feat(intercept): Phase B — never-worse gate on the enriched Read packet #133
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| build-and-test: | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, windows-latest] | |
| node-version: [20, 22] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Use Node.js ${{ matrix.node-version }} | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: ${{ matrix.node-version }} | |
| cache: npm | |
| # ripgrep is required by the grep "never-worse" gate (ADR-0007): the | |
| # handler shells out to `rg` to size the agent's raw grep before deciding | |
| # to intercept. Without it the gate can't measure and passes through, so | |
| # the deny-path integration tests (bash/grep) see null instead of a packet. | |
| # Runners don't ship rg by default, so install it per-OS. These steps are | |
| # best-effort (continue-on-error): rg availability is an ENVIRONMENT detail, | |
| # not a code property, so an install hiccup (e.g. a flaky choco mirror) must | |
| # never red CI — the tests carry `it.skipIf(!HAS_RG)` and skip cleanly when | |
| # rg is absent. apt is reliable, so the gate is exercised for real on Linux. | |
| - name: Install ripgrep (Linux) | |
| if: runner.os == 'Linux' | |
| run: sudo apt-get update && sudo apt-get install -y ripgrep | |
| continue-on-error: true | |
| - name: Install ripgrep (Windows) | |
| if: runner.os == 'Windows' | |
| run: choco install ripgrep -y --no-progress | |
| continue-on-error: true | |
| - name: Report ripgrep availability (tests skip cleanly if absent) | |
| run: rg --version | |
| continue-on-error: true | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Typecheck | |
| run: npm run lint | |
| - name: Build | |
| run: npm run build | |
| - name: Test | |
| run: npx vitest run |