validate.yml

# example-kvs CI — single job that runs the three gates:
#   1. `rivet validate`   typed-artifact graph check
#   2. `bazel build //...` AADL → WIT → wit-bindgen → WASM component
#   3. `python tools/verify.py` artifact-driven verification gate
#      (drives bazel test per comp-req's verified-by entries)
#
# Note: CI may go RED on purpose. The verify gate runs surface tests
# against the vendored eclipse-score rust_kvs sources. Some of those
# tests assert spec compliance the upstream impl does not enforce;
# when that's the case, the test FAILs and the gate FIREs. That is
# the LS-N demonstration vs. "green-CI-by-default" coverage-wedge
# reporting. See README.md "What this gate measures" for details.

name: validate

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  validate:
    name: rivet + bazel + verify
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install rivet
        run: |
          cargo install --git https://github.com/pulseengine/rivet \
              --tag v0.13.0 \
              rivet-cli --bin rivet --locked
          rivet --version

      - name: Install PyYAML for verify.py
        run: pip install pyyaml

      - name: Set up bazelisk
        uses: bazel-contrib/setup-bazel@0.9.1
        with:
          bazelisk-version: "1.x"

      - name: rivet validate (typed-artifact graph check)
        run: make validate

      - name: bazel build (AADL → WIT → wit-bindgen → wasm component)
        run: bazel build //...

      - name: artifact-driven verification gate (real bazel test per artifact)
        # verify.py shells out to `bazel test --test_arg=--exact …` per
        # entry in each comp-req's verified-by list. Honest signal: red
        # iff any comp-req has FAILED or MISSING evidence.
        run: make verify