diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index aef550a..33d1e04 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -27,7 +27,7 @@ jobs: actions: read contents: read security-events: write - uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8 + uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 with: scan-args: |- --recursive @@ -41,10 +41,10 @@ jobs: pull-requests: read steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Dependency vulnerability review - uses: actions/dependency-review-action@v5 + uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5 test: runs-on: ubuntu-latest @@ -53,30 +53,30 @@ jobs: pact_do_not_track: true steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Java 21 - uses: actions/setup-java@v5 + uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5 with: distribution: temurin java-version: '21' cache: gradle - name: Validate Gradle wrapper - uses: gradle/actions/wrapper-validation@v6 + uses: gradle/actions/wrapper-validation@90ddb51e90a5fd9ba75f40cf85156b7b41bf76a3 # v6 - name: Run Gradle quality gate run: ./gradlew clean check securityScan allureReport -Denv=${ENV} --parallel - name: Upload SBOM - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: cyclonedx-sbom path: build/reports/cyclonedx/** - name: Upload failure artifacts if: failure() - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: aria-test-artifacts path: | @@ -89,13 +89,13 @@ jobs: build/reports/cyclonedx - name: Upload OpenAPI coverage - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: openapi-coverage path: build/reports/openapi-coverage.md - name: Upload quality reports - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: quality-reports path: | @@ -107,13 +107,13 @@ jobs: build/reports/pitest/** - name: Upload Pact contracts - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: pact-contracts path: build/pacts/** - name: Upload Allure report artifact - uses: actions/upload-artifact@v7 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 with: name: allure-report path: build/reports/allure-report/allureReport @@ -125,10 +125,10 @@ jobs: pact_do_not_track: true steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Java 21 - uses: actions/setup-java@v5 + uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5 with: distribution: temurin java-version: '21' @@ -192,10 +192,10 @@ jobs: pact_do_not_track: true steps: - name: Checkout - uses: actions/checkout@v6 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Set up Java 21 - uses: actions/setup-java@v5 + uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5 with: distribution: temurin java-version: '21' diff --git a/.github/workflows/deploy-allure-pages.yml b/.github/workflows/deploy-allure-pages.yml index a6a5518..f466363 100644 --- a/.github/workflows/deploy-allure-pages.yml +++ b/.github/workflows/deploy-allure-pages.yml @@ -21,7 +21,7 @@ jobs: url: ${{ steps.deployment.outputs.page_url }} steps: - name: Download Allure Pages artifact from CI run - uses: actions/download-artifact@v8 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 with: name: allure-report run-id: ${{ github.event.workflow_run.id }} @@ -29,13 +29,13 @@ jobs: path: allure-report - name: Re-upload Pages artifact for this deployment run - uses: actions/upload-pages-artifact@v5 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5 with: name: github-pages-${{ github.run_attempt }} path: allure-report - name: Deploy Allure report to GitHub Pages id: deployment - uses: actions/deploy-pages@v5 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5 with: artifact_name: github-pages-${{ github.run_attempt }} diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index ec860f7..0eed018 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -12,7 +12,7 @@ jobs: links-and-claims: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 - name: Reject workstation-only links and unsupported superlatives shell: bash run: | diff --git a/docs/evidence/latest-verification.json b/docs/evidence/latest-verification.json index f1e5d8b..daba733 100644 --- a/docs/evidence/latest-verification.json +++ b/docs/evidence/latest-verification.json @@ -1,15 +1,17 @@ { "schemaVersion": 1, "repository": "aria-api-framework", - "evidenceState": "evidence-stale", + "evidenceState": "review-ready", "evidenceClass": ["controlled", "scheduled-live"], "verifiedRef": "main", - "verifiedSha": null, - "workflow": {"name": "ci.yml", "runId": null, "runUrl": null, "branch": "main", "event": null, "conclusion": null, "completedAt": null}, + "verifiedSha": "ab00c637e820d952ab756f3926255d311485e851", + "workflow": {"name": "ci.yml", "runId": 29138314002, "runUrl": "https://github.com/qa-test-automation-frameworks/aria-api-framework/actions/runs/29138314002", "branch": "main", "event": "push", "conclusion": "success", "completedAt": "2026-07-11T03:40:32Z"}, "target": {"name": "owned/container-backed provider", "environment": "controlled"}, - "results": [], + "results": [ + {"command": "test (JUnit XML)", "total": 66, "passed": 66, "failed": 0, "errors": 0, "skipped": 0, "durationSeconds": 13.695} + ], "reportUrl": "https://qa-test-automation-frameworks.github.io/aria-api-framework/", "artifactRetention": "CI retention plus published Allure history", "limitationsUrl": "https://github.com/qa-test-automation-frameworks/aria-api-framework/blob/main/docs/known-issues.md", - "generatedAt": "2026-07-11T00:00:00Z" + "generatedAt": "2026-07-11T04:20:00Z" } diff --git a/docs/evidence/latest-verification.md b/docs/evidence/latest-verification.md index 6f9d6dc..4e9590b 100644 --- a/docs/evidence/latest-verification.md +++ b/docs/evidence/latest-verification.md @@ -2,15 +2,17 @@ | Field | Value | |---|---| -| Repository ref | `main` (refresh after the next weekly scheduled smoke) | -| Fast gate | `ci.yml` — deterministic Gradle quality, security, container, contract, and report gates | +| Repository ref | `main` @ [`ab00c63`](https://github.com/qa-test-automation-frameworks/aria-api-framework/commit/ab00c637e820d952ab756f3926255d311485e851) | +| Fast gate | [`ci.yml` run 29138314002](https://github.com/qa-test-automation-frameworks/aria-api-framework/actions/runs/29138314002) — deterministic Gradle quality, security, container, contract, and report gates; completed 2026-07-11T03:40:32Z | | Full evidence | Weekly scheduled `live-smoke` job; broader live regression remains manual | -| Current state | `evidence-stale`; this record must be refreshed by the next weekly run | +| Current state | `review-ready`; refresh after the next scheduled or merged run | | Target/environment | Owned/container-backed provider plus explicitly configured live smoke target | | Evidence class | Controlled and scheduled-live | +| Result counts | 66 tests, 66 passed, 0 failed, 0 errors, 0 skipped (13.695s), from JUnit XML | | Report | [Allure report](https://qa-test-automation-frameworks.github.io/aria-api-framework/) | | Known limitations | [Known issues](../known-issues.md) and [review guide](../Portfolio_Review_Guide.md) | -The next record must include the exact SHA, workflow run URL, completion time, -deterministic/container/live scope, OpenAPI/Pact/mutation results, artifact links, -and any external-target limitation. +The machine-readable record with the exact SHA, run ID/URL, conclusion, and result +counts is published at [`latest-verification.json`](latest-verification.json). This +record does not include the weekly `live-smoke` job's own pass/fail counts; that +scope remains a controlled/scheduled-live distinction, not a production claim.