ci: pinar GitHub Actions por SHA (supply-chain) #43

	name: ci

	# Lightweight continuous verification: the engine imports and the /measure service
	# passes its tests against the versioned findings.json. The full analysis pipeline
	# does not run here (it depends on the restricted raw dataset), but the drift of the
	# NUMBERS is audited locally by `build_lineage.py --check` in run.sh.

	on:
	push:
	branches: [main]
	pull_request:

	jobs:
	test:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
	- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
	with:
	python-version: "3.13"
	- name: Install pinned dependencies
	run: \|
	python -m pip install --upgrade pip
	pip install -r study/requirements.txt
	pip install -r study/api/requirements.txt
	pip install pytest
	- name: Engine import smoke
	working-directory: study
	run: python -c "import skewlib.exante, skewlib.skewmeter, skewlib.model, skewlib.canonical; print('skewlib OK')"
	- name: Tests (canonical core + adapters + /measure API)
	working-directory: study
	run: python -m pytest tests/ api/test_api.py -q

Navigation Menu