fix(git): harden audit_engine and banned_attribution_lib (PT canonical guard stack) #39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OramaSys Security Invariants | |
| # Merged 2026-07-31 from security-invariant-enforcer.yml + | |
| # invariant-monitor-bot.yml -- the two were running ~95% the same | |
| # checkout/setup/tests twice on every push and PR. Union of both test | |
| # lists (nothing either one checked is now unchecked); the PR-comment | |
| # step from the monitor bot is kept, not dropped. | |
| on: | |
| pull_request: | |
| branches: [main] | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| issues: write | |
| jobs: | |
| security-invariants: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install pytest pytest-asyncio pytest-cov pyyaml | |
| pip install fastapi aiohttp redis httpx python-dotenv loguru pydantic slowapi respx | |
| if [ -f requirements.txt ]; then pip install -r requirements.txt; fi | |
| - name: Check endpoint policy core wiring | |
| run: | | |
| python scripts/security/check_endpoint_policy_core.py | |
| - name: Run invariant + policy test suite | |
| run: | | |
| pytest tests/test_endpoint_policy_core.py \ | |
| tests/test_scheme_preservation.py \ | |
| tests/test_hardware_routing.py::test_active_tilting_ollama_win_uses_model_port_not_lmstudio \ | |
| tests/test_model_endpoint_url.py \ | |
| tests/test_fastapi_health.py -q --tb=short | |
| env: | |
| ORAMA_ENABLED: "false" | |
| - name: Transport scheme integrity check | |
| run: | | |
| if grep -R --include='*.py' -n 'http://http\|https://https' orchestrator src; then | |
| echo "FAIL: double-scheme transport mojibake in production Python" | |
| exit 1 | |
| fi | |
| echo "Invariant checks passed" | |
| - name: Comment on PR if failure | |
| if: failure() && github.event_name == 'pull_request' | |
| uses: actions/github-script@v7 | |
| with: | |
| script: | | |
| github.rest.issues.createComment({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| issue_number: context.payload.pull_request.number, | |
| body: [ | |
| '## OramaSys Security Invariants Alert', | |
| '', | |
| 'Transport, endpoint-policy, or FastAPI health invariants failed. See the workflow log.', | |
| '', | |
| '- scripts/security/check_endpoint_policy_core.py', | |
| '- tests/test_endpoint_policy_core.py', | |
| '- tests/test_scheme_preservation.py', | |
| '- tests/test_model_endpoint_url.py', | |
| '- tests/test_fastapi_health.py', | |
| ].join('\n'), | |
| }) |