feat(passport): track post-reveal updating (#48) (#51) #109
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: checks | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # release.yml calls this workflow on a tag and consumes the immutable | |
| # artifact uploaded by the release-artifacts job below. | |
| workflow_call: | |
| outputs: | |
| release_artifact_id: | |
| description: Immutable Actions artifact containing the verified release files | |
| value: ${{ jobs.release_artifacts.outputs.artifact_id }} | |
| concurrency: | |
| group: checks-${{ github.ref }}-${{ github.event_name }} | |
| cancel-in-progress: true | |
| jobs: | |
| python-compat: | |
| name: Python ${{ matrix.python-version }} | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| # 3.9 mirrors the oldest system python contributors run the lints | |
| # under via bare `python3`; 3.12 is the current baseline. | |
| python-version: ["3.9", "3.12"] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| - name: Install Python check dependencies | |
| run: pip install --quiet pyyaml pytest | |
| - name: Manifest parse lint | |
| run: python3 scripts/check_manifests.py | |
| - name: Invariant lint | |
| run: python3 scripts/check_invariants.py | |
| - name: Pack schema lint | |
| run: python3 scripts/check_pack_schema.py | |
| - name: Verbatim block sync | |
| run: python3 scripts/check_verbatim_blocks.py | |
| - name: Version consistency | |
| run: python3 scripts/check_version_consistency.py | |
| - name: Web clean-clone and content-source guard | |
| run: python3 scripts/check_web_content.py | |
| - name: Public daily-case schema and answer-leak guard | |
| run: python3 scripts/check_daily_cases.py | |
| - name: Mutation + unit tests | |
| run: python3 -m pytest scripts/ -q | |
| node: | |
| name: Node and content | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: web/package-lock.json | |
| - name: Install web dependencies | |
| run: npm --prefix web ci --ignore-scripts | |
| - name: Syntax-check every tracked JavaScript module | |
| run: npm --prefix web run check | |
| - name: Web locale parity and synchronized Daily fixtures | |
| run: | | |
| npm --prefix web run check:i18n | |
| npm --prefix web run daily:sync-public -- --check | |
| - name: Daily API unit tests | |
| run: npm --prefix web run test:daily | |
| browser-smoke: | |
| name: Playwright smoke | |
| # Pull requests and main pushes exercise the browser once. A tag-triggered | |
| # reusable call skips it because the same commit already passed on main. | |
| if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| cache-dependency-path: web/tests/requirements-e2e.txt | |
| - name: Install Playwright and Chromium | |
| run: | | |
| pip install --quiet -r web/tests/requirements-e2e.txt | |
| python -m playwright install --with-deps chromium | |
| - name: Run focused browser smoke | |
| run: | | |
| server_log="${RUNNER_TEMP}/casebook-http.log" | |
| python -m http.server 4173 --bind 127.0.0.1 --directory web >"${server_log}" 2>&1 & | |
| server_pid=$! | |
| trap 'kill "${server_pid}"' EXIT | |
| for _ in {1..50}; do | |
| if curl --fail --silent --output /dev/null http://127.0.0.1:4173/; then | |
| break | |
| fi | |
| if ! kill -0 "${server_pid}" 2>/dev/null; then | |
| cat "${server_log}" | |
| exit 1 | |
| fi | |
| sleep 0.2 | |
| done | |
| curl --fail --silent --output /dev/null http://127.0.0.1:4173/ | |
| CASEBOOK_BASE_URL=http://127.0.0.1:4173/ python web/tests/e2e_smoke.py | |
| release_artifacts: | |
| name: Build verified release artifacts | |
| needs: [python-compat, node] | |
| runs-on: ubuntu-latest | |
| outputs: | |
| artifact_id: ${{ steps.upload.outputs.artifact-id }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Install artifact-check dependencies | |
| run: pip install --quiet pyyaml | |
| - name: Build artifacts once | |
| run: | | |
| bash scripts/build_claude_ai_zip.sh | |
| bash scripts/build_portable.sh | |
| - name: Verify artifacts and record checksums | |
| run: | | |
| unzip -tqq dist/critical-thinking-for-humans-claude-ai.zip | |
| python3 scripts/check_manifests.py | |
| cd dist | |
| sha256sum \ | |
| critical-thinking-for-humans-claude-ai.zip \ | |
| critical-thinking-for-humans-portable.md > SHA256SUMS | |
| sha256sum --check SHA256SUMS | |
| - name: Upload immutable verified artifacts | |
| id: upload | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: release-artifacts-${{ github.sha }} | |
| path: | | |
| dist/critical-thinking-for-humans-claude-ai.zip | |
| dist/critical-thinking-for-humans-portable.md | |
| dist/SHA256SUMS | |
| if-no-files-found: error | |
| retention-days: 14 |