Enforce repository I/O security boundary #77
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: validate | |
| on: | |
| push: | |
| pull_request: | |
| workflow_dispatch: | |
| inputs: | |
| run_aggregate: | |
| description: Run the full dependency-free aggregate in every portability job | |
| required: false | |
| type: boolean | |
| default: false | |
| run_release_gate: | |
| description: Run strict release provenance and artifact validation | |
| required: false | |
| type: boolean | |
| default: false | |
| permissions: | |
| contents: read | |
| env: | |
| PYTHONDONTWRITEBYTECODE: "1" | |
| jobs: | |
| portability: | |
| name: ${{ matrix.os }} / Python ${{ matrix.python-version }} | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - os: ubuntu-24.04 | |
| python-version: "3.12" | |
| - os: ubuntu-24.04 | |
| python-version: "3.13" | |
| - os: ubuntu-24.04 | |
| python-version: "3.14" | |
| - os: macos-15 | |
| python-version: "3.13" | |
| - os: macos-15 | |
| python-version: "3.14" | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Harden ephemeral Linux runner home | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| account_home="$(python -I -S -B -c 'import os, pwd; print(pwd.getpwuid(os.geteuid()).pw_dir)')" | |
| setfacl --remove-all --remove-default -- "$account_home" | |
| chmod go-w -- "$account_home" | |
| - name: Run the short dependency-free gate | |
| run: make check-fast | |
| - name: Run dependency-free unit contracts | |
| run: make check-unit | |
| - name: Run real platform capability checks | |
| run: PLATFORM_POLICY=required make check-platform | |
| - name: Optionally run the dependency-free aggregate | |
| if: ${{ github.event_name == 'workflow_dispatch' && inputs.run_aggregate }} | |
| run: make check | |
| - name: Install CI validation dependencies | |
| run: python -m pip install --requirement requirements-ci.txt | |
| - name: Run Apply JSON Schema parity validation | |
| run: make check-schema | |
| behavior: | |
| name: behavior / Python ${{ matrix.python-version }} | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.12", "3.13"] | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Harden ephemeral Linux runner home | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| account_home="$(python -I -S -B -c 'import os, pwd; print(pwd.getpwuid(os.geteuid()).pw_dir)')" | |
| setfacl --remove-all --remove-default -- "$account_home" | |
| chmod go-w -- "$account_home" | |
| - name: Run Goal and Apply behavior gates | |
| run: make check-behavior | |
| package: | |
| name: package / Ubuntu / Python 3.13 | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.13" | |
| - name: Harden ephemeral Linux runner home | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| account_home="$(python -I -S -B -c 'import os, pwd; print(pwd.getpwuid(os.geteuid()).pw_dir)')" | |
| setfacl --remove-all --remove-default -- "$account_home" | |
| chmod go-w -- "$account_home" | |
| - name: Run package contract and extraction gates | |
| run: make check-package | |
| - name: Run public release privacy validation | |
| run: make check-public-privacy | |
| - name: Validate an extracted Gitless source package | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| tmpdir="$(mktemp -d)" | |
| trap 'rm -rf "$tmpdir"' EXIT | |
| python3 scripts/export_sanitized.py \ | |
| --root . \ | |
| --artifact-type plugin \ | |
| --provenance-mode worktree \ | |
| --output "$tmpdir/codexqb-plugin-worktree.zip" | |
| python3 scripts/export_sanitized.py \ | |
| --root . \ | |
| --artifact-type source \ | |
| --provenance-mode worktree \ | |
| --output "$tmpdir/CodexQB-source-worktree.zip" | |
| python3 scripts/verify_package_manifest.py --zip "$tmpdir/codexqb-plugin-worktree.zip" | |
| python3 scripts/verify_package_manifest.py --zip "$tmpdir/CodexQB-source-worktree.zip" | |
| python3 scripts/extract_verified_package.py \ | |
| --zip "$tmpdir/codexqb-plugin-worktree.zip" \ | |
| --output "$tmpdir/plugin" \ | |
| --artifact-type plugin | |
| python3 scripts/extract_verified_package.py \ | |
| --zip "$tmpdir/CodexQB-source-worktree.zip" \ | |
| --output "$tmpdir/source" \ | |
| --artifact-type source | |
| python3 scripts/verify_package_manifest.py \ | |
| --root "$tmpdir/plugin" \ | |
| --strict-artifact \ | |
| --expected-artifact-type plugin | |
| python3 scripts/verify_package_manifest.py \ | |
| --root "$tmpdir/source/CodexQB" \ | |
| --strict-artifact \ | |
| --expected-artifact-type source | |
| test -f "$tmpdir/plugin/.codex-plugin/plugin.json" | |
| test ! -e "$tmpdir/plugin/tests" | |
| test ! -e "$tmpdir/source/CodexQB/.git" | |
| python3 -I -S -B scripts/run_extracted_validation.py \ | |
| --expected-head "$GITHUB_SHA" \ | |
| --zip "$tmpdir/CodexQB-source-worktree.zip" \ | |
| --root "$tmpdir/source/CodexQB" \ | |
| --profile static \ | |
| --skip-unit-tests \ | |
| --skip-behavior-smoke | |
| required: | |
| name: required / CodexQB | |
| if: ${{ always() }} | |
| needs: [portability, behavior, package] | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Require every public validation lane | |
| env: | |
| PORTABILITY_RESULT: ${{ needs.portability.result }} | |
| BEHAVIOR_RESULT: ${{ needs.behavior.result }} | |
| PACKAGE_RESULT: ${{ needs.package.result }} | |
| run: | | |
| test "$PORTABILITY_RESULT" = success | |
| test "$BEHAVIOR_RESULT" = success | |
| test "$PACKAGE_RESULT" = success | |
| release: | |
| name: strict release gate | |
| if: >- | |
| startsWith(github.ref, 'refs/tags/v') || | |
| (github.event_name == 'workflow_dispatch' && inputs.run_release_gate) | |
| needs: [required] | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.13" | |
| - name: Harden ephemeral Linux runner home | |
| if: runner.os == 'Linux' | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| account_home="$(python -I -S -B -c 'import os, pwd; print(pwd.getpwuid(os.geteuid()).pw_dir)')" | |
| setfacl --remove-all --remove-default -- "$account_home" | |
| chmod go-w -- "$account_home" | |
| - name: Install release validation dependencies | |
| run: python -m pip install --requirement requirements-ci.txt | |
| - name: Run strict release validation | |
| run: make check-release |