Lineage decision policy: which evidence licenses which conclusion (#266 slice 2, step 1) #212
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # OwnAudit is pure-Python tooling (the .NET/WPF audit of STS runs on a Windows | |
| # stand, not here), so CI runs the build-free test suites + a smoke of the SARIF | |
| # export and dashboard build. No analyzers, no .NET — fast and deterministic. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| name: test suites (bare python3) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.12" | |
| - name: fix-arm + report suites | |
| run: | | |
| set -euo pipefail | |
| PYTHONPATH=fix python3 fix/tests/test_ai_fix.py | |
| PYTHONPATH=fix python3 fix/tests/test_own_fix.py | |
| PYTHONPATH=fix python3 fix/tests/test_orchestrate.py | |
| PYTHONPATH=. python3 identity/tests/test_pattern.py | |
| PYTHONPATH=. python3 identity/tests/test_occurrence.py | |
| PYTHONPATH=. python3 identity/tests/test_lineage_contract.py | |
| PYTHONUTF8=1 PYTHONPATH=. python3 identity/tests/test_lineage_decision.py | |
| PYTHONPATH=. python3 aggregate/tests/test_normalize.py | |
| PYTHONPATH=. python3 report/tests/test_sarif.py | |
| PYTHONPATH=. python3 report/tests/test_baseline.py | |
| PYTHONPATH=. python3 report/tests/test_rules_map.py | |
| PYTHONPATH=. python3 report/tests/test_annotate.py | |
| PYTHONPATH=. python3 report/tests/test_exec.py | |
| PYTHONPATH=. python3 viz/tests/test_dashboard_rules.py | |
| PYTHONPATH=. python3 arch/tests/test_arch.py | |
| PYTHONPATH=. python3 oracle/fixtures/test_oracle_arch.py | |
| PYTHONPATH=. python3 oracle/fixtures/test_oracle_runtime.py | |
| PYTHONPATH=. python3 runtime/tests/test_runtime.py | |
| PYTHONPATH=. python3 runtime/tests/test_member_aware.py | |
| PYTHONPATH=. python3 leakmine/tests/test_leakmine.py | |
| - name: re-run under -O (assert-stripping safety) | |
| run: | | |
| set -euo pipefail | |
| PYTHONPATH=fix python3 -O fix/tests/test_ai_fix.py | |
| PYTHONPATH=fix python3 -O fix/tests/test_own_fix.py | |
| PYTHONPATH=fix python3 -O fix/tests/test_orchestrate.py | |
| PYTHONPATH=. python3 -O identity/tests/test_pattern.py | |
| PYTHONPATH=. python3 -O identity/tests/test_occurrence.py | |
| PYTHONPATH=. python3 -O identity/tests/test_lineage_contract.py | |
| PYTHONUTF8=1 PYTHONPATH=. python3 -O identity/tests/test_lineage_decision.py | |
| PYTHONPATH=. python3 -O aggregate/tests/test_normalize.py | |
| PYTHONPATH=. python3 -O report/tests/test_sarif.py | |
| PYTHONPATH=. python3 -O report/tests/test_baseline.py | |
| PYTHONPATH=. python3 -O report/tests/test_rules_map.py | |
| PYTHONPATH=. python3 -O report/tests/test_annotate.py | |
| PYTHONPATH=. python3 -O report/tests/test_exec.py | |
| PYTHONPATH=. python3 -O viz/tests/test_dashboard_rules.py | |
| PYTHONPATH=. python3 -O arch/tests/test_arch.py | |
| PYTHONPATH=. python3 -O oracle/fixtures/test_oracle_arch.py | |
| PYTHONPATH=. python3 -O oracle/fixtures/test_oracle_runtime.py | |
| PYTHONPATH=. python3 -O runtime/tests/test_runtime.py | |
| PYTHONPATH=. python3 -O runtime/tests/test_member_aware.py | |
| PYTHONPATH=. python3 -O leakmine/tests/test_leakmine.py | |
| linetol-policy: | |
| # OwnAudit#59. Run-Audit.ps1 itself cannot run in CI — it wants a worktree, a | |
| # build and a Windows stand — so the clustering-tolerance decision lives in a | |
| # pure function (scripts/LineTolPolicy.ps1) that can. The issue is explicit | |
| # that this must not be accepted by reading the code, hence a real interpreter | |
| # on a real Windows runner. | |
| # | |
| # Both shells on Windows: the script's own examples invoke `pwsh`, but a stand | |
| # that still has only Windows PowerShell 5.1 must not silently get different | |
| # tolerances. Ubuntu covers the pwsh-on-Linux path a contributor is likely to | |
| # use locally. | |
| name: line-tol policy matrix (${{ matrix.os }} / pwsh) | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [windows-latest, ubuntu-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| - name: Resolve-LineTol decision matrix | |
| shell: pwsh | |
