chore: audit-remediation batch — panic/unsafe, CI test-gating + cover… #261
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MPL-2.0 | |
| name: ECHIDNA Validation | |
| on: | |
| push: | |
| paths: | |
| - 'proofs/**' | |
| - 'impl/rust-cli/src/**' | |
| - 'impl/rust-cli/tests/**' | |
| - 'scripts/validate-with-echidna.sh' | |
| - '.github/workflows/echidna-validation.yml' | |
| pull_request: | |
| paths: | |
| - 'proofs/**' | |
| - 'impl/rust-cli/**' | |
| schedule: | |
| - cron: '0 6 * * 1' # Weekly on Monday at 06:00 UTC | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| echidna-verify: | |
| name: ECHIDNA Proof Verification | |
| # This job builds the external ECHIDNA repository from its current default | |
| # branch. Keep that moving integration check out of required PR CI so | |
| # valence-shell changes are not blocked by an unrelated upstream breakage. | |
| if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6.0.2 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable | |
| with: | |
| components: rustfmt, clippy | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@baf1a810e98b6a3001d0d7234864ed75a17c42fb # v2 | |
| with: | |
| workspaces: impl/rust-cli | |
| - name: Build ECHIDNA from source | |
| run: | | |
| git clone --depth 1 https://github.com/hyperpolymath/echidna.git /tmp/echidna | |
| cd /tmp/echidna | |
| cargo build --release --bin echidna | |
| echo "/tmp/echidna/target/release" >> $GITHUB_PATH | |
| - name: Install proof provers | |
| run: | | |
| set -euo pipefail | |
| sudo apt-get update | |
| sudo apt-get install -y --no-install-recommends \ | |
| lean \ | |
| coq \ | |
| agda \ | |
| isabelle \ | |
| z3 | |
| - name: Verify ECHIDNA available | |
| run: echidna list-provers | |
| - name: Run ECHIDNA validation pipeline | |
| run: bash scripts/validate-with-echidna.sh --verbose | |
| env: | |
| ECHIDNA_BIN: /tmp/echidna/target/release/echidna | |
| correspondence: | |
| name: Lean 4 ↔ Rust Correspondence | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6.0.2 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable | |
| - name: Cache Rust dependencies | |
| uses: Swatinem/rust-cache@baf1a810e98b6a3001d0d7234864ed75a17c42fb # v2 | |
| with: | |
| workspaces: impl/rust-cli | |
| - name: Run correspondence tests | |
| working-directory: impl/rust-cli | |
| run: cargo test --test correspondence_tests --verbose | |
| - name: Run property correspondence tests | |
| working-directory: impl/rust-cli | |
| run: cargo test --test property_tests --verbose | |
| - name: Run security tests | |
| working-directory: impl/rust-cli | |
| run: cargo test --test security_tests --verbose | |
| - name: Count proof holes | |
| run: | | |
| echo "=== Proof Hole Audit ===" | |
| echo "" | |
| echo "--- Lean 4 (sorry) ---" | |
| grep -rn "sorry" proofs/lean4/ || echo "(none)" | |
| echo "" | |
| echo "--- Coq (Admitted) ---" | |
| grep -rn "Admitted" proofs/coq/ || echo "(none)" | |
| echo "" | |
| echo "--- Agda (postulate) ---" | |
| grep -rn "postulate" proofs/agda/ || echo "(none)" | |
| echo "" | |
| LEAN_HOLES=$(grep -r "sorry" proofs/lean4/ 2>/dev/null | wc -l || echo 0) | |
| COQ_HOLES=$(grep -r "Admitted" proofs/coq/ 2>/dev/null | wc -l || echo 0) | |
| AGDA_HOLES=$(grep -r "postulate" proofs/agda/ 2>/dev/null | wc -l || echo 0) | |
| TOTAL=$((LEAN_HOLES + COQ_HOLES + AGDA_HOLES)) | |
| echo "Total proof holes: $TOTAL (Lean: $LEAN_HOLES, Coq: $COQ_HOLES, Agda: $AGDA_HOLES)" | |
| echo "" | |
| if [ "$TOTAL" -gt 35 ]; then | |
| echo "WARNING: Proof holes increased beyond baseline (31). Investigate." | |
| exit 1 | |
| fi |