ci(e2e): restore e2e-reliability-t1 PR gate (worker + pin + workflow) #558
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| jobs: | |
| validate: | |
| name: validate configs | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Install validation tools | |
| run: pip install yamllint | |
| - name: Lint YAML configs | |
| run: | | |
| find configs/ -name '*.yml' -o -name '*.yaml' -o -name '*.json' | sort | |
| find configs/ -name '*.yml' -o -name '*.yaml' | xargs --no-run-if-empty yamllint -c .yamllint.yml | |
| - name: Check e2e compose image pins (no floating tags) | |
| run: bash scripts/check_e2e_image_pins.sh | |
| - name: Install markdownlint-cli | |
| run: npm install -g markdownlint-cli | |
| - name: Lint documentation markdown | |
| run: markdownlint AGENTS.md docs/architecture.md docs/adr/*.md | |
| - name: Install pixi | |
| uses: prefix-dev/setup-pixi@a09b6247153796b190642a2b53fac4241043cf6f # v0.10.0 | |
| with: | |
| run-install: false | |
| - name: Validate pixi.toml | |
| run: pixi info --manifest-path pixi.toml | |
| - name: Install just | |
| run: curl -fsSL https://just.systems/install.sh | bash -s -- --to /usr/local/bin | |
| - name: Validate justfile (parse round-trip) | |
| run: just --summary | |
| - name: Validate merge-queue readiness and ruleset mutation safety | |
| run: just test-merge-queue-readiness | |
| - name: Symlink integrity audit | |
| run: | | |
| broken=0 | |
| while IFS= read -r -d '' link; do | |
| if [ ! -e "$link" ]; then | |
| echo "BROKEN: $link -> $(readlink "$link")" | |
| broken=1 | |
| fi | |
| done < <(find . -type l -print0) | |
| [ "$broken" -eq 0 ] || exit 1 | |
| - name: Validate NATS auth (issue #176) | |
| run: | | |
| bash tools/validate-nats-auth.sh | |
| bash tools/tests/test-validate-nats-auth.sh | |
| - name: Install nats-server | |
| run: | | |
| curl -fsSL https://github.com/nats-io/nats-server/releases/download/v2.10.22/nats-server-v2.10.22-linux-amd64.tar.gz \ | |
| | tar xz --wildcards --strip-components=1 -C /usr/local/bin '*/nats-server' | |
| - name: NATS configs parse with required credentials set | |
| run: | | |
| # Create self-signed dummy certs so nats-server -t can validate TLS config structure. | |
| sudo mkdir -p /etc/nats/certs | |
| openssl req -x509 -newkey rsa:2048 -keyout /tmp/key.pem -out /tmp/cert.pem \ | |
| -days 1 -nodes -subj "/CN=test" 2>/dev/null | |
| sudo cp /tmp/cert.pem /etc/nats/certs/server-cert.pem | |
| sudo cp /tmp/key.pem /etc/nats/certs/server-key.pem | |
| sudo cp /tmp/cert.pem /etc/nats/certs/ca.pem | |
| # nats-server -t runs as the non-root CI user; `sudo cp` leaves the | |
| # files root-owned 0600, so the key was unreadable (permission denied | |
| # parsing the X509 pair). Make the dummy validation certs world-readable | |
| # (key 0644 is fine — these are throwaway self-signed CI certs). | |
| sudo chmod 644 /etc/nats/certs/server-cert.pem /etc/nats/certs/server-key.pem /etc/nats/certs/ca.pem | |
| NATS_CLIENT_TOKEN=x NATS_LEAF_USER=u NATS_LEAF_PASSWORD=p NATS_CLUSTER_USER=u NATS_CLUSTER_PASSWORD=p nats-server -c configs/nats/server.conf -t | |
| - name: Grafana credential-gate self-test (#179) | |
| run: python3 scripts/check_grafana_credentials.py --self-test | |
| - name: Grafana credential hygiene (#179) | |
| run: python3 scripts/check_grafana_credentials.py | |
| verify-scripts: | |
| name: verify-scripts — Claude read permissions (if present) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Run verify_claude_read_permissions.py (skip if absent) | |
| run: | | |
| if [ -f scripts/verify_claude_read_permissions.py ]; then | |
| python3 scripts/verify_claude_read_permissions.py | |
| else | |
| echo "scripts/verify_claude_read_permissions.py not present — skipping" | |
| fi |