Seal prepared request capabilities for v0.4.4 #133

Workflow file for this run

	name: quality

	on:
	push:
	pull_request:

	permissions:
	contents: read

	jobs:
	test:
	strategy:
	fail-fast: false
	matrix:
	os: [ubuntu-latest, windows-latest, macos-latest]
	python-version: ["3.10", "3.13"]
	runs-on: ${{ matrix.os }}
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
	with:
	python-version: ${{ matrix.python-version }}
	cache: pip
	- name: Install
	run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
	- name: Lint
	run: python -m ruff check mrma tests
	- name: Test
	run: python -m pytest
	- name: Compile
	run: python -m compileall -q mrma
	- name: CLI smoke
	run: mrma --version

	evidence-quality:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
	with:
	python-version: "3.13"
	cache: pip
	- run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
	- name: Strict type check v0.4 modules
	run: >-
	python -m mypy --strict
	mrma/benchmark.py
	mrma/engine
	mrma/evidence
	mrma/policy
	mrma/transport
	mrma/workflows
	- name: Type check corrected core
	run: >-
	python -m mypy
	mrma/core/compare.py
	mrma/core/experiment.py
	mrma/core/http_client.py
	mrma/core/http_semantics.py
	mrma/core/privacy.py
	mrma/core/raw_request.py
	mrma/core/sender.py
	- name: Whole-repository branch coverage
	run: >-
	python -m pytest
	--cov=mrma
	--cov-branch
	--cov-report=term-missing
	--cov-report=json:coverage.json
	- name: Enforce corrected-core and v0.4 runtime coverage
	run: python tools/check_critical_coverage.py coverage.json --minimum 90 --core-minimum 85

	semantic-mutation:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
	with:
	python-version: "3.13"
	cache: pip
	- run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
	- name: Kill committed critical-policy mutation baseline
	run: python tools/run_mutation_gate.py --json-output mutation-result.json

	benchmark:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
	with:
	python-version: "3.13"
	cache: pip
	- run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
	- name: Validate packaged release baseline
	run: python -m pytest tests/test_benchmark.py::test_packaged_release_benchmark_is_schema_valid_and_passed
	- name: Run loopback benchmark
	run: python -c "from mrma.cli import main; main()" benchmark --out-json benchmark-result.json

	runtime-audit:
	strategy:
	fail-fast: false
	matrix:
	python-version: ["3.10", "3.13"]
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
	with:
	python-version: ${{ matrix.python-version }}
	cache: pip
	- name: Audit published runtime dependency floor
	run: \|
	python -m pip install --upgrade pip pip-audit
	python -m pip_audit --requirement requirements-audit.txt

	distribution:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	- uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
	with:
	python-version: "3.13"
	cache: pip
	- run: python -m pip install --upgrade pip twine
	- name: Install hash-locked build toolchain
	run: >-
	python -m pip install --only-binary=:all:
	--require-hashes -r requirements-build.txt
	- name: Build wheel and source distribution
	run: python -m build --no-isolation
	- name: Validate distribution metadata
	run: python -m twine check dist/*
	- name: Validate hash-locked container dependencies
	run: >-
	python -m pip install --dry-run --only-binary=:all:
	--require-hashes -r requirements-container.txt
	- name: Install built wheel in a clean environment
	run: \|
	python -m venv /tmp/mrma-wheel
	/tmp/mrma-wheel/bin/python -m pip install --upgrade pip
	/tmp/mrma-wheel/bin/python -m pip install dist/*.whl
	/tmp/mrma-wheel/bin/python -m pip check
	cd /tmp
	/tmp/mrma-wheel/bin/mrma --version
	/tmp/mrma-wheel/bin/python -c "from importlib.resources import files; root=files('mrma.schemas'); assert all(root.joinpath(f'experiment-v{v}.schema.json').is_file() for v in (2,3,4,5,6,7,8)); assert all(root.joinpath(f'authorization-v{v}.schema.json').is_file() for v in (1,2)); assert all(root.joinpath(f'benchmark-v{v}.schema.json').is_file() for v in (1,2)); assert files('mrma').joinpath('benchmarks', 'release-baseline.json').is_file(); assert 'site-packages' in str(root)"
	cd /tmp
	/tmp/mrma-wheel/bin/python -c "import json; from importlib.resources import files; from mrma.evidence import validate_benchmark_document; validate_benchmark_document(json.loads(files('mrma').joinpath('benchmarks', 'release-baseline.json').read_text()))"

	container:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	- name: Build pinned container
	run: docker build --tag mrma:ci .
	- name: Smoke test non-root image
	run: \|
	test "$(docker image inspect mrma:ci --format '{{.Config.User}}')" = "mrma"
	docker run --rm mrma:ci --version

Navigation Menu

Seal prepared request capabilities for v0.4.4 #133

Workflow file

Seal prepared request capabilities for v0.4.4 #133

Uh oh!

Workflow file for this run