ci.yml

name: CI

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

# Network resilience: crates.io registry downloads intermittently drop with
# "OpenSSL ... unexpected eof while reading" under cargo's HTTP/2 multiplexing.
# Disable multiplexing and raise the retry count so a transient fetch blip
# retries instead of failing the build.
env:
  CARGO_NET_RETRY: "10"
  CARGO_HTTP_MULTIPLEXING: "false"
  CARGO_TERM_COLOR: always
  # #922: compile-time SQLx query checks use lib/storage/.sqlx offline cache.
  SQLX_OFFLINE: "true"

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # ── PR-049: Rust test matrix (stable + beta + MSRV 1.88) ─────────────────────
  # MSRV is 1.88 — the highest rust-version declared across the dependency tree
  # (darling 0.23, time 0.3.47, …) and ≥1.78 required to parse the v4 Cargo.lock.
  gateway:
    name: Gateway (${{ matrix.rust }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        rust: [stable, beta, "1.88"]
    steps:
      - uses: actions/checkout@v7
      # aegis-api's build.rs (lib/api/build.rs) compiles proto/*.proto via
      # prost-build/tonic-build, which needs the protoc binary on PATH.
      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends protobuf-compiler
      - uses: dtolnay/rust-toolchain@master
        with:
          toolchain: ${{ matrix.rust }}
          components: rustfmt, clippy
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: .
          key: ${{ matrix.rust }}
      - name: Install sqlx-cli (#922)
        if: matrix.rust == 'stable'
        run: cargo install sqlx-cli --no-default-features --features sqlite --locked
      - name: Verify SQLx offline query cache (#922)
        if: matrix.rust == 'stable'
        run: |
          mkdir -p db
          export DATABASE_URL="sqlite://${GITHUB_WORKSPACE}/db/aegisagent.db"
          (cd lib/storage && sqlx database create)
          (cd lib/storage && sqlx migrate run)
          (cd lib/storage && cargo sqlx prepare --check -- --all-targets)
      - name: Check formatting
        run: cargo fmt --all -- --check
        if: matrix.rust == 'stable'
      - name: Clippy
        run: cargo clippy --workspace --all-targets -- -D warnings
        if: matrix.rust == 'stable'
      - name: Tests
        run: cargo test --workspace -- --test-threads=1
      # ── TASK-1313: /v1/authorize latency regression gate ─────────────────
      # Runs the criterion benchmark (reduced sample size, see
      # benches/authorize_benchmark.rs) and compares the mean latency of the
      # steady-state allow hot path against the checked-in baseline
      # (benches/baseline.json), failing if it regresses by more than 25%.
      # See docs/performance-baseline.md for methodology and the mean-vs-p99
      # approximation this gate makes.
      - name: Authorize latency benchmark
        if: matrix.rust == 'stable'
        run: cargo bench --workspace
      - name: Check benchmark regression (>25% mean latency)
        if: matrix.rust == 'stable'
        run: |
          python3 src/scripts/check_bench_regression.py \
            --baseline src/benches/baseline.json \
            --estimates target/criterion/authorize_action/allow_readonly_filesystem_read_file/new/estimates.json \
            --threshold 0.25
      # ── TEST-005 (#1165): canonicalization / receipt-hash regression gates ──
      # `cargo bench` above (no --bench filter) already ran canon_benchmark
      # and receipt_hash_benchmark too; these reuse the same regression-check
      # script at the issue's own 20% threshold against their checked-in
      # baselines (benches/baseline_canon.json, benches/baseline_receipt_hash.json).
      - name: Check canonicalization benchmark regression (>20% mean latency)
        if: matrix.rust == 'stable'
        run: |
          python3 src/scripts/check_bench_regression.py \
            --baseline src/benches/baseline_canon.json \
            --estimates target/criterion/canonicalization/canonicalize_json_nested_mixed_types/new/estimates.json \
            --threshold 0.20
      - name: Check receipt-hash benchmark regression (>20% mean latency)
        if: matrix.rust == 'stable'
        run: |
          python3 src/scripts/check_bench_regression.py \
            --baseline src/benches/baseline_receipt_hash.json \
            --estimates target/criterion/receipt_hash/compute_receipt_hash_mid_chain/new/estimates.json \
            --threshold 0.20