| run: ./scripts/tests/Test-LineTolPolicy.ps1 | |
| linetol-policy-ps51: | |
| # Split out rather than folded into the matrix above: `shell:` accepts no | |
| # expression, so `${{ matrix.shell }}` is rejected by the workflow schema. | |
| # Launching the interpreter by hand from bash would sidestep that, but GitHub | |
| # sets $ErrorActionPreference and the invocation form per shell, and a fidelity | |
| # test should run under the shell it claims to cover, not near it. | |
| name: line-tol policy matrix (windows-latest / Windows PowerShell 5.1) | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| - name: Resolve-LineTol decision matrix | |
| shell: powershell | |
| run: ./scripts/tests/Test-LineTolPolicy.ps1 | |
| runner-shell-contract: | |
| # OwnAudit#64. The runners are pwsh-only; the contract is that Windows | |
| # PowerShell 5.1 can still READ them and refuse them for a true reason, | |
| # instead of dying on a syntax error inside a word in a comment. Windows only: | |
| # the defect is Windows 5.1 decoding a BOM-less file in the system ANSI | |
| # codepage, and no Linux runner reproduces it. | |
| name: runner shell contract (windows-latest / pwsh) | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| - name: ASCII, #Requires, and parse under pwsh | |
| shell: pwsh | |
| run: ./scripts/tests/Test-RunnerShellContract.ps1 | |
| runner-shell-contract-ps51: | |
| # The leg that actually covers the defect. Split out for the same reason as | |
| # linetol-policy-ps51: `shell:` accepts no expression, so a matrix cannot | |
| # carry it. Here the suite invokes each runner for real and asserts the | |
| # refusal names the version and leaves no -Out directory behind. | |
| name: runner shell contract (windows-latest / Windows PowerShell 5.1) | |
| runs-on: windows-latest | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| - name: 5.1 reads the runners and refuses them by version | |
| shell: powershell | |
| run: ./scripts/tests/Test-RunnerShellContract.ps1 | |
| audit-report: | |
| name: SARIF export + dashboard smoke | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5 | |
| with: | |
| python-version: "3.12" | |
| # GitHub-friendly SARIF (warning+), plus metrics.json / report.md. | |
| # Runs against the committed synthetic fixture, not the stand-only sts_audit | |
| # corpus, so CI stays green (and leaks nothing) once sts_audit is removed. | |
| - name: Export audit artifacts | |
| run: PYTHONPATH=. python3 -m report.cli --min-level warning --findings viz/fixtures/findings.json | |
| # Catches Python/JS-template regressions in the dashboards (no unit tests there). | |
| # Points at viz/fixtures (synthetic golden set) for the same reason as above. | |
| # The arch dashboard renders empty-state here (graph.json/runtime.json are stand-only). | |
| - name: Build dashboards (smoke) | |
| run: | | |
| set -euo pipefail | |
| # raw path: renders straight from findings.json | |
| python3 viz/build_dashboard.py viz/fixtures | |
| # FP-judge triaged path: merge the overlay (also exercises apply_verdicts' | |
| # staleness guard + merge), then re-render — build_dashboard auto-prefers the | |
| # freshly written findings-triaged.json and renders the triage view. | |
| python3 viz/apply_verdicts.py --findings viz/fixtures/findings.json \ | |
| --overlay viz/fixtures/fp-verdicts.json --out viz/fixtures/findings-triaged.json | |
| python3 viz/build_dashboard.py viz/fixtures | |
| python3 viz/build_arch_dashboard.py | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: ownnet-audit | |
| path: report/out/ | |
| if-no-files-found: error | |
| # To surface findings in the Security tab when running against the STS repo | |
| # itself, drop the cap (export the full set) and upload to code scanning: | |
| # permissions: { security-events: write } | |
| # - run: PYTHONPATH=. python3 -m report.cli --max-results 0 | |
| # - uses: github/codeql-action/upload-sarif@v3 | |
| # with: { sarif_file: report/out/ownnet-audit.sarif } | |
| # (Skipped here: findings.json paths point at the external STS tree, not OwnAudit.) |