Skip to content
CI

feat(context-fabric): require immutable contract release pins #3982

Sign in to view logs

feat(context-fabric): require immutable contract release pins

feat(context-fabric): require immutable contract release pins #3982

Workflow file for this run

.github/workflows/ci.yml at 4325564
name: CI
on:
push:
branches: [main]
pull_request:
workflow_dispatch:
permissions:
contents: read
concurrency:
group: ${{ github.workflow }}-${{ github.repository }}-${{ github.event.pull_request.number || github.run_id }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}
jobs:
unit-tests:
name: Unit tests (Python ${{ matrix.python-version }})
runs-on: ubuntu-latest
timeout-minutes: 20
strategy:
fail-fast: false
matrix:
python-version: ["3.10", "3.12", "3.14"]
steps:
- name: Harden runner
uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
with:
egress-policy: audit
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
persist-credentials: false
- name: Verify exact source head
run: test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
- name: Set up Python
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: ${{ matrix.python-version }}
- name: Set up uv
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
prune-cache: true
- name: Install locked dependencies
run: uv sync --locked
- name: Run unit tests
run: uv run pytest -q -m "not integration"
quality-gates:
name: Coverage, docstrings, lint, and package
runs-on: ubuntu-latest
timeout-minutes: 20
steps:
- name: Harden runner
uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
with:
egress-policy: audit
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
persist-credentials: false
- name: Verify exact source head
run: test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
- name: Set up Python
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.14"
- name: Set up uv
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
prune-cache: true
- name: Install locked dependencies
run: uv sync --locked
- name: Compile source
run: uv run python -m compileall -q pg_llm_batch
- name: Lint
run: uv run ruff check pg_llm_batch tests
- name: Enforce docstring coverage
run: uvx --from 'interrogate==1.7.0' interrogate --fail-under 100 pg_llm_batch
- name: Enforce line coverage
run: >-
uv run --with pytest-cov==7.1.0 pytest -q -m "not integration"
--cov=pg_llm_batch --cov-report=term-missing --cov-fail-under=100
- name: Verify lockfile freshness
run: uv lock --check
- name: Build distribution artifacts without workspace sources
run: uv build --no-sources
container-builds:
name: Container builds and PostgreSQL runtime smokes
runs-on: ubuntu-latest
timeout-minutes: 30
steps:
- name: Harden runner
uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
with:
egress-policy: audit
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
persist-credentials: false
- name: Verify exact source head
run: test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
- name: Validate Compose configuration
run: docker compose config >/dev/null
- name: Build component image
run: docker build --tag pg-llm-batch:ci .
- name: Build PostgreSQL image
run: docker build --tag pg-llm-batch-postgres:ci docker/postgres
- name: Verify PostgreSQL container log routing
run: bash tests/smoke_postgres_container_logging.sh
- name: Run legacy SQL cleanup integration smoke
run: bash tests/smoke_legacy_sql_cleanup.sh
- name: Run lifecycle-outbox replay-arbiter smoke
run: bash tests/smoke_context_lifecycle_outbox_replay_arbiter.sh
- name: Run lifecycle-outbox exact-column smoke
run: bash tests/smoke_context_lifecycle_outbox_exact_columns.sh
- name: Run lifecycle-outbox UUID default-authority smoke
run: bash tests/smoke_context_lifecycle_outbox_uuid_default_authority.sh
- name: Run lifecycle-outbox row-admission authority smoke
run: bash tests/smoke_context_lifecycle_outbox_row_admission_authority.sh
- name: Run lifecycle-outbox final default-authority smoke
run: bash tests/smoke_context_lifecycle_outbox_final_default_authority.sh
- name: Run lifecycle-outbox final column-authority smoke
run: bash tests/smoke_context_lifecycle_outbox_final_column_authority.sh
- name: Run lifecycle-outbox final relation-authority smoke
run: bash tests/smoke_context_lifecycle_outbox_final_relation_authority.sh
- name: Run lifecycle-outbox CHECK-expression authority smoke
run: bash tests/smoke_context_lifecycle_outbox_check_expression_authority.sh
- name: Run lifecycle-outbox final RLS authority smoke
run: bash tests/smoke_context_lifecycle_outbox_final_rls_authority.sh
- name: Run lifecycle-outbox effective-role RLS authority smoke
run: bash tests/smoke_context_lifecycle_outbox_effective_role_authority.sh
- name: Run lifecycle-outbox authenticated-session role-authority smoke
run: bash tests/smoke_context_lifecycle_outbox_session_user_authority.sh
- name: Run lifecycle-outbox DML grant-option authority smoke
run: bash tests/smoke_context_lifecycle_outbox_grant_option_authority.sh
- name: Run lifecycle-outbox MAINTAIN authority smoke
run: bash tests/smoke_context_lifecycle_outbox_maintain_authority.sh
- name: Run lifecycle-outbox role-admin DML-delegation smoke
run: bash tests/smoke_context_lifecycle_outbox_role_admin_delegation_authority.sh
- name: Run lifecycle-outbox role-admin destructive-delegation smoke
run: bash tests/smoke_context_lifecycle_outbox_role_admin_destructive_authority.sh
- name: Run lifecycle-outbox live RLS policy-authority smoke
run: bash tests/smoke_context_lifecycle_outbox_runtime_rls_policy_authority.sh
- name: Run lifecycle-outbox SECURITY DEFINER replication-authority smoke
run: bash tests/smoke_context_lifecycle_outbox_security_definer_replication_authority.sh
- name: Run lifecycle-outbox SECURITY DEFINER admin-delegation smoke
run: bash tests/smoke_context_lifecycle_outbox_security_definer_admin_authority.sh
- name: Run lifecycle-outbox nested SECURITY DEFINER authority smoke
run: bash tests/smoke_context_lifecycle_outbox_security_definer_chain_authority.sh
- name: Run lifecycle-outbox SECURITY DEFINER search-path authority smoke
run: bash tests/smoke_context_lifecycle_outbox_security_definer_search_path_authority.sh
- name: Run lifecycle-outbox SECURITY DEFINER foreign-data authority smoke
run: bash tests/smoke_context_lifecycle_outbox_security_definer_foreign_authority.sh
- name: Run lifecycle-outbox SECURITY DEFINER delegated foreign-data authority smoke
run: bash tests/smoke_context_lifecycle_outbox_security_definer_admin_foreign_authority.sh
- name: Run lifecycle-outbox materialized-view authority smoke
run: bash tests/smoke_context_lifecycle_outbox_materialized_view_authority.sh
- name: Run lifecycle-outbox foreign-table authority smoke
run: bash tests/smoke_context_lifecycle_outbox_foreign_table_authority.sh
- name: Run lifecycle-outbox partitioned foreign authority smoke
run: bash tests/smoke_context_lifecycle_outbox_partitioned_foreign_authority.sh