  # ── ADR-0006/0007/0008: event primitive safety gates ────────────────────────
  # The ring and published-prefix algorithms compile once with native std
  # atomics/UnsafeCell and once with Loom's modeled equivalents. This job stays
  # separate from the gateway matrix so the hot-path crate cannot accidentally
  # acquire Tokio, SQLx, protobuf, or system-service dependencies. CRC32C is the
  # only default runtime edge; Loom is optional model-checking infrastructure.
  event-concurrency:
    name: Event primitives native + Loom
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: clippy
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: .
          key: event-concurrency
      - name: Native correctness and stress tests
        run: cargo test -p aegis-event
      - name: All-feature correctness and feature-isolation tests
        run: cargo test -p aegis-event --all-features
      - name: Loom ring and published-prefix publication models
        run: cargo test -p aegis-event --features loom loom_
      - name: All-feature Clippy
        run: cargo clippy -p aegis-event --all-targets --all-features -- -D warnings
      - name: Assert default and all-feature runtime allowlists are exact
        run: |
          test "$(cargo tree -p aegis-event --edges normal --depth 1 --prefix none | tail -n +2)" = "crc32c v0.6.8"
          test "$(cargo tree -p aegis-event --edges normal --depth 1 --prefix none --all-features | tail -n +2)" = "$(printf 'crc32c v0.6.8\nloom v0.7.2')"
      - name: Compile diagnostic event benchmarks
        run: cargo bench -p aegis-event --bench spsc_ring --bench published_slab --no-run

  event-miri:
    name: Event primitives Miri
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: miri
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: .
          key: event-miri
      - name: Miri ring, sealed-page, and published-prefix ownership suite
        run: cargo miri test -p aegis-event

  # Rust nightly currently exposes ASan and TSan but no `undefined` sanitizer.
  # Miri is therefore the Rust UB/provenance gate; any future C/C++ ABI must add
  # a real UBSan lane before that boundary can be accepted.
  event-sanitizers:
    name: Event published-prefix ${{ matrix.sanitizer }} sanitizer
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        sanitizer: [address, thread]
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@nightly
        with:
          components: rust-src
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: .
          key: event-${{ matrix.sanitizer }}-sanitizer
      - name: Native raw-pointer and cross-thread stress
        env:
          RUSTFLAGS: -Zsanitizer=${{ matrix.sanitizer }}
          ASAN_OPTIONS: detect_leaks=1:halt_on_error=1
          TSAN_OPTIONS: halt_on_error=1
        run: >-
          cargo test -Zbuild-std
          --target x86_64-unknown-linux-gnu
          -p aegis-event
          --test published_slab

  # ── #1194 (Postgres GA): live Postgres integration smoke test ────────────
  # Closes the biggest concrete gap named in
  # docs/adr/0002-sqlite-first-storage.md for Postgres GA: until this job,
  # `--features postgres` was only ever compile-checked, never run against a
  # real database — exactly how a 528-line compile break in the read-replica
  # failover path went unnoticed for a period (#1297), and how the
  # `health_check` INT4/INT8 decode mismatch fixed alongside this job went
  # undetected. Runs lib/storage/tests/postgres_smoke.rs against a real
  # postgres:16 service container, with AEGIS_DB_READ_REPLICA_URL pointed at
  # the same instance to also exercise the read/write pool-routing plumbing
  # (not true cross-instance replication — see the test file's doc comment;
  # real failover/replication-lag validation remains a separate follow-up).
  postgres-integration:
    name: Postgres integration smoke test (#1194)
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: aegis
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U postgres"
          --health-interval 5s
          --health-timeout 5s
          --health-retries 10
    steps:
      - uses: actions/checkout@v7
      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends protobuf-compiler
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: .
          key: postgres-integration
      - name: Run Postgres smoke tests
        env:
          DATABASE_URL: postgres://postgres:aegis@127.0.0.1:5432/postgres
          AEGIS_DB_READ_REPLICA_URL: postgres://postgres:aegis@127.0.0.1:5432/postgres
        run: cargo test -p aegis-storage --features postgres --test postgres_smoke -- --test-threads=1

