conicshield/.github/workflows/reference-authority.yml at main · fraware/conicshield · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
name: reference-authority

# Public gate: index, snapshot, flagship invariants, and reference evidence tests.
on:
  pull_request:
  push:
    branches: [main]
  schedule:
    - cron: "0 6 1 * *"
  workflow_dispatch:

concurrency:
  group: reference-authority-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install project (dev)
        run: |
          python -m pip install --upgrade pip
          python -m pip install -r requirements-dev.txt
          python -m pip install -e ".[dev]"
      - name: Reference refresh cadence (max 35 days)
        run: python scripts/check_reference_refresh_cadence.py --max-days 35
      - name: Full flagship refresh cadence (live-export-full)
        run: python scripts/check_flagship_full_refresh_cadence.py --max-days 35
      - name: Flagship refresh trigger paths
        run: python scripts/check_flagship_refresh_triggers.py --base-ref ${{ github.event.pull_request.base.sha || github.event.before || 'origin/main' }}
      - name: Reference system status artifact
        run: |
          python scripts/generate_reference_system_status.py
          python scripts/generate_reference_system_status.py --check
      - name: verify-reference-system
        run: make verify-reference-system
      - name: Community dataset smoke (API, CLI, flagship example)
        run: make community-verify
      - name: v1 lock quick (auditor entrypoint)
        run: make verify-v1-lock-quick
      - name: Published bundle file profile (all tiers)
        run: python scripts/validate_published_bundle_profile.py
      - name: Committed batch acceptance report (viability — required)
        run: |
          python scripts/check_batch_acceptance.py \
            --tier viability \
            --report benchmarks/reports/batch_solve_report.latest.json
      - name: Batch throughput advisory (non-blocking)
        run: |
          python scripts/check_batch_acceptance.py \
            --tier throughput_advisory \
            --report benchmarks/reports/batch_solve_report.latest.json