chore: governance snapshot from registry@78a426f #131
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Governance | ||
| on: | ||
| workflow_dispatch: | ||
| pull_request: | ||
| push: | ||
| branches: [main] | ||
| # Default: least-privilege. Jobs that push (propose-spec, sync-contracts) use | ||
| # an explicit app token — GITHUB_TOKEN only needs read access to checkout. | ||
| permissions: | ||
| contents: read | ||
| jobs: | ||
| # ─── STEP 1: PULL SPEC ──────────────────────────────────── | ||
| pull-spec: | ||
| uses: Starisian-Technologies/sparxstar-product-specification-registry/.github/workflows/fetch-specs.yml@v1.0.0 | ||
|
Check failure on line 18 in .github/workflows/governance.yml
|
||
| with: | ||
| specs: "sirus" | ||
| agent-ref: main | ||
| contract-ref: "v1.0.0" | ||
| secrets: | ||
| COMPOSER_RESOLVER_PRIVATE_KEY: ${{ secrets.COMPOSER_RESOLVER_PRIVATE_KEY }} | ||
| # ─── STEP 2: CI ─────────────────────────────────────────── | ||
| # Core CI runs after spec pull. Lint and static analysis run | ||
| # independently via standards.yml — not chained here to avoid | ||
| # masking PHPStan behind a PHPCS short-circuit. | ||
| smoke: | ||
| needs: [pull-spec] | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Setup PHP | ||
| uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f | ||
| with: | ||
| php-version: '8.3' | ||
| tools: composer:2.9.8 | ||
| - name: Run API contract smoke test | ||
| run: composer run smoke:api-contract | ||
| test: | ||
| needs: [pull-spec] | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| - name: Setup PHP | ||
| uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f | ||
| with: | ||
| php-version: '8.3' | ||
| tools: composer:2.9.8 | ||
| - name: Mint Composer resolver token | ||
| id: composer-token | ||
| uses: actions/create-github-app-token@v1 | ||
| with: | ||
| client-id: ${{ vars.COMPOSER_RESOLVER_CLIENT_ID }} | ||
| private-key: ${{ secrets.COMPOSER_RESOLVER_PRIVATE_KEY }} | ||
| owner: Starisian-Technologies | ||
| repositories: sparxstar-ouroboros-integrity | ||
| - name: Wire git to use Composer resolver token for Ouroboros | ||
| env: | ||
| TOKEN: ${{ steps.composer-token.outputs.token }} | ||
| run: git config --global url."https://x-access-token:${TOKEN}@github.com/".insteadOf "https://github.com/" | ||
| - name: Cache Composer packages | ||
| uses: actions/cache@v4 | ||
| with: | ||
| path: vendor | ||
| key: composer-v2-${{ hashFiles('**/composer.lock') }} | ||
| restore-keys: composer-v2- | ||
| - name: Install PHP dependencies | ||
| env: | ||
| COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ steps.composer-token.outputs.token }}"}}' | ||
| run: composer install --no-interaction | ||
| - name: Run unit tests | ||
| run: composer run test:unit | ||
| # ─── STEP 3A: PROPOSE SPEC UPDATE ───────────────────────── | ||
| propose-spec: | ||
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 2 | ||
| path: source | ||
| - name: Check if spec changed | ||
| id: check | ||
| run: | | ||
| cd source | ||
| if ! git diff HEAD~1 --name-only -- docs/sirus-tech-spec.md > /tmp/spec-changes.txt 2>&1; then | ||
| echo "changed=false" >> "$GITHUB_OUTPUT" | ||
| exit 0 | ||
| fi | ||
| if [ -s /tmp/spec-changes.txt ]; then | ||
| echo "changed=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "changed=false" >> "$GITHUB_OUTPUT" | ||
| fi | ||
| - name: Generate token | ||
| if: steps.check.outputs.changed == 'true' | ||
| uses: actions/create-github-app-token@v1 | ||
| id: token | ||
| with: | ||
| app-id: ${{ vars.CONTRACT_SYNC_CLIENT_ID }} | ||