  # ── CI-004 (#1173): Rust code coverage gate (blocking, threshold 80%) ────────
  # Raised from 70% to the project's 80% standard (rules/common/testing.md) on
  # 2026-07-09 — actual coverage measured at 87.62% lines, so this only closes
  # a stale-gate gap, no test-writing was needed to clear it.
  # Runs once on stable (not the full beta/MSRV matrix — instrumented builds
  # are slower and the coverage number doesn't vary by toolchain). Posts the
  # per-file table to the run's Job Summary; a true PR-comment bot would need
  # pull-requests: write on a `pull_request`-triggered workflow, which is a
  # write-token surface we don't want on a workflow that also runs against
  # untrusted fork PRs, so the Job Summary (linked directly from the PR's
  # checks tab) is the deliberate substitute.
  rust-coverage:
    name: Gateway coverage gate (>= 80%)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends protobuf-compiler
      - uses: dtolnay/rust-toolchain@stable
        with:
          components: llvm-tools-preview
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: .
          key: coverage
      - name: Install cargo-llvm-cov
        run: cargo install cargo-llvm-cov --locked
      - name: Coverage (fails under 80% lines)
        run: |
          cargo llvm-cov --summary-only --fail-under-lines 80 -- --test-threads=1 | tee coverage-summary.txt
      - name: Publish coverage summary
        if: always()
        run: |
          echo "### Gateway coverage (cargo-llvm-cov)" >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"
          cat coverage-summary.txt >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"

  # ── TEST-002 (#1162): canonicalization fuzz smoke gate ───────────────────────
  # Fuzzes aegis-canon::canonicalize_json / canonical_value_string (the
  # aegis-jcs-1 implementation shared with the gateway via a path dependency)
  # with cargo-fuzz on nightly. PR-blocking smoke run is short (catches build
  # breaks / quick crashes); the full 1-hour-per-target run required by the
  # TEST-002 acceptance criteria runs nightly — see canon-fuzz.yml.
  canon-fuzz:
    name: Canonicalization fuzz smoke (${{ matrix.target }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        target: [canonicalize_json, canonical_value_string]
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@nightly
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: src/fuzz
      - name: Install cargo-fuzz
        run: cargo install cargo-fuzz --locked
      - name: Fuzz ${{ matrix.target }} for 60 seconds
        working-directory: src
        run: cargo +nightly fuzz run ${{ matrix.target }} -- -max_total_time=60

  # ── PR-050: Python test matrix (3.9 → 3.12) ──────────────────────────────────
  python-sdk:
    name: Python SDK (${{ matrix.python }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python: ["3.9", "3.10", "3.11", "3.12"]
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python }}
      - name: Install SDK (with dev tools)
        run: python -m pip install -e "sdk-python[dev]"
      - name: Black format check
        run: python -m black --check sdk-python/ examples/
        if: matrix.python == '3.12'
      - name: Unit tests
        run: python -m unittest discover -s sdk-python/tests
      - name: Integrity demo smoke test (no network)
        run: python examples/integrity_demo.py

  # ── CI-004 (#1173): Python SDK coverage gate (blocking, threshold 78%) ───────
  # Single run on 3.12 (coverage % doesn't vary meaningfully across the
  # matrix). See the rust-coverage job above for why this publishes to the
  # Job Summary rather than posting a PR comment. Raised from 75% on
  # 2026-07-09; actual measured at exactly 80%, so the gate stops short of
  # that (78%) to leave a safety margin rather than sitting flush with the
  # current number.
  python-coverage:
    name: Python SDK coverage gate (>= 78%)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install SDK (with dev tools)
        run: python -m pip install -e "sdk-python[dev]"
      - name: Run tests under coverage
        run: python -m coverage run -m unittest discover -s sdk-python/tests
      - name: Coverage report (fails under 78% lines)
        run: |
          python -m coverage report --include="sdk-python/aegisagent/*" --fail-under=78 | tee coverage-summary.txt
      - name: Publish coverage summary
        if: always()
        run: |
          echo "### Python SDK coverage (coverage.py)" >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"
          cat coverage-summary.txt >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"

