Roll cohesion pattern across VM+PM, Identity, Backup: contract, run_c… #11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| smoke-test: | |
| name: Demo Pipeline Smoke Test | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.10", "3.11", "3.12"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Run unified assessment (demo mode) | |
| run: python3 run_all.py --demo --output /tmp/e8cr-test | |
| - name: Verify all reports generated | |
| run: | | |
| test -f /tmp/e8cr-test/e8cr-assessment.html | |
| test -f /tmp/e8cr-test/vmpm/evidence-pack/weekly-report.html | |
| test -f /tmp/e8cr-test/identity/identity-report.html | |
| test -f /tmp/e8cr-test/appcontrol/appcontrol-report.html | |
| test -f /tmp/e8cr-test/backup/backup-report.html | |
| echo "✅ All 5 reports generated successfully" | |
| - name: Verify individual bot demos | |
| run: | | |
| python3 e8cr-vmpm/scripts/demo_generate.py --output /tmp/e8cr-individual-vmpm --full-pipeline | |
| echo "✅ vmpm demo_generate passed" | |
| python3 e8cr-identity/scripts/demo_generate.py --output /tmp/e8cr-individual-identity --full-pipeline | |
| echo "✅ identity demo_generate passed" | |
| python3 e8cr-appcontrol/scripts/demo_generate.py --output /tmp/e8cr-individual-appcontrol --full-pipeline | |
| echo "✅ appcontrol demo_generate passed" | |
| python3 e8cr-backup/scripts/demo_generate.py --output /tmp/e8cr-individual-backup --full-pipeline | |
| echo "✅ backup demo_generate passed" | |
| - name: Validate bot contracts + evidence schemas | |
| run: | | |
| pip install pyyaml jsonschema | |
| python3 e8cr-vmpm/scripts/check_contract_consistency.py --root e8cr-vmpm | |
| python3 e8cr-vmpm/scripts/validate_evidence.py --evidence-dir /tmp/e8cr-individual-vmpm --schemas-dir e8cr-vmpm/schemas | |
| python3 e8cr-identity/scripts/check_contract_consistency.py --root e8cr-identity | |
| python3 e8cr-identity/scripts/validate_evidence.py --evidence-dir /tmp/e8cr-individual-identity --schemas-dir e8cr-identity/schemas | |
| python3 e8cr-appcontrol/scripts/check_contract_consistency.py --root e8cr-appcontrol | |
| python3 e8cr-appcontrol/scripts/validate_evidence.py --evidence-dir /tmp/e8cr-individual-appcontrol --schemas-dir e8cr-appcontrol/schemas | |
| python3 e8cr-backup/scripts/check_contract_consistency.py --root e8cr-backup | |
| python3 e8cr-backup/scripts/validate_evidence.py --evidence-dir /tmp/e8cr-individual-backup --schemas-dir e8cr-backup/schemas | |
| - name: Check for common issues | |
| run: | | |
| # No __pycache__ in repo | |
| ! find . -path ./.git -prune -o -name __pycache__ -print | grep -q . | |
| echo "✅ No __pycache__ in repo" | |
| # No hardcoded secrets | |
| ! grep -r "AZURE_CLIENT_SECRET\s*=" --include="*.py" . | grep -v "os.environ\|os.getenv\|get_env\|argparse\|#\|sample\|example\|demo" | |
| echo "✅ No hardcoded secrets detected" | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - run: pip install ruff | |
| - run: ruff check --select E,F,W --ignore E501,E402 . |