Add Heimdall V2 research pipeline #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Heimdall V2 Dry-Run Validation | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| jobs: | |
| heimdall: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt | |
| - name: Run Semgrep when available | |
| continue-on-error: true | |
| run: | | |
| mkdir -p reports | |
| if command -v semgrep >/dev/null 2>&1; then | |
| semgrep scan --config auto --json --output reports/semgrep.json || true | |
| else | |
| echo '{"results":[],"message":"Semgrep not available; using sample dataset demo."}' > reports/semgrep.json | |
| fi | |
| - name: Run Heimdall dry-run validation | |
| run: | | |
| python experiments/run_experiment.py --dataset data/sample_alerts.jsonl --mode all --output reports | |
| - name: Fail on confirmed High or Critical True Positives | |
| run: | | |
| python - <<'PY' | |
| import csv | |
| import sys | |
| from pathlib import Path | |
| results = Path("reports/results.csv") | |
| if not results.exists(): | |
| sys.exit("reports/results.csv was not generated") | |
| blocking = [] | |
| with results.open(newline="", encoding="utf-8") as handle: | |
| for row in csv.DictReader(handle): | |
| if ( | |
| row["mode"] == "heimdall_full_pipeline_stub" | |
| and row["classification"] == "TP" | |
| and row["severity"].lower() in {"high", "critical"} | |
| ): | |
| blocking.append(row["alert_id"]) | |
| if blocking: | |
| sys.exit(f"Confirmed High/Critical True Positives: {', '.join(blocking)}") | |
| PY | |
| - name: Upload Heimdall reports | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: heimdall-reports | |
| path: reports/ |