  # ── M2: one-command local demo guardrails ───────────────────────────────────
  # Cheap checks for the 10-minute path before the slower Docker E2E jobs run.
  # These catch broken shell entrypoints, stale docs/setup commands, invalid
  # compose config, Makefile target drift, and local preflight regressions.
  demo-guardrails:
    name: Demo guardrails
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
      - name: Shell syntax for local demo scripts
        run: bash -n scripts/doctor.sh scripts/run-killer-demo.sh scripts/seed-demo.sh scripts/seed-demo-dev.sh
      - name: Docs and path guardrails
        run: node scripts/validate-docs.mjs
      - name: Docker Compose config
        run: docker compose config >/dev/null
      - name: Makefile demo targets resolve
        run: |
          make -n doctor
          make -n demo
          make -n setup
      - name: Doctor preflight
        run: make doctor

  # ── Phase 4: Bun SPA (ui-next) unit/build gate ────────────────────────────────
  ui-next:
    name: UI-next (Bun SPA)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.14"
      - name: Install dependencies
        working-directory: ui-next
        run: bun install --frozen-lockfile
      - name: Unit tests
        working-directory: ui-next
        run: bun test
      - name: Production build (base /dashboard/)
        working-directory: ui-next
        run: bun run build
      - name: Verify asset base path
        working-directory: ui-next
        run: |
          grep -q '/dashboard/assets/' dist/index.html
          test -f dist/index.html

  # ── PR-051: TypeScript SDK test gate ──────────────────────────────────────────
  typescript-sdk:
    name: TypeScript SDK
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
          cache: npm
          cache-dependency-path: sdk-typescript/package-lock.json
      - name: Install dependencies
        run: npm ci
        working-directory: sdk-typescript
      - name: Build
        run: npx tsc --noEmit
        working-directory: sdk-typescript
      - name: Tests
        run: npm test
        working-directory: sdk-typescript

  # ── B3: Go SDK canon corpus gate ─────────────────────────────────────────────
  go-sdk:
    name: Go SDK canon byte-parity
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version: "1.25"
      - name: Go canon corpus tests (TestCanonicalActionVectors + TestReceiptChainVectors)
        run: go test ./...
        working-directory: sdk-go

  # ── B3: TypeScript SDK canon corpus gate (Node 24, required) ─────────────────
  ts-canon:
    name: TS SDK canon byte-parity (Node 24)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v6
        with:
          node-version: "24"
      - name: TS canon + receipt corpus tests (node --test, no deps required)
        # Receipt verifier is production code (`src/receipts.ts`); keep it on the
        # required byte-parity job so a broken shared corpus fails CI hard.
        run: node --test test/canon.test.ts test/receipts.test.ts
        working-directory: sdk-typescript

  # ── PR-052: Cross-language byte-equality corpus gate ──────────────────────────
  corpus-check:
    name: Corpus byte-equality gate (Rust + Python + Go + TS)
    runs-on: ubuntu-latest
    needs: [gateway, python-sdk, go-sdk, ts-canon]
    steps:
      - uses: actions/checkout@v7
      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends protobuf-compiler
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: .
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install Python SDK
        run: python -m pip install -e "sdk-python[dev]"
      - name: Rust corpus test (canonical_action_matches_shared_corpus)
        run: cargo test -p gateway canonical_action_matches_shared_corpus -- --exact
      - name: Rust corpus test (receipt_chain_matches_shared_corpus)
        run: cargo test -p gateway receipt_chain_matches_shared_corpus -- --exact
      - name: Python corpus test
        run: python -m pytest sdk-python/tests/test_canonical_action.py sdk-python/tests/test_receipt_vectors.py -v 2>/dev/null || python -m unittest sdk-python/tests/test_canonical_action.py sdk-python/tests/test_receipt_vectors.py -v
      - name: Summary
        run: echo "✅ All cross-language corpus vectors are byte-identical"

