weekly certification verdict #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: weekly certification verdict | |
| on: | |
| schedule: | |
| - cron: "0 7 * * 1" | |
| workflow_dispatch: | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| jobs: | |
| refresh: | |
| runs-on: ubuntu-latest | |
| env: | |
| CI: "true" | |
| RUST_BACKTRACE: "1" | |
| CARGO_INCREMENTAL: "0" | |
| CARGO_PROFILE_DEV_DEBUG: "line-tables-only" | |
| CARGO_TARGET_DIR: /tmp/pi-agent-rust-target | |
| TMPDIR: /tmp/pi-agent-rust-tmp | |
| CI_RUN_ID: weekly-${{ github.run_id }} | |
| CI_CORRELATION_ID: weekly-${{ github.run_id }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@nightly | |
| with: | |
| components: rustfmt, clippy | |
| - name: Prepare temp directories | |
| run: | | |
| set -euxo pipefail | |
| mkdir -p "$CARGO_TARGET_DIR" "$TMPDIR" | |
| - name: Refresh must-pass extension gate | |
| continue-on-error: true | |
| run: | | |
| set -euxo pipefail | |
| cargo test --test ext_conformance_generated --features ext-conformance \ | |
| -- conformance_must_pass_gate --nocapture --exact | |
| - name: Refresh extension lifecycle parity evidence | |
| continue-on-error: true | |
| run: | | |
| set -euxo pipefail | |
| cargo test --test extensions_event_wiring \ | |
| -- lifecycle_hook_parity_matrix_writes_evidence_artifact --nocapture --exact | |
| - name: Refresh extension journey report | |
| continue-on-error: true | |
| run: | | |
| set -euxo pipefail | |
| cargo test --test ext_conformance_generated --features ext-conformance \ | |
| -- conformance_extension_journeys --nocapture --exact | |
| - name: Refresh extension health delta | |
| continue-on-error: true | |
| run: | | |
| set -euxo pipefail | |
| cargo test --test ext_conformance_generated --features ext-conformance \ | |
| -- conformance_health_delta --nocapture --exact | |
| - name: Refresh stress triage report | |
| continue-on-error: true | |
| run: | | |
| set -euxo pipefail | |
| cargo test --test extensions_stress \ | |
| -- stress_short_10_extensions --nocapture --exact | |
| mkdir -p tests/perf/reports | |
| cp "$CARGO_TARGET_DIR/perf/stress_triage.json" tests/perf/reports/stress_triage.json | |
| - name: Refresh evidence bundle | |
| continue-on-error: true | |
| run: | | |
| set -euxo pipefail | |
| cargo test --test ci_evidence_bundle \ | |
| -- build_evidence_bundle --nocapture --exact | |
| - name: Refresh full-suite gate | |
| continue-on-error: true | |
| run: | | |
| set -euxo pipefail | |
| cargo test --test ci_full_suite_gate \ | |
| -- full_suite_gate --nocapture --exact | |
| - name: Refresh certification lane | |
| continue-on-error: true | |
| run: | | |
| set -euxo pipefail | |
| cargo test --test ci_full_suite_gate \ | |
| -- full_certification --nocapture --exact | |
| - name: Build drop-in certification verdict artifact | |
| run: | | |
| set -euxo pipefail | |
| python3 - <<'PY' | |
| import json | |
| import os | |
| from datetime import datetime, timezone | |
| from pathlib import Path | |
| source_path = Path("tests/full_suite_gate/certification_verdict.json") | |
| target_path = Path("docs/evidence/dropin-certification-verdict.json") | |
| generated_at = ( | |
| datetime.now(timezone.utc) | |
| .replace(microsecond=0) | |
| .isoformat() | |
| .replace("+00:00", "Z") | |
| ) | |
| def write_payload(payload): | |
| target_path.parent.mkdir(parents=True, exist_ok=True) | |
| target_path.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8") | |
| print(f"Wrote {target_path} with overall_verdict={payload.get('overall_verdict')}") | |
| if not source_path.exists(): | |
| write_payload({ | |
| "schema": "pi.dropin.certification_verdict.v1", | |
| "git_commit": os.environ.get("GITHUB_SHA", "unknown"), | |
| "generated_at_utc": generated_at, | |
| "overall_verdict": "NOT_CERTIFIED", | |
| "hard_gate_results": [], | |
| "blocking_reasons": [f"missing source artifact: {source_path.as_posix()}"], | |
| "evidence_index": [{"path": source_path.as_posix(), "exists": False}], | |
| "source": { | |
| "certification_lane_artifact": source_path.as_posix(), | |
| "lane_verdict": "missing", | |
| }, | |
| }) | |
| raise SystemExit(0) | |
| source = json.loads(source_path.read_text(encoding="utf-8")) | |
| gates = source.get("gates", []) | |
| hard_gate_results = [] | |
| blocking_reasons = [] | |
| evidence_index = [] | |
| for gate in gates: | |
| gate_id = str(gate.get("id", "unknown")) | |
| status = str(gate.get("status", "unknown")).lower() | |
| blocking = bool(gate.get("blocking", False)) | |
| detail = gate.get("detail") | |
| artifact_path = gate.get("artifact_path") | |
| hard_gate_results.append({ | |
| "gate_id": gate_id, | |
| "status": status, | |
| "blocking": blocking, | |
| "detail": detail, | |
| "artifact_path": artifact_path, | |
| "bead": gate.get("bead"), | |
| }) | |
| if blocking and status != "pass": | |
| reason = f"{gate_id}:{status}" | |
| if detail: | |
| reason = f"{reason} ({detail})" | |
| blocking_reasons.append(reason) | |
| if isinstance(artifact_path, str) and artifact_path: | |
| evidence_index.append({ | |
| "path": artifact_path, | |
| "exists": Path(artifact_path).exists(), | |
| }) | |
| write_payload({ | |
| "schema": "pi.dropin.certification_verdict.v1", | |
| "git_commit": os.environ.get("GITHUB_SHA", "unknown"), | |
| "generated_at_utc": generated_at, | |
| "overall_verdict": "CERTIFIED" if not blocking_reasons else "NOT_CERTIFIED", | |
| "hard_gate_results": hard_gate_results, | |
| "blocking_reasons": blocking_reasons, | |
| "evidence_index": evidence_index, | |
| "source": { | |
| "certification_lane_artifact": source_path.as_posix(), | |
| "lane_verdict": source.get("verdict", "unknown"), | |
| "lane_generated_at": source.get("generated_at"), | |
| }, | |
| }) | |
| PY | |
| - name: Open refresh pull request | |
| uses: peter-evans/create-pull-request@v7 | |
| with: | |
| branch: automation/weekly-certification-verdict | |
| delete-branch: true | |
| title: "Refresh weekly certification verdict" | |
| commit-message: | | |
| Refresh weekly certification verdict | |
| Regenerate extension, evidence-bundle, full-suite, and drop-in certification artifacts from the scheduled evidence refresh workflow. | |
| body: | | |
| ## Weekly Certification Refresh | |
| This PR was generated by `.github/workflows/weekly-certification-verdict.yml`. | |
| Refreshed artifacts include: | |
| - `docs/evidence/dropin-certification-verdict.json` | |
| - `tests/ext_conformance/reports/gate/` | |
| - `tests/ext_conformance/reports/lifecycle_hooks/` | |
| - `tests/ext_conformance/reports/journeys/` | |
| - `tests/ext_conformance/reports/health_delta/` | |
| - `tests/perf/reports/stress_triage.json` | |
| - `tests/evidence_bundle/` | |
| - `tests/full_suite_gate/` | |
| labels: | | |
| evidence | |
| automation |