Skip to content

Commit 958fc1f

Browse files
hyperpolymathhyperpolymath
committed
fix(security/compliance): standardized TruffleHog and RSR metadata
2 parents 173960b + a87fcb1 commit 958fc1f

48 files changed

Lines changed: 568 additions & 840 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/e2e.yml‎

Lines changed: 131 additions & 117 deletions
Original file line numberDiff line numberDiff line change
@@ -1,132 +1,146 @@
11
# SPDX-License-Identifier: MPL-2.0
22
# Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
33
#
4-
# RSR Standard E2E + Aspect + Benchmark Workflow Template
5-
#
6-
# Covers ALL merge requirement test categories:
7-
# - E2E (end-to-end pipeline tests)
8-
# - Aspect (cross-cutting concern validation)
9-
# - Benchmarks (performance regression detection)
10-
# - Readiness (Component Readiness Grade: D/C/B)
11-
#
12-
# INSTRUCTIONS: Uncomment and customise the section matching your stack.
13-
# Delete sections that don't apply. See examples in each job.
4+
# E2E gate for SNIFS: builds the wasm guest in BOTH ReleaseSafe and ReleaseFast
5+
# modes (per Justfile build-wasm), then runs the Elixir demo suite against the
6+
# fresh artifacts. The property under test is the SNIFS guarantee itself —
7+
# illegal behaviour in the ReleaseSafe artifact must surface as {:error, _},
8+
# and the ReleaseFast artifact must demonstrably produce the silent-corruption
9+
# anti-property. If this gate is red, the SNIFS isolation claim is void on the
10+
# affected build.
1411

1512
name: E2E + Aspect + Bench
1613
on:
1714
push:
1815
branches: [main, master, develop]
1916
paths:
20-
- 'src/**'
21-
- 'ffi/**'
22-
- 'tests/**'
17+
- 'zig/**'
18+
- 'demo/**'
19+
- 'priv/**'
20+
- 'Justfile'
2321
- '.github/workflows/e2e.yml'
2422
pull_request:
2523
branches: [main, master]
2624
paths:
27-
- 'src/**'
28-
- 'ffi/**'
29-
- 'tests/**'
25+
- 'zig/**'
26+
- 'demo/**'
27+
- 'priv/**'
28+
- 'Justfile'
29+
- '.github/workflows/e2e.yml'
3030
workflow_dispatch:
3131
permissions: read-all
3232
concurrency:
3333
group: e2e-${{ github.ref }}
3434
cancel-in-progress: true
3535
jobs:
36-
# ─── End-to-End Tests ──────────────────────────────────────────────
37-
# Uncomment ONE of the following e2e job blocks matching your stack.
36+
# ─── Build-mode invariant gate ─────────────────────────────────────
37+
# Builds the wasm guest fresh from source (defeating any stale committed
38+
# artifacts) and runs the demo suite against it. The ReleaseSafe artifact
39+
# asserts traps → {:error, _}; the ReleaseFast artifact asserts the canary
40+
# value 0x0BADF00D leaks back as {:ok, [195_948_557]} (proving safety checks
41+
# are absent on that artifact — by design for the demo, and the proof that
42+
# the test discriminates between modes rather than passing trivially).
43+
e2e:
44+
name: E2E — Build-mode invariant
45+
runs-on: ubuntu-latest
46+
timeout-minutes: 15
47+
steps:
48+
- name: Checkout
49+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
3850

39-
## === RUST E2E ===
40-
# e2e:
41-
# name: E2E — Full Pipeline
42-
# runs-on: ubuntu-latest
43-
# timeout-minutes: 15
44-
# steps:
45-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
46-
# - uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
47-
# - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
48-
# - run: cargo build --release
49-
# - run: bash tests/e2e.sh
50-
# # OR: cargo test --test end_to_end -- --nocapture
51+
- name: Install Zig 0.15.1
52+
uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
53+
with:
54+
version: 0.15.1
5155

