fix+feat(memory): roadmap phases 1-4 — tails, smartness, proof, operability #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: piguard-e2e | |
| # End-to-end test of the PIGuard prompt-injection sidecar against the real | |
| # guard client (internal/guard). Builds the daemon + gateway images, starts | |
| # them with the gateway published on 127.0.0.1:18080 and the daemon socket | |
| # bind-mounted at /tmp/piguard-e2e, then runs the env-gated E2E test in | |
| # internal/guard/piguard_e2e_test.go. | |
| # | |
| # The ONNX model (~735 MB) is cached across runs, keyed on the pinned model | |
| # revision in docker/piguard/export_onnx.py (MODEL_REVISION). Bump the cache | |
| # key when the revision changes. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| env: | |
| PIGUARD_MODEL_REVISION: dd78b24e330193a22d2293ac66922dd4f982f563 # keep in sync with docker/piguard/export_onnx.py | |
| jobs: | |
| guard-e2e: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-go@v5 | |
| with: | |
| go-version: "1.25" | |
| - name: Cache PIGuard ONNX model | |
| id: model-cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: docker/piguard/models | |
| key: piguard-model-${{ env.PIGUARD_MODEL_REVISION }} | |
| restore-keys: piguard-model- | |
| - name: Download PIGuard model | |
| if: steps.model-cache.outputs.cache-hit != 'true' | |
| run: docker/piguard/download-model.sh | |
| - name: Build PIGuard images | |
| working-directory: docker | |
| run: docker compose --profile restricted build piguard piguard-gateway | |
| - name: Start PIGuard stack | |
| run: | | |
| set -euo pipefail | |
| mkdir -p /tmp/piguard-e2e | |
| docker network create piguard-e2e | |
| docker run -d --name piguard-e2e-daemon --network piguard-e2e \ | |
| -v "$PWD/docker/piguard/models:/models:ro" \ | |
| -v /tmp/piguard-e2e:/run/piguard \ | |
| piguard:local \ | |
| --socket=/run/piguard/piguard.sock --model-dir=/models \ | |
| --max-batch=32 --batch-wait=5ms | |
| docker run -d --name piguard-e2e-gateway --network piguard-e2e \ | |
| -p 127.0.0.1:18080:8080 \ | |
| -v /tmp/piguard-e2e:/run/piguard \ | |
| piguard-gateway:local \ | |
| --addr=:8080 --socket=/run/piguard/piguard.sock | |
| - name: Wait for gateway health | |
| run: | | |
| set -euo pipefail | |
| for i in $(seq 1 90); do | |
| if curl -fsS http://127.0.0.1:18080/healthz >/dev/null 2>&1; then | |
| echo "gateway healthy after ${i} attempts" | |
| exit 0 | |
| fi | |
| sleep 2 | |
| done | |
| echo "=== daemon logs ===" | |
| docker logs piguard-e2e-daemon || true | |
| echo "=== gateway logs ===" | |
| docker logs piguard-e2e-gateway || true | |
| echo "gateway never became healthy" >&2 | |
| exit 1 | |
| - name: Run guard E2E tests | |
| env: | |
| ODEK_E2E_GUARD: "1" | |
| PIGUARD_URL: http://127.0.0.1:18080/detect | |
| PIGUARD_SOCKET: /tmp/piguard-e2e/piguard.sock | |
| run: go test ./internal/guard -run E2E -count=1 -v | |
| - name: Tear down PIGuard stack | |
| if: always() | |
| run: | | |
| docker rm -f piguard-e2e-gateway piguard-e2e-daemon || true | |
| docker network rm piguard-e2e || true |