RFC: CI/CD pipeline and automated testing

[HaraldeRoessler]

Background

The project currently has no automated testing or deployment pipeline. Tests exist (test_sandbox.py, test_protocol_compliance.py, tests/test_nonce_manager.py) but run only manually. Docker support was recently added (#1) which makes containerized testing feasible.

Proposal

Phase 1: GitHub Actions CI (minimal effort)

Run on every PR and push to main:

• Python dependency installation
• Unit tests (pytest)
• Docker image build verification

This catches broken imports, missing dependencies, and syntax errors before merge. Runs on GitHub's free tier — no infrastructure needed.

Phase 2: Integration testing (optional, needs infra)

• Deploy to a staging environment (K8s namespace or Docker Compose)
• Run smoke tests against a live API instance
• Credential issuance + verification round-trip
• Could integrate with the endpoint sensor work discussed in RFC: Endpoint Sensor / Kinetic Layer for Policy Self-Modification Detection (RSAC Gap 1) #8

Benefits

• Contributors can verify their PRs pass tests before requesting review
• Maintainer gets confidence that merges don't break existing functionality
• Foundation for automated deployment later

Open questions

• Should the CI run on ubuntu-latest or a custom runner?
• Which Python version(s) to test against? (codebase uses 3.12+ features like f-string nesting)
• Should Docker build be a required check or advisory?
• Any secrets needed for integration tests (test DB, test API keys)?

[HaraldeRoessler]

Phase 2 add-on: Runtime security validation with Falco

As a complement to the integration testing proposed in Phase 2, it might be worth connecting the CI/CD pipeline to a Falco-based runtime sensor (see #8).

Why this fits Phase 2:

• Smoke tests verify functional correctness (endpoints respond correctly)
• Falco syscall/eBPF rules can verify behavioral correctness (no unexpected policy self-modification, no anomalous file writes during test runs)

Proposed addition to Phase 2 checklist:

• Deploy Falco with MolTrust-specific rules to staging namespace
• Gate CI pass/fail on zero Falco critical alerts during smoke test run
• Export Falco events to pipeline logs for audit trail

This would give the project both functional and security regression coverage from a single CI run — without requiring a separate manual audit step.

Happy to draft the Falco rules and the CI integration snippet if there is interest. Tracked separately in #8.

[HaraldeRoessler]

First-cut implementation in #14 — install + syntax + pytest-collect jobs. Validated green on fork before opening upstream. Subsequent jobs (lint, test execution via docker-compose from #3, semgrep/security scans) are intentionally split into follow-up PRs to keep each gate reviewable on its own.