ci: fail closed when CodeQL analysis fails #16
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: capture-core tests | |
| on: | |
| pull_request: | |
| paths: | |
| - "packages/agentrust-capture-core/**" | |
| - ".github/workflows/capture-core-tests.yml" | |
| push: | |
| branches: [main] | |
| paths: | |
| - "packages/agentrust-capture-core/**" | |
| - ".github/workflows/capture-core-tests.yml" | |
| permissions: | |
| contents: read | |
| jobs: | |
| # The engines run from shell hooks at session start, before anything is | |
| # installed, so the core must work on the standard library alone. 3.9 is the | |
| # floor because the scheduled-agents matrix tests it. | |
| core: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.9", "3.11", "3.12", "3.13"] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Run core tests | |
| working-directory: packages/agentrust-capture-core | |
| run: | | |
| pip install pytest | |
| python -m pytest tests -q | |
| # The engines import the core as a hard dependency now, so the thing worth | |
| # proving is that a fresh install of the built package actually satisfies every | |
| # engine. Previously this job asserted the opposite, that they worked WITHOUT it. | |
| engines-import-against-the-installed-core: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Install the core from source, then import every engine | |
| run: | | |
| pip install ./packages/agentrust-capture-core | |
| python - <<'PY' | |
| import importlib.util | |
| for path in ( | |
| "claude-code/engine/capture.py", | |
| "plugins/agentrust-codex/engine/capture.py", | |
| "scheduled-agents/engine/capture.py", | |
| "copilot/engine/capture.py", | |
| ): | |
| spec = importlib.util.spec_from_file_location("cap_" + path.replace("/", "_"), path) | |
| module = importlib.util.module_from_spec(spec) | |
| spec.loader.exec_module(module) | |
| assert "_vendor" not in module.core.__file__, path + " still loaded a vendored copy" | |
| print("ok:", path, "->", module.core.__version__) | |
| PY | |
| # A missing core must fail loudly. The engines previously fell back to a vendored | |
| # copy; now they must tell the user what to install rather than emitting a vague | |
| # "integrity check skipped". | |
| missing-core-fails-clearly: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Engine must name the missing package | |
| run: | | |
| set +e | |
| out="$(python claude-code/engine/capture.py verify 2>&1)" | |
| code=$? | |
| set -e | |
| echo "$out" | |
| if [ "$code" -eq 0 ]; then | |
| echo "::error::engine succeeded without the core installed"; exit 1 | |
| fi | |
| echo "$out" | grep -q "pip install agentrust-capture-core" || { echo "::error::error message does not say what to install"; exit 1; } |