52-
## === ZIG FFI E2E ===
53-
# e2e:
54-
# name: E2E — FFI Pipeline
55-
# runs-on: ubuntu-latest
56-
# timeout-minutes: 15
57-
# steps:
58-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
59-
# - uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d7b4f723a50dea1f3608 # v2
60-
# with:
61-
# version: 0.15.0
62-
# - run: cd ffi/zig && zig build test
63-
# - run: bash tests/e2e.sh
56+
- name: Install just
57+
run: |
58+
curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh \
59+
| bash -s -- --to /usr/local/bin
6460
65-
## === ELIXIR E2E ===
66-
# e2e:
67-
# name: E2E — Full Pipeline
68-
# runs-on: ubuntu-latest
69-
# timeout-minutes: 15
70-
# steps:
71-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
72-
# - uses: erlef/setup-beam@5a67e1a1dd86cae5e5bef84e2da5060406a66c07 # v1
73-
# with:
74-
# otp-version: '27.0'
75-
# elixir-version: '1.17'
76-
# - run: mix deps.get && mix compile --warnings-as-errors
77-
# - run: mix test test/integration/e2e_test.exs --trace
78-
79-
## === DENO/RESCRIPT E2E ===
80-
# e2e:
81-
# name: E2E — Full Pipeline
82-
# runs-on: ubuntu-latest
83-
# timeout-minutes: 15
84-
# steps:
85-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
86-
# - uses: denoland/setup-deno@5fae568d37c3b73e0e4ca63d4e2c4e324a2b3497 # v2
87-
# with:
88-
# deno-version: v2.x
89-
# - run: deno install --node-modules-dir=auto
90-
# - run: deno task res:build # ReScript compile
91-
# - run: deno test tests/e2e/
92-
93-
## === PLAYWRIGHT (Browser E2E) ===
94-
# e2e-playwright:
95-
# name: Playwright — ${{ matrix.project }}
96-
# runs-on: ubuntu-latest
97-
# timeout-minutes: 20
98-
# strategy:
99-
# fail-fast: false
100-
# matrix:
101-
# project: [chromium-1080p, firefox-1080p, webkit-1080p]
102-
# steps:
103-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
104-
# - uses: denoland/setup-deno@5fae568d37c3b73e0e4ca63d4e2c4e324a2b3497 # v2
105-
# with:
106-
# deno-version: v2.x
107-
# - run: deno install --node-modules-dir=auto
108-
# - run: npx playwright install --with-deps
109-
# - run: npx playwright test --project=${{ matrix.project }}
110-
# - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
111-
# if: failure()
112-
# with:
113-
# name: playwright-traces-${{ matrix.project }}
114-
# path: test-results/**/trace.zip
115-
# retention-days: 7
61+
- name: Build wasm artifacts (both modes, from source)
62+
run: just build-wasm
11663

