ci: hash-pin the test harness across the remaining workflows #77
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: claude-code tests | |
| on: | |
| pull_request: | |
| paths: | |
| - "claude-code/**" | |
| - ".github/workflows/claude-code-tests.yml" | |
| push: | |
| branches: [main] | |
| paths: | |
| - "claude-code/**" | |
| - ".github/workflows/claude-code-tests.yml" | |
| permissions: | |
| contents: read | |
| jobs: | |
| # The drift path needs only agentrust-capture-core. This job installs no crypto | |
| # packages, so the signing tests skip and any accidental dependency on them fails | |
| # the build. The core is installed from this checkout, not PyPI, so the suite runs | |
| # against the code in the pull request. | |
| drift-without-signing: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Run the drift suite without the signing packages | |
| run: | | |
| # The local package goes in with --no-deps: it has no runtime | |
| # dependencies of its own, so nothing here resolves against PyPI. | |
| pip install --require-hashes -r requirements/pytest-9.txt | |
| pip install --no-deps ./packages/agentrust-capture-core | |
| cd claude-code | |
| python -m pytest tests -q | |
| # Full suite including the signing / verification tests, which need the crypto | |
| # packages from requirements.txt. | |
| signing: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13"] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Run full suite (with crypto packages) | |
| working-directory: claude-code | |
| run: | | |
| # The local package goes in with --no-deps: it has no runtime | |
| # dependencies of its own, so nothing here resolves against PyPI. | |
| pip install --require-hashes -r ../requirements/pytest-9.txt | |
| pip install --no-deps ../packages/agentrust-capture-core | |
| # The plugin's own requirements are the subject of this test, so they | |
| # stay resolved from PyPI rather than pinned. | |
| pip install -r requirements.txt | |
| python -m pytest tests -q |