feat(experiments): arbitrary-tiebreak pilot -- the ceiling finally br… #17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| name: Lint, type-check, test (Python ${{ matrix.python-version }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Matches `requires-python = ">=3.10"`. The lower bound is tested | |
| # because the codebase uses PEP 604 unions at module scope, which is | |
| # exactly what a 3.9 environment cannot import -- the previous matrix | |
| # pinned 3.9 and could never have passed. | |
| python-version: ["3.10", "3.11", "3.12"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: "pip" | |
| - name: Install dependencies | |
| run: pip install -e ".[dev,tokenizers]" | |
| - name: Lint (ruff check) | |
| run: ruff check src/ tests/ | |
| - name: Format check (ruff format) | |
| run: ruff format --check src/ tests/ | |
| - name: Type check (mypy) | |
| run: mypy src/verityai | |
| - name: Test with coverage | |
| # The threshold lives in pyproject.toml's [tool.coverage.report] so | |
| # `make test` and CI cannot drift apart. | |
| run: pytest tests/ --cov=verityai --cov-report=term-missing --cov-report=xml | |
| - name: Upload coverage | |
| if: matrix.python-version == '3.11' | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: coverage | |
| path: coverage.xml | |
| retention-days: 14 | |
| dogfood: | |
| name: Harness checks itself | |
| runs-on: ubuntu-latest | |
| # The Reliability Engine's architecture check (ADR-0008) validates the | |
| # import policy documented in CLAUDE.md against the real code graph, and | |
| # exits non-zero when they disagree. Running it here is the difference | |
| # between having that check and using it: a PR adding an undeclared | |
| # cross-engine import fails before review. | |
| # | |
| # `verity reliability security` is deliberately NOT run here. It always | |
| # exits 0 -- by design, since its own rules declare that they match a | |
| # syntactic shape and cannot tell a shared container from a local one. | |
| # A CI step that structurally cannot fail is theatre, and this project's | |
| # own T6 finding is to be suspicious of a checker that has never failed | |
| # anything. It stays a local reporting tool. | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| cache: "pip" | |
| - name: Install | |
| run: pip install -e "." | |
| - name: Build the code graph over this repository | |
| run: | | |
| verity init | |
| verity graph build . | |
| - name: Architecture check (import policy) | |
| run: verity reliability architecture |