fix: recognize announced repository maintainers as code owners (#621) #910
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| inputs: | |
| ref: | |
| description: "Branch or SHA to run CI on" | |
| required: false | |
| default: "" | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13"] | |
| os: [ubuntu-latest, windows-latest] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| # Third-party dependencies come from the hash-pinned lock first; the | |
| # local package then goes in with --no-deps, because pip cannot | |
| # hash-pin an editable install in the same invocation. | |
| run: | | |
| python -m pip install --require-hashes -r requirements/dev.txt | |
| python -m pip install --no-deps -e . | |
| - name: Security scan | |
| # --skip-editable: pip-audit resolves the editable install of this package | |
| # against PyPI and fails when the version is not published yet, so without | |
| # it no version-bump PR can ever pass CI. Dependencies are still audited. | |
| # | |
| # bandit and pip-audit are already in the dev extra above, so the | |
| # scan runs against the same pinned versions rather than fetching | |
| # whatever is current at scan time. | |
| run: bandit -r src/ -c pyproject.toml && pip-audit --skip-editable | |
| - name: Lint | |
| run: ruff check src/ tests/ | |
| - name: Type check | |
| run: mypy src/cmcp_runtime/ | |
| - name: Test | |
| # Soak tests are intentionally excluded from per-PR CI. | |
| run: pytest tests/unit/ tests/conformance/ tests/integration/ -v --tb=short --cov=src --cov-report=xml | |
| - name: Upload coverage report | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| with: | |
| fail_ci_if_error: false | |
| governance: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install cMCP dependencies | |
| # Third-party dependencies come from the hash-pinned lock first; the | |
| # local package then goes in with --no-deps, because pip cannot | |
| # hash-pin an editable install in the same invocation. | |
| run: | | |
| python -m pip install --require-hashes -r requirements/dev.txt | |
| python -m pip install --no-deps -e . | |
| - name: Install AGT as isolated CI tooling | |
| run: | | |
| python -m venv .agt-venv | |
| .agt-venv/bin/python -m pip install --require-hashes -r requirements/agt.txt | |
| .agt-venv/bin/python -m pip install --no-deps -e . | |
| - name: Generate evidence file | |
| run: .agt-venv/bin/python scripts/gen_agt_evidence.py | |
| - name: Verify AGT runtime evidence (isolated) | |
| run: | | |
| set +e | |
| output=$(.agt-venv/bin/agt verify --evidence agt-evidence.json 2>&1) | |
| status=$? | |
| set -e | |
| printf '%s\n' "$output" | |
| printf '%s\n' "$output" | grep -Fq "Runtime Evidence: 6/6 checks passed" | |
| test "$status" -eq 0 || test "$status" -eq 1 | |
| - name: Save attestation JSON | |
| run: | | |
| set +e | |
| .agt-venv/bin/agt --json verify --evidence agt-evidence.json > agt-attestation.json | |
| status=$? | |
| set -e | |
| python -m json.tool agt-attestation.json > /dev/null | |
| test "$status" -eq 0 || test "$status" -eq 1 | |
| - name: Upload governance artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0 | |
| with: | |
| name: agt-governance-${{ github.sha }} | |
| path: | | |
| agt-evidence.json | |
| agt-attestation.json | |
| if-no-files-found: warn | |
| benchmark: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| if: github.ref == 'refs/heads/main' | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install dependencies | |
| # Third-party dependencies come from the hash-pinned lock first; the | |
| # local package then goes in with --no-deps, because pip cannot | |
| # hash-pin an editable install in the same invocation. | |
| run: | | |
| python -m pip install --require-hashes -r requirements/dev.txt | |
| python -m pip install --no-deps -e . | |
| - name: Run benchmark (software-only, CI gate p99 < 5ms) | |
| run: python -m cmcp_runtime.benchmarks --provider software-only --calls 10000 --out benchmarks/ | |
| - name: Upload benchmark results | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0 | |
| with: | |
| name: benchmark-results | |
| path: benchmarks/ | |
| if-no-files-found: warn |