ci.yml

name: EPAC CI

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ['3.10', '3.11', '3.12']
    steps:
      - uses: actions/checkout@v7
        with:
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
          persist-credentials: false
      - uses: actions/setup-python@v7
        with:
          python-version: ${{ matrix.python-version }}
      - name: Install exact verification environment
        run: |
          python -m pip install uv==0.11.18
          uv sync --locked --python python --extra test --extra build
      - name: Build normalized licensed release candidate
        env:
          EXPECTED_SOURCE_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          test -z "$(git status --porcelain --untracked-files=all)"
          test "$(git rev-parse HEAD)" = "$EXPECTED_SOURCE_COMMIT"
          uv python install 3.11.15
          uv venv --python 3.11.15 /tmp/epac-release-builder
          uv pip install --python /tmp/epac-release-builder/bin/python -r requirements-build.txt
          /tmp/epac-release-builder/bin/python tools/build_release.py /tmp/epac-release-candidate
          .venv/bin/python -m twine check /tmp/epac-release-candidate/*.whl /tmp/epac-release-candidate/*.tar.gz
      - name: Replay installed wheel and source artifact
        run: bash tools/replay_distributions.sh . /tmp/epac-release-candidate /tmp/epac-replay python
      - name: Verify work-graph identity
        run: |
          python - <<'PY'
          import hashlib
          import json
          from pathlib import Path

          doc = json.loads(Path("docs/work-graph.json").read_text(encoding="utf-8"))
          payload = {"repositories": doc["repositories"], "boundaries": doc["boundaries"]}
          actual = hashlib.sha256(
              json.dumps(payload, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
          ).hexdigest()
          assert actual == doc["work_graph_sha256"], (actual, doc["work_graph_sha256"])
          print(actual)
          PY
      - name: Retain private artifact replay evidence
        env:
          EXPECTED_SOURCE_COMMIT: ${{ github.event.pull_request.head.sha || github.sha }}
        run: |
          python - <<'PY'
          import json
          import os
          from pathlib import Path
          import shutil
          import subprocess
          import sys

          def git(*args):
              return subprocess.check_output(['git', *args], text=True).strip()
          if git('status', '--porcelain', '--untracked-files=all') or git('rev-parse', 'HEAD') != os.environ['EXPECTED_SOURCE_COMMIT']:
              raise SystemExit('source identity changed during qualification')
          output = Path('/tmp/epac-ci-evidence')
          output.mkdir()
          shutil.copytree('/tmp/epac-release-candidate', output / 'artifacts')
          replay = output / 'replay'
          replay.mkdir()
          for path in Path('/tmp/epac-replay').iterdir():
              if path.is_file():
                  shutil.copy2(path, replay / path.name)
          (output / 'source.json').write_text(json.dumps({
              'source_commit': git('rev-parse', 'HEAD'),
              'source_tree': git('rev-parse', 'HEAD^{tree}'),
              'python': sys.version,
              'license_qualification': 'recorded; release qualification separate' if Path('LICENSE').is_file() else 'pending owner choice',
              'publication_or_authority_transfer': False
          }, indent=2) + '\n')
          PY
      - uses: actions/upload-artifact@v7
        with:
          name: epac-private-replay-${{ matrix.python-version }}
          path: /tmp/epac-ci-evidence
          if-no-files-found: error