weekly-certification-verdict.yml

name: weekly certification verdict

on:
  schedule:
    - cron: "0 7 * * 1"
  workflow_dispatch:

permissions:
  contents: write
  pull-requests: write

jobs:
  refresh:
    runs-on: ubuntu-latest
    env:
      CI: "true"
      RUST_BACKTRACE: "1"
      CARGO_INCREMENTAL: "0"
      CARGO_PROFILE_DEV_DEBUG: "line-tables-only"
      CARGO_TARGET_DIR: /tmp/pi-agent-rust-target
      TMPDIR: /tmp/pi-agent-rust-tmp
      CI_RUN_ID: weekly-${{ github.run_id }}
      CI_CORRELATION_ID: weekly-${{ github.run_id }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Install Rust toolchain
        uses: dtolnay/rust-toolchain@nightly
        with:
          components: rustfmt, clippy

      - name: Prepare temp directories
        run: |
          set -euxo pipefail
          mkdir -p "$CARGO_TARGET_DIR" "$TMPDIR"

      - name: Refresh must-pass extension gate
        continue-on-error: true
        run: |
          set -euxo pipefail
          cargo test --test ext_conformance_generated --features ext-conformance \
            -- conformance_must_pass_gate --nocapture --exact

      - name: Refresh extension lifecycle parity evidence
        continue-on-error: true
        run: |
          set -euxo pipefail
          cargo test --test extensions_event_wiring \
            -- lifecycle_hook_parity_matrix_writes_evidence_artifact --nocapture --exact

      - name: Refresh extension journey report
        continue-on-error: true
        run: |
          set -euxo pipefail
          cargo test --test ext_conformance_generated --features ext-conformance \
            -- conformance_extension_journeys --nocapture --exact

      - name: Refresh extension health delta
        continue-on-error: true
        run: |
          set -euxo pipefail
          cargo test --test ext_conformance_generated --features ext-conformance \
            -- conformance_health_delta --nocapture --exact

      - name: Refresh stress triage report
        continue-on-error: true
        run: |
          set -euxo pipefail
          cargo test --test extensions_stress \
            -- stress_short_10_extensions --nocapture --exact
          mkdir -p tests/perf/reports
          cp "$CARGO_TARGET_DIR/perf/stress_triage.json" tests/perf/reports/stress_triage.json

      - name: Refresh evidence bundle
        continue-on-error: true
        run: |
          set -euxo pipefail
          cargo test --test ci_evidence_bundle \
            -- build_evidence_bundle --nocapture --exact

      - name: Refresh full-suite gate
        continue-on-error: true
        run: |
          set -euxo pipefail
          cargo test --test ci_full_suite_gate \
            -- full_suite_gate --nocapture --exact

      - name: Refresh certification lane
        continue-on-error: true
        run: |
          set -euxo pipefail
          cargo test --test ci_full_suite_gate \
            -- full_certification --nocapture --exact

      - name: Build drop-in certification verdict artifact
        run: |
          set -euxo pipefail
          python3 - <<'PY'
          import json
          import os
          from datetime import datetime, timezone
          from pathlib import Path

          source_path = Path("tests/full_suite_gate/certification_verdict.json")
          target_path = Path("docs/evidence/dropin-certification-verdict.json")
          generated_at = (
              datetime.now(timezone.utc)
              .replace(microsecond=0)
              .isoformat()
              .replace("+00:00", "Z")
          )

          def write_payload(payload):
              target_path.parent.mkdir(parents=True, exist_ok=True)
              target_path.write_text(json.dumps(payload, indent=2) + "\n", encoding="utf-8")
              print(f"Wrote {target_path} with overall_verdict={payload.get('overall_verdict')}")

          if not source_path.exists():
              write_payload({
                  "schema": "pi.dropin.certification_verdict.v1",
                  "git_commit": os.environ.get("GITHUB_SHA", "unknown"),
                  "generated_at_utc": generated_at,
                  "overall_verdict": "NOT_CERTIFIED",
                  "hard_gate_results": [],
                  "blocking_reasons": [f"missing source artifact: {source_path.as_posix()}"],
                  "evidence_index": [{"path": source_path.as_posix(), "exists": False}],
                  "source": {
                      "certification_lane_artifact": source_path.as_posix(),
                      "lane_verdict": "missing",
                  },
              })
              raise SystemExit(0)

          source = json.loads(source_path.read_text(encoding="utf-8"))
          gates = source.get("gates", [])
          hard_gate_results = []
          blocking_reasons = []
          evidence_index = []

          for gate in gates:
              gate_id = str(gate.get("id", "unknown"))
              status = str(gate.get("status", "unknown")).lower()
              blocking = bool(gate.get("blocking", False))
              detail = gate.get("detail")
              artifact_path = gate.get("artifact_path")

              hard_gate_results.append({
                  "gate_id": gate_id,
                  "status": status,
                  "blocking": blocking,
                  "detail": detail,
                  "artifact_path": artifact_path,
                  "bead": gate.get("bead"),
              })

              if blocking and status != "pass":
                  reason = f"{gate_id}:{status}"
                  if detail:
                      reason = f"{reason} ({detail})"
                  blocking_reasons.append(reason)

              if isinstance(artifact_path, str) and artifact_path:
                  evidence_index.append({
                      "path": artifact_path,
                      "exists": Path(artifact_path).exists(),
                  })

          write_payload({
              "schema": "pi.dropin.certification_verdict.v1",
              "git_commit": os.environ.get("GITHUB_SHA", "unknown"),
              "generated_at_utc": generated_at,
              "overall_verdict": "CERTIFIED" if not blocking_reasons else "NOT_CERTIFIED",
              "hard_gate_results": hard_gate_results,
              "blocking_reasons": blocking_reasons,
              "evidence_index": evidence_index,
              "source": {
                  "certification_lane_artifact": source_path.as_posix(),
                  "lane_verdict": source.get("verdict", "unknown"),
                  "lane_generated_at": source.get("generated_at"),
              },
          })
          PY

      - name: Open refresh pull request
        uses: peter-evans/create-pull-request@v7
        with:
          branch: automation/weekly-certification-verdict
          delete-branch: true
          title: "Refresh weekly certification verdict"
          commit-message: |
            Refresh weekly certification verdict

            Regenerate extension, evidence-bundle, full-suite, and drop-in certification artifacts from the scheduled evidence refresh workflow.
          body: |
            ## Weekly Certification Refresh

            This PR was generated by `.github/workflows/weekly-certification-verdict.yml`.

            Refreshed artifacts include:
            - `docs/evidence/dropin-certification-verdict.json`
            - `tests/ext_conformance/reports/gate/`
            - `tests/ext_conformance/reports/lifecycle_hooks/`
            - `tests/ext_conformance/reports/journeys/`
            - `tests/ext_conformance/reports/health_delta/`
            - `tests/perf/reports/stress_triage.json`
            - `tests/evidence_bundle/`
            - `tests/full_suite_gate/`
          labels: |
            evidence
            automation