ci.yml

# SPDX-License-Identifier: MPL-2.0
# 007 CI — runs on every push and PR
# This is the safety net: tests + clippy + Harvard invariant checks

name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
permissions:
  contents: read
jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7
        with:
          toolchain: nightly
          components: clippy, rustfmt
      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5
      - name: Check
        run: cargo check --all-targets
      - name: Test
        run: cargo test
      - name: Clippy
        run: cargo clippy -- -D warnings
      - name: Format check
        run: cargo fmt -- --check
  grammar-guard:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Grammar change detection
        run: |
          if git diff --name-only HEAD~1 2>/dev/null | grep -qE '(grammar\.ebnf|grammar\.pest)'; then
            echo "::warning::SECURITY: Grammar files changed in this commit. Manual review required."
            echo "Grammar changes affect Harvard Architecture safety guarantees."
            echo "Changed files:"
            git diff --name-only HEAD~1 | grep -E '(grammar\.ebnf|grammar\.pest)'
          fi
      - name: Harvard invariant check
        run: |
          # Harvard invariant: a data-expression rule must not reference any
          # control construct. We check the *definitions* of data_ rules
          # (lines that start a `data_<name> = ...` production) for references
          # to control_stmt / control_expr / control_block. A union rule such
          # as `agent_member = { data_block | control_block | state_decl }`
          # legitimately mentions both and is NOT a violation, so we anchor on
          # the data_ rule head rather than flagging any line co-mentioning the
          # two (which produced a false positive on agent_member).
          if grep -nE '^[[:space:]]*data_[A-Za-z0-9_]+[[:space:]]*=' crates/oo7-core/src/grammar.pest \
             | grep -E 'control_stmt|control_expr|control_block'; then
            echo "::error::HARVARD VIOLATION: a data_ rule references control constructs"
            exit 1
          fi
          echo "Harvard invariant: OK"
      - name: Sentinel hash stability
        run: |
          # Track grammar hash for sentinel verification
          sha256sum spec/grammar.ebnf > /tmp/grammar_hash.txt
          sha256sum crates/oo7-core/src/grammar.pest >> /tmp/grammar_hash.txt
          echo "Grammar hashes:"
          cat /tmp/grammar_hash.txt