chore(main): release 0.9.0 #316
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copilot Setup Steps | |
| # Provisions the toolchain and per-surface dependency closures for GitHub | |
| # Copilot cloud coding agent sessions. The single `copilot-setup-steps` job | |
| # is consumed by Copilot before each agent session; this workflow also runs | |
| # on self-changes and weekly to detect toolchain drift. | |
| # | |
| # Reference: | |
| # https://docs.github.com/en/copilot/how-tos/copilot-on-github/customize-copilot/customize-cloud-agent/customize-the-agent-environment | |
| --- | |
| name: Copilot Setup Steps | |
| on: | |
| workflow_dispatch: | |
| push: | |
| paths: | |
| - .github/workflows/copilot-setup-steps.yml | |
| pull_request: | |
| paths: | |
| - .github/workflows/copilot-setup-steps.yml | |
| # Weekly drift check: surfaces broken action SHAs, yanked packages, or | |
| # registry outages on a Monday morning instead of mid-Copilot-session. | |
| schedule: | |
| - cron: '17 9 * * 1' | |
| permissions: | |
| contents: read | |
| jobs: | |
| copilot-setup-steps: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install apt packages (shellcheck, jq, ffmpeg) | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends shellcheck jq ffmpeg | |
| - name: Install actionlint | |
| run: scripts/setup/install-actionlint.sh | |
| - name: Install OSV-Scanner v2.3.8 | |
| env: | |
| OSV_SCANNER_VERSION: 2.3.8 | |
| OSV_SCANNER_SHA256: bc98e15319ed0d515e3f9235287ba53cdc5535d576d24fd573978ecfe9ab92dc | |
| run: | | |
| curl -sSLo /tmp/osv-scanner \ | |
| "https://github.com/google/osv-scanner/releases/download/v${OSV_SCANNER_VERSION}/osv-scanner_linux_amd64" | |
| echo "${OSV_SCANNER_SHA256} /tmp/osv-scanner" | sha256sum -c --quiet - | |
| sudo install -m 0755 /tmp/osv-scanner /usr/local/bin/osv-scanner | |
| rm -f /tmp/osv-scanner | |
| osv-scanner --version | |
| - name: Setup Python 3.12 | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.12' | |
| - name: Setup uv | |
| uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 | |
| - name: Setup Node.js (frontend pin) | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version-file: data-management/viewer/frontend/.nvmrc | |
| cache: npm | |
| cache-dependency-path: | | |
| package-lock.json | |
| data-management/viewer/frontend/package-lock.json | |
| - name: Setup Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: infrastructure/terraform/e2e/go.mod | |
| cache-dependency-path: infrastructure/terraform/e2e/go.mod | |
| - name: Setup Terraform | |
| uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1 | |
| with: | |
| terraform_wrapper: false | |
| - name: Setup TFLint | |
| uses: terraform-linters/setup-tflint@6e1e0642c0289bd619021bf6b34e3c08ed1e005a # v6.3.0 | |
| - name: Install gh-aw CLI extension (v0.81.6) | |
| run: gh extension install github/gh-aw --pin v0.81.6 | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| # Bootstrap the microsoft/hve-core RPI persona for the cloud-agent | |
| # `Physical-AI RPI` umbrella. This step runs outside the cloud-agent | |
| # firewall (per the customize-the-agent-firewall docs) so it can fetch | |
| # raw.githubusercontent.com content that the agent itself cannot reach. | |
| # The umbrella agent reads `_audit.md` at session start and fails fast | |
| # with a PR comment if these files are missing. | |
| # | |
| # UPSTREAM_REF is pinned to a reviewed release SHA to defend against a | |
| # malicious or breaking change landing on `main`. To upgrade, pick a | |
