fix(git): harden audit_engine and banned_attribution_lib (PT canonical guard stack) #1555
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| git-hygiene: | |
| name: Git hygiene (mandatory hooks + attribution) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Configure approved git identity | |
| run: | | |
| git config user.name "cyre" | |
| git config user.email "Lawrence@cyre.me" | |
| - name: Install mandatory repo hooks | |
| run: bash scripts/git/install-local-hooks.sh | |
| - name: Bootstrap private attribution patterns (self-contained) | |
| run: bash scripts/cursor/ci-bootstrap-private-attribution.sh | |
| - name: Checkout orama-system (PR branch for stacked cross-repo parity) | |
| if: github.event_name == 'pull_request' | |
| id: checkout-orama-pr | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: diazMelgarejo/orama-system | |
| ref: ${{ github.head_ref }} | |
| path: orama-system | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| continue-on-error: true | |
| - name: Clear orama-system before main fallback | |
| if: github.event_name != 'pull_request' || steps.checkout-orama-pr.outcome != 'success' | |
| run: rm -rf orama-system | |
| - name: Checkout orama-system (main fallback) | |
| if: github.event_name != 'pull_request' || steps.checkout-orama-pr.outcome != 'success' | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: diazMelgarejo/orama-system | |
| ref: main | |
| path: orama-system | |
| fetch-depth: 1 | |
| persist-credentials: false | |
| continue-on-error: true | |
| - name: Sync gitignored .cursor/private | |
| run: | | |
| if [[ -f orama-system/scripts/cursor/write-openclaw-private-attribution.sh ]]; then | |
| export ORAMA_SYSTEM_PATH="$GITHUB_WORKSPACE/orama-system" | |
| bash orama-system/scripts/cursor/write-openclaw-private-attribution.sh | |
| fi | |
| bash scripts/cursor/sync-private-attribution-from-home.sh | |
| - name: Verify docs/adr pointers in sync with orama docs/v2 (zero-fragmentation) | |
| run: | | |
| if [ -d orama-system ]; then | |
| ORAMA_ROOT="$GITHUB_WORKSPACE/orama-system" \ | |
| bash scripts/check_docs_v2_pointer_sync.sh | |
| else | |
| echo "skip: orama-system not available in this CI run" | |
| fi | |
| - name: Verify model endpoint policy parity with orama-system | |
| run: | | |
| if [ -d orama-system ]; then | |
| ORAMA_SYSTEM_ROOT="$GITHUB_WORKSPACE/orama-system" \ | |
| python3 scripts/review/verify_model_endpoint_policy_parity.py | |
| else | |
| echo "skip: orama-system not available in this CI run" | |
| fi | |
| - name: Scan tracked files for banned tokens | |
| run: bash scripts/git/scan-tracked-banned-tokens.sh | |
| - name: Verify git guards | |
| run: bash scripts/git/verify-git-guards.sh | |
| - name: Provision verboten-literals for CI | |
| # CI checks out this repo in isolation, so repo_hygiene.py's | |
| # openclaw_workspace_root() ancestor walk never finds a sibling | |
| # orama-system/ directory the way a local multi-repo checkout does -- | |
| # the private-literal scan silently checks against nothing on CI | |
| # today. If OPENCLAW_VERBOTEN_LITERALS_CONTENT is provisioned as a | |
| # repo secret (operator action, not this workflow), write it to an | |
| # ephemeral runner-temp file and point OPENCLAW_VERBOTEN_LITERALS at | |
| # it for the rest of this job. No-op (and the scan stays empty, same | |
| # as today) if the secret isn't set -- safe default for forked-repo | |
| # PRs, which never receive secrets. | |
| if: ${{ env.OPENCLAW_VERBOTEN_LITERALS_CONTENT != '' }} | |
| env: | |
| OPENCLAW_VERBOTEN_LITERALS_CONTENT: ${{ secrets.OPENCLAW_VERBOTEN_LITERALS_CONTENT }} | |
| run: | | |
| literals_path="$RUNNER_TEMP/.verboten-literals.local" | |
| printf '%s\n' "$OPENCLAW_VERBOTEN_LITERALS_CONTENT" > "$literals_path" | |
| chmod 600 "$literals_path" | |
| echo "OPENCLAW_VERBOTEN_LITERALS=$literals_path" >> "$GITHUB_ENV" | |
| - name: Repo hygiene gate | |
| run: python3 scripts/review/repo_hygiene.py . | |
| - name: Local runtime overlay gate (committed config) | |
| run: python3 scripts/git/check_local_runtime_overlay.py . --mode tree | |
| - name: Audit branch commit attribution (PR commits) | |
| if: github.event_name == 'pull_request' | |