  # ── PR-053: Docker Compose end-to-end test ────────────────────────────────────
  docker-e2e:
    name: Docker Compose E2E
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: Install Python SDK
        run: python -m pip install -e "sdk-python"
      - name: Build and start gateway
        run: docker compose up --build -d
      - name: Wait for gateway health
        run: |
          for i in $(seq 1 30); do
            if curl -sf http://127.0.0.1:8080/health; then
              echo "Gateway is healthy"
              break
            fi
            echo "Waiting for gateway... ($i/30)"
            sleep 2
          done
      - name: Seed demo data
        run: bash scripts/seed-demo.sh
      - name: Run GitHub attack demo
        run: |
          OUTPUT=$(python3 examples/github-attack-demo.py 2>&1)
          echo "$OUTPUT"
          if echo "$OUTPUT" | grep -q "blocked"; then
            echo "✅ Attack demo passed: malicious action was blocked"
          else
            echo "❌ Attack demo failed: malicious action was not blocked"
            exit 1
          fi
      - name: Tear down
        if: always()
        run: docker compose down

  # ── Wave A: cage Docker e2e (claim → real sandbox → kill) ────────────────────
  # Self-contained: builds gateway + aegis-cage-runner, starts both with a
  # deterministic command-signing key, exercises alpine sandboxes via the
  # host Docker engine. Skipped only if docker is unavailable (should not
  # happen on ubuntu-latest).
  cage-docker-e2e:
    name: Cage Docker E2E
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends protobuf-compiler
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: .
          key: cage-docker-e2e
      - name: Pull sandbox image
        run: docker pull alpine:3
      - name: Cage Docker e2e (managed stack)
        env:
          AEGIS_CAGE_E2E_MANAGE: "1"
          AEGIS_CAGE_E2E_TIMEOUT_SECS: "180"
          RUST_LOG: info
        run: bash scripts/cage-docker-e2e.sh

  # ── Wave A item 4: untrusted agent → cage → egress deny → control → receipt ──
  # Narrative e2e (#1840): isolation, then an untrusted_external cage run whose
  # egress goes through aegis-egress-proxy in --gateway-url mode (the real
  # POST /v1/egress/check fail-closed path, not the proxy's standalone
  # decider) so a durable deny event + receipt is asserted via
  # GET /v1/egress/events, then a signed kill control command.
  cage-wave-a-e2e:
    name: Cage Wave A E2E (untrusted → egress deny → receipt)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - name: Install protoc
        run: sudo apt-get update && sudo apt-get install -y --no-install-recommends protobuf-compiler
      - uses: dtolnay/rust-toolchain@stable
      - uses: Swatinem/rust-cache@v2
        with:
          workspaces: .
          key: cage-wave-a-e2e
      - name: Pull sandbox image
        run: docker pull alpine:3
      - name: Cage Wave A narrative e2e (managed stack)
        env:
          AEGIS_CAGE_E2E_MANAGE: "1"
          AEGIS_CAGE_E2E_TIMEOUT_SECS: "180"
          RUST_LOG: info
        run: bash scripts/cage-wave-a-e2e.sh

  # ── #1326: Dashboard end-to-end test (Playwright) ─────────────────────────────
  dashboard-e2e:
    name: Dashboard E2E (Playwright)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v6
        with:
          node-version: "20"
      - name: Build and start gateway
        run: docker compose up --build -d
      - name: Wait for gateway health
        run: |
          for i in $(seq 1 30); do
            if curl -sf http://127.0.0.1:8080/health; then
              echo "Gateway is healthy"
              break
            fi
            echo "Waiting for gateway... ($i/30)"
            sleep 2
          done
      - name: Seed demo data
        run: bash scripts/seed-demo.sh
      - name: Install Playwright + browsers
        working-directory: e2e
        run: |
          npm ci
          npx playwright install --with-deps chromium
      - name: Run dashboard E2E suite
        working-directory: e2e
        env:
          AEGIS_DASHBOARD_URL: http://127.0.0.1:8080
        run: npx playwright test
      - name: Upload Playwright report
        if: failure()
        uses: actions/upload-artifact@v7
        with:
          name: playwright-report
          path: e2e/playwright-report/
          retention-days: 7
      - name: Tear down
        if: always()
        run: docker compose down

