jev-judge-mcp/.github/workflows/ci.yml at main · PyModel/jev-judge-mcp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
name: ci

on:
  push:
  pull_request:

permissions:
  contents: read

# Fast gates (ruff, pyright, unit, property) run in parallel; every remaining stage is
# gated on all four and then also runs concurrently (no serial chain).
jobs:
  ruff:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          version: "0.12.19"
      # ubuntu-latest carries no actionlint; `make lint`'s workflow check would skip there.
      # The pin is the CI image's — scripts/ci/install_actionlint.sh and the Dockerfile are one
      # pin in two places, held equal by tests/unit/test_ci_prepush_coverage.py.
      - run: bash scripts/ci/install_actionlint.sh
      - run: uv sync --locked --all-extras
      - run: make lint

  pyright:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          version: "0.12.19"
      - run: uv sync --locked --all-extras
      - run: make typecheck

  unit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          version: "0.12.19"
      - run: uv sync --locked --all-extras
      - run: make unit

  property:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          version: "0.12.19"
      - run: uv sync --locked --all-extras
      - run: make property
      - run: make policy-coverage

  # The remaining stages wait for the fast gates, then run in parallel.
  contract:
    needs: [ruff, pyright, unit, property]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          version: "0.12.19"
      - run: uv sync --locked --all-extras
      - run: make contract

  parity:
    needs: [ruff, pyright, unit, property]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          version: "0.12.19"
      # Pinned to the parity oracle's Node (Makefile NODE, tests/parity/harness/reference.sh);
      # a floating 24.x can drift ICU rendering.
      - uses: actions/setup-node@v4
        with:
          node-version: "24.19.0"
      - run: uv sync --locked --all-extras
      - run: make parity

  security:
    needs: [ruff, pyright, unit, property]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          version: "0.12.19"
      - run: uv sync --locked --all-extras
      - run: make security

  # ADR-0058: the ReDoS storm contract on a one-CPU budget. Spare runner cores hide a pool that
  # starves benign calls under quota (worker startup inside a deadline loses the CPU race to the
  # storm's own starts and spins), so the whole security stage reruns as a non-root runner in a
  # `--cpus 1` container — the exact command is proven locally in the same image.
  security-one-cpu:
    needs: [ruff, pyright, unit, property]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: security stage under a one-CPU quota, non-root
        run: |
          # ghcr.io/astral-sh/uv:0.12.19-python3.12-trixie-slim, pinned by digest (multi-arch index).
          docker run --rm --cpus 1 --entrypoint sh -v "$PWD":/src:ro \
            ghcr.io/astral-sh/uv@sha256:10b94fe3550b7a96e3982860bb82cdefba6300264a7a40bb9334acf21a450974 -c '
            set -eux
            apt-get update -qq && apt-get install -y -qq make git procps >/dev/null
            useradd -m runner
            cp -r /src /home/runner/app && chown -R runner:runner /home/runner/app
            su runner -c "cd ~/app && uv sync --locked --all-extras && make security"
          '

  build:
    needs: [ruff, pyright, unit, property]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          version: "0.12.19"
      - run: make build
      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  smoke:
    needs: [ruff, pyright, unit, property]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          version: "0.12.19"
      - run: uv sync --locked --all-extras
      - run: make smoke
      # ADR-0053 guard: an installer-written entry must start when the first Python on PATH is
      # older than 3.12. setup-python prepends 3.10, so plain uvx resolution fails; the guard
      # proves the written `--python` request still gets the entry running (managed download).
      - uses: actions/setup-python@v5
        with:
          python-version: "3.10"
      - run: python scripts/ci_old_python_entry.py

  # Offline eval scorer and calibration tests; never run live.
  eval:
    needs: [ruff, pyright, unit, property]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: astral-sh/setup-uv@v6
        with:
          version: "0.12.19"
      - run: uv sync --locked --all-extras
      - run: make eval
      # Cheap guard for the load stub: concurrency 1 and 4, no timing budget. The full timing run is
      # `make load` and stays out of CI. Folded in here so it does not spend a runner on a sub-second test.
      - run: make load_canary