chore(deps): bump github/codeql-action/upload-sarif from 4.35.4 to 4.36.2 #211
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: read-all | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| env: | |
| SANNA_ALLOW_TEMP_DB: "1" | |
| strategy: | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12"] | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| submodules: recursive | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Verify operational schema copies match submodule (governance gate) | |
| run: | | |
| diff -q spec/schemas/receipt.schema.json src/sanna/spec/receipt.schema.json | |
| diff -q spec/schemas/constitution.schema.json src/sanna/spec/constitution.schema.json | |
| - name: Install dependencies | |
| run: pip install -e ".[dev]" pytest-asyncio | |
| - name: Run tests | |
| run: python -m pytest tests/ -v | |
| - name: Verify golden receipts | |
| run: | | |
| for f in golden/receipts/*.json; do | |
| # Tampered fixtures use one of two name conventions: | |
| # 999_tampered* (legacy cv=9 baseline; pre-SAN-533) | |
| # v{cv}_tampered* (per-cv coverage; SAN-533 onward) | |
| # Both must FAIL sanna-verify (verifier detects output_hash mismatch). | |
| if [[ "$(basename "$f")" == *tampered* ]]; then | |
| sanna-verify "$f" --format json && echo "ERROR: tampered receipt should fail" && exit 1 || echo "tampered detected" | |
| else | |
| sanna-verify "$f" --format json | python -c "import sys,json; r=json.load(sys.stdin); assert r['valid'], f'FAILED: {r}'" | |
| fi | |
| done | |
| echo "All golden receipts verified." | |
| - name: Verify example constitution | |
| run: sanna-sign-constitution examples/customer_support_constitution.yaml --verify-only | |
| - name: Validate state doc (SAN-326) | |
| run: python3 tools/generate_state_doc.py --check | |
| - name: Install pre-commit | |
| run: pip install pre-commit==4.0.1 | |
| - name: Run pre-commit (block PEM private keys, etc.) | |
| # SAN-404: detect-private-key blocks any future PEM private key from | |
| # entering the repo. Local hook + CI step (belt + suspenders). | |
| run: pre-commit run --all-files --show-diff-on-failure --color=always |