agentegrity/.github/workflows/ci.yml at main · Cogensec/agentegrity · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python-version: ["3.10", "3.12"]
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v6
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: pip install -e ".[dev,crypto]"

      - name: Verify Python version parity (pyproject ↔ __init__ ↔ README)
        run: python scripts/check_versions.py

      - name: Lint
        run: python -m ruff check src/ tests/

      - name: Type check
        run: python -m mypy src/agentegrity

      - name: Test
        run: python -m pytest tests/ -v

  coverage:
    # Separate job so the unit-test matrix above stays fast. Runs once
    # against the latest supported Python; the threshold lives in
    # pyproject.toml [tool.coverage.report].fail_under.
    #
    # Installs [all,dev] (not just [dev,crypto]) so the optional-dep
    # modules (cortical_llm, adversarial_llm, kms_checkpoint) get
    # exercised by their test suites instead of being imported-but-
    # untested — those skipped tests would otherwise pull coverage
    # below the 85% gate.
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install dependencies
        run: pip install -e ".[all,dev]"

      - name: Run tests with branch coverage
        run: |
          python -m pytest tests/ \
            --cov=agentegrity \
            --cov-report=term-missing \
            --cov-report=xml:coverage.xml

      - name: Upload coverage XML
        if: always()
        uses: actions/upload-artifact@v7
        with:
          name: python-coverage-xml
          path: coverage.xml
          retention-days: 14

  dependency-audit:
    # Surfaces known CVEs in Python + TypeScript dependencies on every
    # PR. Advisory (continue-on-error), NOT a hard gate: pip-audit scans
    # the whole environment (including ambient pip/setuptools/wheel and
    # transitive/dev packages), so blocking here would fail main
    # non-deterministically on advisories with no project-side fix. The
    # ENFORCING mechanism is Dependabot (.github/dependabot.yml), which
    # opens remediation PRs and feeds GitHub's security alerts. Read this
    # job's log/annotations to triage; bump the offending dep to clear it.
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-python@v6
        with:
          python-version: "3.12"

      - name: Install package + pip-audit
        run: |
          pip install -e ".[all,dev]"
          pip install pip-audit

      - name: Audit Python dependencies
        run: pip-audit --desc
        continue-on-error: true

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.10"

      - name: Audit TypeScript dependencies
        run: bun audit
        working-directory: clients/typescript
        continue-on-error: true

  typescript:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        node-version: ["18", "20", "22"]
    steps:
      - uses: actions/checkout@v7

      - uses: oven-sh/setup-bun@v2
        with:
          bun-version: "1.3.10"

      - uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node-version }}

      - name: Install workspace
        run: bun install --frozen-lockfile
        working-directory: clients/typescript

      - name: Verify version parity with pyproject
        run: bun run check-versions
        working-directory: clients/typescript

      - name: Build @agentegrity/client first (dependent packages resolve its types from dist/)
        run: bun run --filter @agentegrity/client build
        working-directory: clients/typescript

      - name: Typecheck all packages
        run: bun run typecheck
        working-directory: clients/typescript

      - name: Build all packages
        run: bun run build
        working-directory: clients/typescript

      - name: Test all packages
        run: bun run test
        working-directory: clients/typescript

      - name: TypeScript coverage gate (lines ≥ 80, functions ≥ 70)
        run: bun run check-coverage
        working-directory: clients/typescript