| env: | |
| BASE_REF: ${{ github.base_ref }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| run: | | |
| git fetch origin "$BASE_REF:$BASE_REF" || true | |
| # actions/checkout checks out refs/pull/*/merge for pull_request events. | |
| # Audit the contributor's actual head commits, not GitHub's synthetic merge commit. | |
| RANGE="origin/$BASE_REF..$HEAD_SHA" | |
| GIT_AUDIT_RANGE="$RANGE" GIT_AUDIT_STRICT=1 bash scripts/git/audit_attribution.sh | |
| # docs-sync folded in 2026-07-31: same trigger as the rest of this | |
| # job already (both live in ci.yml), so a second full | |
| # checkout+Python+pyyaml setup for two lightweight script calls was | |
| # a redundant runner/checkout, not a real isolation boundary. | |
| # | |
| # if: ${{ !cancelled() }} on all 3 steps below is load-bearing, not | |
| # decorative: without it, a step failure earlier in THIS job (e.g. | |
| # repo hygiene, banned-token scan) would skip these by GitHub | |
| # Actions' own default step behavior, silently coupling docs/config | |
| # sync to git-hygiene's success -- exactly the independent-execution | |
| # property docs-sync had as its own separate job before this fold. | |
| # !cancelled() (not always()) deliberately still skips these on a | |
| # genuine manual cancellation, which always() would not. | |
| - name: Install pyyaml (for docs/config sync checks below) | |
| if: ${{ !cancelled() }} | |
| run: pip install pyyaml | |
| - name: Validate hardware/SKILL.md matches config/models.yml | |
| if: ${{ !cancelled() }} | |
| run: python scripts/check_docs_sync.py --quiet | |
| - name: Reject stale model as default_primary_model | |
| if: ${{ !cancelled() }} | |
| run: | | |
| # Only fail if qwen3.5-35b-a3b-q4 is set as the PRIMARY model. | |
| # It may still appear as a legacy fallback entry — that is intentional. | |
| if grep "default_primary_model:.*qwen3.5-35b-a3b-q4" hardware/SKILL.md; then | |
| echo "FAIL: stale model 'qwen3.5-35b-a3b-q4' is set as default_primary_model — update to canonical LM Studio model" | |
| exit 1 | |
| fi | |
| echo "OK: default_primary_model is not a stale reference" | |
| lint-and-test: | |
| needs: [git-hygiene] | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.11", "3.12"] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Bootstrap private attribution patterns (self-contained) | |
| run: bash scripts/cursor/ci-bootstrap-private-attribution.sh | |
| - name: Set up Python ${{ matrix.python-version }} | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| # Core test deps + runtime deps needed by orchestrator.py at import time | |
| pip install pytest pytest-asyncio pytest-cov pyyaml | |
| pip install fastapi aiohttp redis httpx python-dotenv loguru pydantic | |
| # fix(ci): slowapi must be present before orchestrator.py can be imported | |
| pip install slowapi | |
| # fix(ci): respx is used by tests/discovery/ for mocking httpx calls | |
| pip install respx | |
| # fix(ci): hypothesis is used by tests/test_state_transition_manager.py | |
| # for property-based tests (declared in pyproject.toml's dev extra, but | |
| # this step installs an explicit list rather than `pip install -e .[dev]`, | |
| # so it needs to be listed here too or CI diverges from pyproject.toml). | |
| pip install hypothesis | |
| if [ -f requirements.txt ]; then pip install -r requirements.txt; fi | |
| - name: Lint with flake8 (warnings only) | |
| run: | | |
| pip install flake8 | |
| flake8 . --count --max-line-length=120 --statistics --exit-zero | |
| continue-on-error: true | |
| - name: Run tests | |
| run: | | |
| pytest tests/ -v --tb=short | |
| env: | |
| ORAMA_ENDPOINT: http://localhost:8001/orama | |
| ORAMA_TIMEOUT: "120" | |
| ORAMA_ENABLED: "false" | |
| - name: Check routing.yml validity | |
| run: | | |
| python -c " | |
| import yaml | |
| with open('config/routing.yml') as f: | |
| cfg = yaml.safe_load(f) | |
| assert 'routes' in cfg, 'routes key missing' | |
| assert 'deep_reasoning' in cfg['routes'], 'deep_reasoning route missing' | |
| assert 'code_analysis' in cfg['routes'], 'code_analysis route missing' | |
| print('routing.yml OK -- all required routes present') | |
| " |