mrma/.github/workflows/ci.yml at aa99665dd820745127a335c5cd65bead24e4c686 · 0xmrma/mrma · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
name: quality

on:
  push:
  pull_request:

permissions:
  contents: read

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        python-version: ["3.10", "3.13"]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Install
        run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
      - name: Lint
        run: python -m ruff check mrma tests
      - name: Test
        run: python -m pytest
      - name: Compile
        run: python -m compileall -q mrma
      - name: CLI smoke
        run: mrma --version

  evidence-quality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.13"
          cache: pip
      - run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
      - name: Strict type check v0.4 modules
        run: >-
          python -m mypy --strict
          mrma/benchmark.py
          mrma/engine
          mrma/evidence
          mrma/policy
          mrma/transport
          mrma/workflows
      - name: Type check corrected core
        run: >-
          python -m mypy
          mrma/core/compare.py
          mrma/core/experiment.py
          mrma/core/http_client.py
          mrma/core/http_semantics.py
          mrma/core/privacy.py
          mrma/core/raw_request.py
          mrma/core/sender.py
      - name: Whole-repository branch coverage
        run: >-
          python -m pytest
          --cov=mrma
          --cov-branch
          --cov-report=term-missing
          --cov-report=json:coverage.json
      - name: Enforce corrected-core and v0.4 runtime coverage
        run: python tools/check_critical_coverage.py coverage.json --minimum 90 --core-minimum 85

  semantic-mutation:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.13"
          cache: pip
      - run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
      - name: Kill committed critical-policy mutation baseline
        run: python tools/run_mutation_gate.py --json-output mutation-result.json

  benchmark:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.13"
          cache: pip
      - run: python -m pip install --upgrade pip && python -m pip install -e ".[dev]"
      - name: Validate packaged release baseline
        run: python -m pytest tests/test_benchmark.py::test_packaged_release_benchmark_is_schema_valid_and_passed
      - name: Run loopback benchmark
        run: python -c "from mrma.cli import main; main()" benchmark --out-json benchmark-result.json

  runtime-audit:
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.13"]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: ${{ matrix.python-version }}
          cache: pip
      - name: Audit published runtime dependency floor
        run: |
          python -m pip install --upgrade pip pip-audit
          python -m pip_audit --requirement requirements-audit.txt

  distribution:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
        with:
          python-version: "3.13"
          cache: pip
      - run: python -m pip install --upgrade pip twine
      - name: Install hash-locked build toolchain
        run: >-
          python -m pip install --only-binary=:all:
          --require-hashes -r requirements-build.txt
      - name: Build wheel and source distribution
        run: python -m build --no-isolation
      - name: Validate distribution metadata
        run: python -m twine check dist/*
      - name: Validate hash-locked container dependencies
        run: >-
          python -m pip install --dry-run --only-binary=:all:
          --require-hashes -r requirements-container.txt
      - name: Install built wheel in a clean environment
        run: |
          python -m venv /tmp/mrma-wheel
          /tmp/mrma-wheel/bin/python -m pip install --upgrade pip
          /tmp/mrma-wheel/bin/python -m pip install dist/*.whl
          /tmp/mrma-wheel/bin/python -m pip check
          cd /tmp
          /tmp/mrma-wheel/bin/mrma --version
          /tmp/mrma-wheel/bin/python -c "from importlib.resources import files; root=files('mrma.schemas'); assert all(root.joinpath(f'experiment-v{v}.schema.json').is_file() for v in (2,3,4,5,6,7,8,9)); assert all(root.joinpath(f'authorization-v{v}.schema.json').is_file() for v in (1,2)); assert all(root.joinpath(f'benchmark-v{v}.schema.json').is_file() for v in (1,2)); assert files('mrma').joinpath('benchmarks', 'release-baseline.json').is_file(); assert 'site-packages' in str(root)"
          cd /tmp
          /tmp/mrma-wheel/bin/python -c "import json; from importlib.resources import files; from mrma.evidence import validate_benchmark_document; validate_benchmark_document(json.loads(files('mrma').joinpath('benchmarks', 'release-baseline.json').read_text()))"

  container:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Build pinned container
        run: docker build --tag mrma:ci .
      - name: Smoke test non-root image
        run: |
          test "$(docker image inspect mrma:ci --format '{{.Config.User}}')" = "mrma"
          docker run --rm mrma:ci --version