| # SHA from a published release at | |
| # https://github.com/microsoft/hve-core/releases, update the comment | |
| # below to the matching tag, and verify the worker still resolves the | |
| # expected subagents on a feature branch before merging. | |
| - name: Bootstrap hve-core RPI persona | |
| continue-on-error: true | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| UPSTREAM_REPO: microsoft/hve-core | |
| # microsoft/hve-core release: hve-core-v3.2.2 (2026-03-23) | |
| UPSTREAM_REF: e69486a5f809ede45c63c0a31358c12912bd5168 | |
| UPSTREAM_SUBAGENTS_PATH: .github/agents/hve-core/subagents | |
| UPSTREAM_UMBRELLA_PATH: .github/agents/hve-core/rpi-agent.agent.md | |
| DEST_DIR: .copilot-tracking/upstream/hve-core-rpi | |
| run: | | |
| set -euo pipefail | |
| mkdir -p "${DEST_DIR}/subagents" | |
| sha="$(gh api "repos/${UPSTREAM_REPO}/commits/${UPSTREAM_REF}" --jq .sha)" | |
| if [ -z "${sha}" ]; then | |
| echo "Failed to resolve ${UPSTREAM_REPO}@${UPSTREAM_REF} SHA" >&2 | |
| exit 1 | |
| fi | |
| echo "Resolved ${UPSTREAM_REPO}@${UPSTREAM_REF} -> ${sha}" | |
| umbrella_url="https://raw.githubusercontent.com/${UPSTREAM_REPO}/${sha}/${UPSTREAM_UMBRELLA_PATH}" | |
| curl -fsSL "${umbrella_url}" -o "${DEST_DIR}/rpi-agent.agent.md" | |
| mapfile -t subagent_names < <( | |
| gh api "repos/${UPSTREAM_REPO}/contents/${UPSTREAM_SUBAGENTS_PATH}?ref=${sha}" \ | |
| --jq '.[] | select(.type=="file") | select(.name | endswith(".agent.md")) | .name' | |
| ) | |
| if [ "${#subagent_names[@]}" -eq 0 ]; then | |
| echo "No subagents discovered under ${UPSTREAM_REPO}@${sha}:${UPSTREAM_SUBAGENTS_PATH}" >&2 | |
| exit 1 | |
| fi | |
| for name in "${subagent_names[@]}"; do | |
| url="https://raw.githubusercontent.com/${UPSTREAM_REPO}/${sha}/${UPSTREAM_SUBAGENTS_PATH}/${name}" | |
| curl -fsSL "${url}" -o "${DEST_DIR}/subagents/${name}" | |
| done | |
| { | |
| echo "# hve-core RPI bootstrap audit" | |
| echo | |
| echo "- upstream: ${UPSTREAM_REPO}" | |
| echo "- requested-ref: ${UPSTREAM_REF}" | |
| echo "- resolved-sha: ${sha}" | |
| echo "- resolved-at: $(date -u +%Y-%m-%dT%H:%M:%SZ)" | |
| echo "- umbrella: rpi-agent.agent.md" | |
| echo "- subagents:" | |
| for name in "${subagent_names[@]}"; do | |
| echo " - ${name}" | |
| done | |
| } > "${DEST_DIR}/_audit.md" | |
| echo "Bootstrap complete:" | |
| ls -la "${DEST_DIR}" "${DEST_DIR}/subagents" | |
| - name: Install PowerShell modules (Pester 5.7.1, powershell-yaml 0.4.12) | |
| shell: pwsh | |
| run: | | |
| Install-Module -Name Pester -RequiredVersion 5.7.1 -Force -SkipPublisherCheck -Scope CurrentUser | |
| Install-Module -Name powershell-yaml -RequiredVersion 0.4.12 -Force -SkipPublisherCheck -Scope CurrentUser | |
| - name: Install root Node tooling (markdownlint, cspell, table-formatter, link-check) | |
| run: npm ci | |
| - name: Presync root Python dev group | |
| run: uv sync --group dev | |
| - name: Presync dataviewer backend Python (dev + analysis + hdf5 + export + auth) | |
| working-directory: data-management/viewer/backend | |
| run: uv sync --extra dev --extra analysis --extra hdf5 --extra export --extra auth | |
| - name: Presync evaluation Python dev group | |
| working-directory: evaluation | |
| run: uv sync --only-group dev | |
| - name: Presync dataviewer frontend | |
| working-directory: data-management/viewer/frontend | |
| run: npm ci | |
| - name: Presync Go modules (terraform e2e) | |
| working-directory: infrastructure/terraform/e2e | |
| run: go mod download |