          TUTORIAL: docs/content/try-it/_index.md
        run: WARDEN_DIR="${{ github.workspace }}/${{ env.WARDEN_DIR }}" bash scripts/demo.sh

      # The four claims, each plain and with BREAK=1, on the same sandbox
      # (each takes a fresh org). The record is committed so the evidence page
      # shows the last run's verdicts with their commit and date.
      - name: The claims, held and caught
        run: WARDEN_DIR="${{ github.workspace }}/${{ env.WARDEN_DIR }}" bash scripts/smoke-record.sh docs/data/smoke.json

      # #192 — which specification version warden is actually running, read
      # from the evaluator warden itself installed rather than from anything we
      # ship. Reported and committed, never gated: the version a consumer pins
      # is that repository's decision. `if: always()` because a skew is most
      # worth knowing about on a run where something else went wrong.
      - name: Report the consumer's version skew
        if: always()
        run: node scripts/consumer-skew.mjs "${{ github.workspace }}/${{ env.WARDEN_DIR }}" docs/data/consumer-skew.json

      - name: Commit the record
        if: always()
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "github-actions[bot]@users.noreply.github.com"
          git add docs/data/smoke.json docs/data/consumer-skew.json
          git diff --cached --quiet || git commit -m "smoke: record of the weekly run" && git push

      - name: Tear down
        if: always()
        working-directory: ${{ env.WARDEN_DIR }}
        run: docker compose -f e2e/docker-compose.yml down -v