sin-verify.yml

# Purpose: verify the Python sin-code-bundle package on PRs by installing the
# local source and running pytest + the audit-chain integrity check.
# n8n-delegated per mandate M1 (see AGENTS.md §M1).
# Heavy work (pip install, go build, pytest, audit chain) runs on the OCI
# free-tier VM via n8n. The only runner-side work is a lightweight `go vet`
# pre-check (~2s).
name: sin-verify

on:
  pull_request:
    branches: ["main"]
  workflow_dispatch:

jobs:
  delegate:
    name: Delegate sin-verify to n8n
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-go@v6
        with:
          go-version-file: go.mod
      - name: Trigger n8n webhook
        env:
          N8N_CI_WEBHOOK_URL: ${{ secrets.N8N_CI_WEBHOOK_URL }}
        run: |
          if [[ -z "$N8N_CI_WEBHOOK_URL" ]]; then
            echo "::error::N8N_CI_WEBHOOK_URL secret is not configured"
            exit 1
          fi
          curl -fsS -X POST \
            -H "Content-Type: application/json" \
            -d "{\"workflow\":\"sin-verify\",\"ref\":\"${{ github.ref }}\",\"sha\":\"${{ github.sha }}\",\"repo\":\"${{ github.repository }}\",\"actor\":\"${{ github.actor }}\"}" \
            "$N8N_CI_WEBHOOK_URL"
      - name: Local pre-check (go vet)
        run: |
          go version
          go vet ./cmd/sin-code/...
          echo "Heavy Python verify work delegated to n8n."