ci.yml

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"

permissions:
  contents: read

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Validate JSON files
        run: |
          find . -name "*.json" -not -path "./.git/*" | while read -r f; do
            python3 -m json.tool "$f" > /dev/null && echo "OK: $f" || exit 1
          done
      - name: Validate YAML files
        run: |
          pip install -q --require-hashes -r requirements/yaml-lint.txt
          find . -name "*.yaml" -o -name "*.yml" | grep -v ".git" | while read -r f; do
            python3 -c "import yaml, sys; yaml.safe_load(open(sys.argv[1]))" "$f" && echo "OK: $f" || exit 1
          done

  financial-services:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: financial-services
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python 3.11
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Run credit engine tests
        run: python -m unittest discover -s tests -v

  agentic-commerce-accountability:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: agentic-commerce-accountability
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python 3.11
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Run accountability tests
        run: python -m unittest discover -s tests -v

      - name: Regenerate and compare committed fixtures
        run: |
          python generate_fixtures.py
          git diff --exit-code -- fixtures

  released-ucp-accountability:
    runs-on: ubuntu-24.04
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Build the locked released-UCP verification image
        run: >-
          docker build --no-cache --tag released-ucp-accountability:ci
          agentic-commerce-accountability/released_ucp

      - name: Run the demo and checks without network or elevated privileges
        run: >-
          docker run --rm --network none --read-only --cap-drop ALL
          --security-opt no-new-privileges --pids-limit 128
          --memory 1g --cpus 2 --tmpfs /tmp:rw,nosuid,nodev,size=256m
          released-ucp-accountability:ci

  industrial-embodied-ai:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: industrial-embodied-ai
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python 3.11
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"
          cache: "pip"
          cache-dependency-path: industrial-embodied-ai/requirements.txt

      - name: Install controller test dependencies
        run: python -m pip install --require-hashes -r ../requirements/controller-tests.txt

      - name: Run controller tests
        run: python -m unittest discover -s tests -v

      - name: Install artifact validation dependencies
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        run: python -m pip install -r requirements.txt

      - name: Verify committed evidence artifacts
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
        run: python validate_artifacts.py

  healthcare:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: healthcare
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python 3.11
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Run clinical engine tests
        run: python -m unittest discover -s tests -v

  embodied-action-receipts:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: embodied-action-receipts
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python 3.11
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"
          cache: "pip"
          cache-dependency-path: embodied-action-receipts/requirements.txt

      - name: Install dependencies
        run: python -m pip install -r requirements.txt

      - name: Verify embodied-action receipt fixtures
        run: python -m unittest discover -s tests -v

  multi-tenant-saas:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: multi-tenant-saas
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python 3.11
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Run people directory tests
        run: python -m unittest discover -s tests -v

  ca2a-delegation:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: ca2a-delegation
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python 3.11
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Install cA2A runtime (pre-release)
        run: python -m pip install --pre ca2a-runtime

      - name: Run delegation tests
        run: python -m unittest discover -s tests -v

      - name: Run the delegation demo
        run: python delegation_agent.py

  weight-custody-manifest:
    runs-on: ubuntu-latest
    defaults:
      run:
        working-directory: weight-custody-manifest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: Set up Python 3.11
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
        with:
          python-version: "3.11"

      - name: Install the WCM SDK from PyPI
        run: python -m pip install -r requirements.txt

      # One runner, discovered rather than listed, so a new demo is covered the
      # day it lands. The list lived in this file and in nobody else's reach,
      # which is why the SDK repository could not run these before cutting a
      # release. It now calls the same script; see run_demos.py.
      - name: Install the model-signing extra the provenance demo needs
        # The runner is pinned; the SDK these demos exercise stays resolved
        # from PyPI, which is what makes them a check on the release.
        run: |
          python -m pip install --require-hashes -r ../requirements/wcm-harness.txt
          python -m pip install "weight-custody-manifest[model-signing]>=0.27.0"

      - name: Run every offline demo and the unit tests
        run: python run_demos.py