  # ── Dependency audit (blocking) ───────────────────────────────────────────────
  security-audit:
    name: Dependency audit
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: dtolnay/rust-toolchain@stable
      - name: Install cargo-audit
        run: cargo install cargo-audit --locked
      - name: cargo audit
        # RUSTSEC-2023-0071 (rsa "Marvin Attack" timing side-channel, no fixed
        # upgrade available): transitive via jsonwebtoken's `rust_crypto`
        # feature, which only provides RSA-family JWT algorithms. The gateway
        # only verifies HS256 (HMAC) tokens (see main.rs `AEGIS_JWT_SECRET`
        # handling) and never exercises the RSA path. Acknowledged and ignored
        # until upstream ships a fix.
        run: cargo audit --ignore RUSTSEC-2023-0071
      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"
      - name: pip-audit
        run: |
          python -m pip install -U pip setuptools
          python -m pip install pip-audit
          python -m pip install -e sdk-python
          pip-audit --progress-spinner off

  # ── CI-005 (#1174): dependency license compliance (blocking) ─────────────────
  # Blocks GPL/AGPL (or any other newly-introduced copyleft license) from
  # entering the gateway's dependency tree. gateway/deny.toml is an allow-list
  # of every license already present in the dependency graph — anything not
  # on it (including GPL/AGPL) fails the check. Distinct from the cargo-audit
  # job above, which checks for known vulnerabilities, not licensing.
  license-check:
    name: Dependency license check (cargo-deny)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: EmbarkStudios/cargo-deny-action@v2
        with:
          manifest-path: src/Cargo.toml
          command: check licenses

  # #1297: the chart (helm/aegis-gateway/) had no CI coverage at all -- a
  # broken template or invalid values.yaml could land undetected. `helm lint`
  # catches malformed templates/values; `helm template` additionally proves
  # every template actually renders (lint alone doesn't fully exercise
  # conditional blocks the default values don't reach), including once with
  # the HPA/autoscaling values overridden since those templates are inert
  # (but still present) with the chart's own defaults.
  helm-lint:
    name: Helm chart lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: azure/setup-helm@v4
      - name: helm lint
        run: |
          helm lint helm/aegis-gateway/
          helm lint helm/aegis-node-sensor/
          helm lint helm/aegis-egress-proxy/
          helm lint helm/aegis-cage-runner/ \
            --set config.gatewayUrl=http://gateway:8080 \
            --set config.tenantId=tenant_example \
            --set config.gatewayPublicKeyHex=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \
            --set secret.create=true \
            --set secret.apiToken=example-token
      - name: helm template (default values)
        run: helm template test-release helm/aegis-gateway/ > /dev/null
      # Multi-replica / HPA requires PostgreSQL (validate-backend.yaml fail-closed).
      # Exercise the HPA templates with a production-shaped database URL.
      - name: helm template (autoscaling + postgres)
        run: |
          helm template test-release helm/aegis-gateway/ \
            --set autoscaling.enabled=true \
            --set replicaCount=3 \
            --set config.databaseUrl='postgres://aegis:secret@postgres:5432/aegis' \
            > /dev/null
      - name: helm template (cage-runner)
        run: |
          helm template test-release helm/aegis-cage-runner/ \
            --set config.gatewayUrl=http://gateway:8080 \
            --set config.tenantId=tenant_example \
            --set config.gatewayPublicKeyHex=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef \
            --set secret.create=true \
            --set secret.apiToken=example-token \
            > /dev/null