feat(canonical): RFC 8785 (JCS) canonicalization for signed bodies (#25) #16
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| inputs: | |
| ref: | |
| description: "Branch or SHA to run CI on" | |
| required: false | |
| default: "" | |
| jobs: | |
| test: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13"] | |
| os: [ubuntu-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]" | |
| - name: Security scan | |
| run: pip install bandit pip-audit && bandit -r src/ -c pyproject.toml && pip-audit | |
| - name: Lint | |
| run: ruff check src/ tests/ | |
| - name: Type check | |
| run: mypy src/ca2a_runtime/ src/ca2a_verify/ | |
| - name: Test | |
| run: pytest tests/unit/ -v --tb=short --cov=src --cov-report=xml | |
| - name: Upload coverage report | |
| uses: codecov/codecov-action@v7 | |
| with: | |
| fail_ci_if_error: false | |
| governance: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install dependencies | |
| run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]" "agent-governance-toolkit>=4.1" | |
| - name: Generate evidence file | |
| run: python scripts/gen_agt_evidence.py | |
| # Advisory until Tier 2 (runtime peer-delegation enforcement) lands. cA2A | |
| # does not yet run the ASI coverage modules, so strict verify reports | |
| # INCOMPLETE. This flips to blocking (drop continue-on-error) once the | |
| # runtime enforces attenuated delegation on inbound peer calls. See ROADMAP. | |
| - name: AGT governance verify (advisory) | |
| continue-on-error: true | |
| run: agt verify --evidence agt-evidence.json | |
| - name: Save attestation JSON | |
| continue-on-error: true | |
| run: agt --json verify --evidence agt-evidence.json > agt-attestation.json | |
| - name: Upload governance artifacts | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: agt-governance-${{ github.sha }} | |
| path: | | |
| agt-evidence.json | |
| agt-attestation.json | |
| if-no-files-found: warn | |
| benchmark: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| if: github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install dependencies | |
| run: python -m pip install --upgrade pip setuptools && pip install -e ".[dev]" | |
| - name: Run benchmark (software-only, CI gate p99 < 5ms) | |
| run: python -m ca2a_runtime.benchmarks --provider software-only --hops 10000 --out benchmarks/ | |
| - name: Upload benchmark results | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: benchmark-results | |
| path: benchmarks/ | |
| if-no-files-found: warn |