foundry.yml

# SPDX-License-Identifier: MPL-2.0
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
#
# Foundry gate — exercise the cartridge-maker's Provision stage + the harness
# CapBounded check (capability partition, escalation + tampered-partition
# failure paths). Pure bash + jq, so it's cheap and needs no idris/deno/zig.
# The Foundry DESIGN proof (proof/Foundry.idr) is type-checked by proofs.yml.
name: Foundry Gate

# Was workflow-level path-filtered: a required check that never ran on PRs
# touching none of its paths, leaving the check "Expected" and the PR blocked.
# Now always runs; the `changes` job gates the heavy job, which when skipped
# reports SUCCESS to required checks.
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: foundry-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  changes:
    name: Detect relevant changes
    runs-on: ubuntu-latest
    timeout-minutes: 5
    outputs:
      run: ${{ steps.detect.outputs.run }}
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0
      - id: detect
        env:
          EVENT: ${{ github.event_name }}
          BASE: ${{ github.base_ref }}
          BEFORE: ${{ github.event.before }}
        run: |
          set -uo pipefail
          run=true
          if [ "$EVENT" = pull_request ]; then
            git fetch --no-tags --depth=200 origin "$BASE" 2>/dev/null \
              && changed=$(git diff --name-only "origin/${BASE}...HEAD" 2>/dev/null) \
              && { printf '%s\n' "$changed" | grep -qE '^tools/foundry/|^tools/cartridge-minter/' && run=true || run=false; }
          elif [ "$EVENT" = push ] && [ -n "$BEFORE" ] && [ "$BEFORE" != 0000000000000000000000000000000000000000 ]; then
            changed=$(git diff --name-only "${BEFORE}...${GITHUB_SHA}" 2>/dev/null) \
              && { printf '%s\n' "$changed" | grep -qE '^tools/foundry/|^tools/cartridge-minter/' && run=true || run=false; }
          fi
          printf 'run=%s\n' "$run" >> "$GITHUB_OUTPUT"
          echo "relevant=$run; changed files:"; printf '%s\n' "${changed:-<none computed>}"

  provision-harness:
    name: Provision + harness (CapBounded) tests
    needs: changes
    if: needs.changes.outputs.run == 'true'
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
      - name: jq version
        run: jq --version
      - name: Run Foundry provision/harness tests
        run: bash tools/foundry/test/test-foundry.sh