validate.yml

# example-kvs CI — runs the two gates that work without spar/sigil
# installed: rivet validate (typed-artifact graph check) and the
# artifact-driven verification gate (tools/verify.py).
#
# No untrusted input is used in any run: block; all commands are
# static make targets / pinned installs.

name: validate

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  validate-pinned:
    name: rivet validate + artifact-driven verification gate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install rivet
        run: |
          cargo install --git https://github.com/pulseengine/rivet \
              --tag v0.13.0 \
              rivet-cli --bin rivet --locked
          rivet --version

      - name: Install PyYAML for verify.py
        run: pip install pyyaml

      - name: rivet validate (typed-artifact graph check)
        run: make validate

      - name: artifact-driven verification gate
        run: make verify

  bazel-wasm-component:
    name: bazel build (AADL → WIT → wasm component)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up bazelisk
        uses: bazel-contrib/setup-bazel@0.9.1
        with:
          bazelisk-version: "1.x"

      - name: bazel build //... (WIT → wit-bindgen → rust_component → .wasm)
        run: bazel build //...

      - name: bazel test //... (rust_wasm_component_test)
        run: bazel test //... --test_output=errors