117-
## === HASKELL E2E ===
118-
# e2e:
119-
# name: E2E — Full Pipeline
120-
# runs-on: ubuntu-latest
121-
# timeout-minutes: 15
122-
# steps:
123-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
124-
# - uses: haskell-actions/setup@dd344bc1cec854a9b55c2b857c28b688010e4fce # v2
125-
# with:
126-
# ghc-version: '9.6'
127-
# cabal-version: '3.10'
128-
# - run: cabal build all
129-
# - run: bash tests/integration-test.sh
64+
- name: Verify build outputs
65+
run: |
66+
test -f priv/safe_nif_ReleaseSafe.wasm
67+
test -f priv/safe_nif_ReleaseFast.wasm
68+
ls -la priv/*.wasm
69+
70+
- name: Install Erlang/Elixir
71+
uses: erlef/setup-beam@fc68ffb90438ef2936bbb3251622353b3dcb2f93 # v1.24.0
72+
with:
73+
# OTP 28.3 + Elixir 1.19.4 matches what the rest of the estate
74+
# uses (bofj-kitt static-analysis-gate verified working). The
75+
# earlier OTP-28 Hex `bs_add` incompat is specific to Elixir 1.18's
76+
# Hex archive — Elixir 1.19's archive is unaffected.
77+
otp-version: '28.3'
78+
elixir-version: '1.19.4'
79+
80+
- name: Run demo test suite
81+
working-directory: demo
82+
run: |
83+
# Install latest Hex/rebar compatible with the Elixir/OTP combo.
84+
# Without this, the bundled-with-setup-beam Hex 2.4.2 hits a
85+
# `Hex.Repo module does not exist` supervisor error on
86+
# Elixir 1.18 / OTP 28 — fixed by installing the runtime-matched
87+
# Hex archive before `mix deps.get` tries to use it.
88+
mix local.hex --force
89+
mix local.rebar --force
90+
mix deps.get
91+
mix test --trace
92+
93+
## === DENO/RESCRIPT E2E ===
94+
# e2e:
95+
# name: E2E — Full Pipeline
96+
# runs-on: ubuntu-latest
97+
# timeout-minutes: 15
98+
# steps:
99+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
100+
# - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
101+
# with:
102+
# deno-version: v2.x
103+
# - run: deno install --node-modules-dir=auto
104+
# - run: deno task res:build # ReScript compile
105+
# - run: deno test tests/e2e/
106+
107+
## === PLAYWRIGHT (Browser E2E) ===
108+
# e2e-playwright:
109+
# name: Playwright — ${{ matrix.project }}
110+
# runs-on: ubuntu-latest
111+
# timeout-minutes: 20
112+
# strategy:
113+
# fail-fast: false
114+
# matrix:
115+
# project: [chromium-1080p, firefox-1080p, webkit-1080p]
116+
# steps:
117+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
118+
# - uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2.0.4
119+
# with:
120+
# deno-version: v2.x
121+
# - run: deno install --node-modules-dir=auto
122+
# - run: npx playwright install --with-deps
123+
# - run: npx playwright test --project=${{ matrix.project }}
124+
# - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
125+
# if: failure()
126+
# with:
127+
# name: playwright-traces-${{ matrix.project }}
128+
# path: test-results/**/trace.zip
129+
# retention-days: 7
130+
131+
## === HASKELL E2E ===
132+
# e2e:
133+
# name: E2E — Full Pipeline
134+
# runs-on: ubuntu-latest
135+
# timeout-minutes: 15
136+
# steps:
137+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
138+
# - uses: haskell-actions/setup@cd0d9bdd65b20557f41bea4dbe43d0b5fbbfe553 # v2.11.0
139+
# with:
140+
# ghc-version: '9.6'
141+
# cabal-version: '3.10'
142+
# - run: cabal build all
143+
# - run: bash tests/integration-test.sh
130144

131145
# ─── Aspect Tests ──────────────────────────────────────────────────
132146
# Cross-cutting concerns: thread safety, ABI contracts, SPDX, dangerous patterns
@@ -160,17 +174,17 @@ jobs:
160174
# path: /tmp/bench-results.txt
161175
# retention-days: 30
162176

163-
## === ZIG BENCH ===
164-
# benchmarks:
165-
# name: Bench — Performance Regression
166-
# runs-on: ubuntu-latest
167-
# timeout-minutes: 15
168-
# steps:
169-
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
170-
# - uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d7b4f723a50dea1f3608 # v2
171-
# with:
172-
# version: 0.15.0
173-
# - run: cd ffi/zig && zig build bench
177+
## === ZIG BENCH ===
178+
# benchmarks:
179+
# name: Bench — Performance Regression
180+
# runs-on: ubuntu-latest
181+
# timeout-minutes: 15
182+
# steps:
183+
# - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
184+
# - uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
185+
# with:
186+
# version: 0.15.0
187+
# - run: cd ffi/zig && zig build bench
174188

175189
# ─── Readiness (CRG) ──────────────────────────────────────────────
176190
# Component Readiness Grade: D (runs) → C (correct) → B (edge cases)

0 commit comments

Comments
 (0)