fix(deps): bump rustls-webpki 0.103.12 -> 0.103.13 (GHSA-82j2-j2ch-gfr8) #428
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| # 007 CI — runs on every push and PR | |
| # This is the safety net: tests + clippy + Harvard invariant checks | |
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 | |
| with: | |
| toolchain: nightly | |
| components: clippy, rustfmt | |
| - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 | |
| - name: Check | |
| run: cargo check --all-targets | |
| - name: Test | |
| run: cargo test | |
| - name: Clippy | |
| run: cargo clippy -- -D warnings | |
| - name: Format check | |
| run: cargo fmt -- --check | |
| grammar-guard: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| - name: Grammar change detection | |
| run: | | |
| if git diff --name-only HEAD~1 2>/dev/null | grep -qE '(grammar\.ebnf|grammar\.pest)'; then | |
| echo "::warning::SECURITY: Grammar files changed in this commit. Manual review required." | |
| echo "Grammar changes affect Harvard Architecture safety guarantees." | |
| echo "Changed files:" | |
| git diff --name-only HEAD~1 | grep -E '(grammar\.ebnf|grammar\.pest)' | |
| fi | |
| - name: Harvard invariant check | |
| run: | | |
| # Harvard invariant: a data-expression rule must not reference any | |
| # control construct. We check the *definitions* of data_ rules | |
| # (lines that start a `data_<name> = ...` production) for references | |
| # to control_stmt / control_expr / control_block. A union rule such | |
| # as `agent_member = { data_block | control_block | state_decl }` | |
| # legitimately mentions both and is NOT a violation, so we anchor on | |
| # the data_ rule head rather than flagging any line co-mentioning the | |
| # two (which produced a false positive on agent_member). | |
| if grep -nE '^[[:space:]]*data_[A-Za-z0-9_]+[[:space:]]*=' crates/oo7-core/src/grammar.pest \ | |
| | grep -E 'control_stmt|control_expr|control_block'; then | |
| echo "::error::HARVARD VIOLATION: a data_ rule references control constructs" | |
| exit 1 | |
| fi | |
| echo "Harvard invariant: OK" | |
| - name: Sentinel hash stability | |
| run: | | |
| # Track grammar hash for sentinel verification | |
| sha256sum spec/grammar.ebnf > /tmp/grammar_hash.txt | |
| sha256sum crates/oo7-core/src/grammar.pest >> /tmp/grammar_hash.txt | |
| echo "Grammar hashes:" | |
| cat /tmp/grammar_hash.txt |