| private-key: ${{ secrets.CONTRACT_SYNC_PRIVATE_KEY }} | ||
| owner: Starisian-Technologies | ||
| - name: Propose to registry | ||
| if: steps.check.outputs.changed == 'true' | ||
| env: | ||
| GH_TOKEN: ${{ steps.token.outputs.token }} | ||
| SPEC_KEY: "sirus" | ||
| # Canonical registry path from MANIFEST.json INCLUDES the domain | ||
| # directory. A flat specs/<key>/ target creates an orphan file | ||
| # instead of updating the canonical spec. | ||
| SPEC_DOMAIN: "dve-core" | ||
| run: | | ||
| REGISTRY="Starisian-Technologies/sparxstar-product-specification-registry" | ||
| BRANCH="propose/${SPEC_KEY}-$(date +%Y%m%d-%H%M%S)" | ||
| TARGET="specs/${SPEC_DOMAIN}/${SPEC_KEY}/${SPEC_KEY}-tech-spec.md" | ||
| git clone --depth 1 \ | ||
| "https://x-access-token:${GH_TOKEN}@github.com/${REGISTRY}.git" \ | ||
| registry | ||
| cd registry | ||
| if [ ! -f "$TARGET" ]; then | ||
| echo "::error::Canonical spec path $TARGET not found in registry. Check MANIFEST.json." | ||
| exit 1 | ||
| fi | ||
| git checkout -b "$BRANCH" | ||
| cp "../source/docs/${SPEC_KEY}-tech-spec.md" "$TARGET" | ||
| git config user.name "sparxstar-contract-sync[bot]" | ||
| git config user.email "contract-sync@starisian.com" | ||
| git add -A | ||
| if git diff --cached --quiet; then | ||
| echo "No spec changes to propose." | ||
| exit 0 | ||
| fi | ||
| git commit -m "propose: ${SPEC_KEY} spec from ${GITHUB_REPOSITORY}@${GITHUB_SHA:0:7}" | ||
| git push origin "$BRANCH" | ||
| gh pr create \ | ||
| --repo "$REGISTRY" \ | ||
| --base main \ | ||
| --head "$BRANCH" \ | ||
| --title "propose: ${SPEC_KEY} spec update" \ | ||
| --body "Proposed by ${GITHUB_REPOSITORY}. Review before merging." | ||
| # ─── STEP 3B: SYNC CONTRACTS ────────────────────────────── | ||
| sync-contracts: | ||
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 2 | ||
| path: source | ||
| - name: Check if contracts changed | ||
| id: check | ||
| run: | | ||
| cd source | ||
| if ! git diff HEAD~1 --name-only -- docs/contracts/ > /tmp/contract-changes.txt 2>&1; then | ||
| echo "changed=false" >> "$GITHUB_OUTPUT" | ||
| exit 0 | ||
| fi | ||
| if [ -s /tmp/contract-changes.txt ]; then | ||
| echo "changed=true" >> "$GITHUB_OUTPUT" | ||
| else | ||
| echo "changed=false" >> "$GITHUB_OUTPUT" | ||
| fi | ||
| - name: Generate token | ||
| if: steps.check.outputs.changed == 'true' | ||
| uses: actions/create-github-app-token@v1 | ||
| id: token | ||
| with: | ||
| app-id: ${{ vars.CONTRACT_SYNC_CLIENT_ID }} | ||
| private-key: ${{ secrets.CONTRACT_SYNC_PRIVATE_KEY }} | ||
| owner: Starisian-Technologies | ||
| - name: Checkout contracts registry | ||
| if: steps.check.outputs.changed == 'true' | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: Starisian-Technologies/sparxstar-contracts-registry | ||
| token: ${{ steps.token.outputs.token }} | ||
| path: target | ||
| - name: Sync | ||
| if: steps.check.outputs.changed == 'true' | ||
| env: | ||
| SPEC_KEY: "sirus" | ||
| run: | | ||
| rm -rf "target/Contracts/${SPEC_KEY}" | ||
| mkdir -p "target/Contracts/${SPEC_KEY}" | ||
| cp -r source/docs/contracts/* "target/Contracts/${SPEC_KEY}/" | ||
| - name: Push | ||
| if: steps.check.outputs.changed == 'true' | ||
| working-directory: target | ||
| run: | | ||
| git config user.name "sparxstar-contract-sync[bot]" | ||
| git config user.email "contract-sync@starisian.com" | ||
| git add -A | ||
| if git diff --cached --quiet; then | ||
| echo "Nothing changed." | ||
| exit 0 | ||
| fi | ||
| git commit -m "sync: contracts from ${GITHUB_REPOSITORY}@${GITHUB_SHA:0:7}" | ||
| git push origin main | ||
