Decide the rewritten PCAP's mode instead of inheriting the umask (#98) #276
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| permissions: | |
| contents: read | |
| # TRIGGERS: `push` is scoped to `main`. Without a branch filter it also matches | |
| # pushes to pull-request branches, which already match `pull_request`, so every | |
| # job ran twice per commit, on two separate workflow runs. Naming `branches:` | |
| # also stops tag pushes from matching. `pull_request` checks out the branch | |
| # already merged into its base, so merge coverage is not what is being dropped | |
| # here — the one thing lost is CI on a branch with no pull request open, and | |
| # `workflow_dispatch` replaces it (`gh workflow run ci.yml --ref <branch>`). | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| jobs: | |
| # Ungated and unconditional: AGENTS.md is itself Markdown, so a | |
| # documentation-only change is exactly the change that can edit a | |
| # generated region. | |
| # | |
| # No `with:` block. The release to compare against and the blocks to | |
| # compare are both read from `.agents/instructions.toml`, so they have one | |
| # source rather than two that can disagree, and the apply job that | |
| # rewrites them never has to touch `.github/workflows/` -- which the | |
| # default GITHUB_TOKEN may not push to. The pin is a release tag rather | |
| # than a branch, so an edit upstream reaches this repository through the | |
| # pull request that moves it instead of turning every unrelated pull | |
| # request red. | |
| instructions: | |
| name: Instructions | |
| uses: aicers/agent-instructions/.github/workflows/check-drift.yml@main | |
| # Ungated and standalone, matching `aicers/roxyd` and `aicers/agentcoop`. Kept | |
| # out of `check` so a clippy failure cannot hide the Markdown result, and so | |
| # the lint survives if the expensive jobs are ever put behind a path filter. | |
| markdown: | |
| name: Markdown | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: DavidAnson/markdownlint-cli2-action@v24 | |
| with: | |
| globs: "**/*.md" | |
| check: | |
| name: Quality Check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Setup Rust Toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| with: | |
| components: clippy, rustfmt | |
| - name: Rust Cache | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Check Rust Formatting | |
| run: cargo fmt -- --check --config group_imports=StdExternalCrate | |
| - name: Check Rust Lints (Clippy) | |
| run: cargo clippy --all-targets -- -D warnings | |
| - name: Install cargo-audit | |
| run: cargo install cargo-audit || true | |
| - name: Run Security Audit | |
| run: cargo audit | |
| test: | |
| name: Test | |
| needs: [check] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Setup Rust Toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Rust Cache | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Run Tests | |
| run: cargo test | |
| ac0-pipeline: | |
| name: AC-0 Pipeline | |
| needs: [check] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Setup Rust Toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Rust Cache | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Build | |
| run: cargo build --release | |
| - name: Generate AC-0 bundle | |
| run: cargo run --release -- generate -s scenarios/ac-0.scenario.yaml -o ac0-bundle | |
| - name: Validate AC-0 bundle | |
| run: cargo run --release -- validate -b ac0-bundle | |
| ac0-compressed-pipeline: | |
| name: AC-0 Compressed Pipeline | |
| needs: [check] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Setup Rust Toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Rust Cache | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Build | |
| run: cargo build --release | |
| - name: Generate AC-0 compressed bundle | |
| run: cargo run --release -- generate -s scenarios/ac-0-compressed.scenario.yaml -o ac0c-bundle | |
| - name: Validate AC-0 compressed bundle | |
| run: cargo run --release -- validate -b ac0c-bundle | |
| - name: Assert meta.json invariants | |
| run: python3 .github/scripts/check_ac0_compressed_meta.py ac0c-bundle/meta.json | |
| - name: Assert ground_truth manifest invariants | |
| run: python3 .github/scripts/check_ac0_compressed_gt.py ac0c-bundle/ground_truth/manifest.jsonl | |
| - name: Assert pcap structural invariants | |
| run: python3 .github/scripts/check_ac0_compressed_pcap.py ac0c-bundle/net/lan.pcap | |
| docker-e2e: | |
| name: Docker E2E | |
| needs: [check] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Setup Rust Toolchain | |
| uses: dtolnay/rust-toolchain@stable | |
| - name: Rust Cache | |
| uses: Swatinem/rust-cache@v2 | |
| - name: Run Docker E2E Tests | |
| run: cargo test -- --ignored |