fix: trust on-ramp + hygiene — Action snippet, install checksum, CI, verify (Act-1 PR-C) #73

Workflow file for this run

	name: CI

	on:
	push:
	branches: [ main ]
	pull_request:

	jobs:
	rust:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: Cache cargo artifacts
	uses: actions/cache@v4
	with:
	path: \|
	~/.cargo/registry
	~/.cargo/git
	target
	key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock') }}
	restore-keys: \|
	${{ runner.os }}-cargo-
	- uses: actions-rs/toolchain@v1
	with:
	toolchain: stable
	profile: minimal
	override: true
	- name: Cargo fmt
	run: cargo fmt --all -- --check
	- name: Cargo test
	run: cargo test
	- name: Build examples
	run: cargo build --examples
	- name: Build docs
	run: cargo doc --no-deps

	python:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: Cache cargo artifacts
	uses: actions/cache@v4
	with:
	path: \|
	~/.cargo/registry
	~/.cargo/git
	target
	key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock') }}
	restore-keys: \|
	${{ runner.os }}-cargo-
	- name: Cache pip
	uses: actions/cache@v4
	with:
	path: ~/.cache/pip
	key: ${{ runner.os }}-pip-${{ hashFiles('pyproject.toml') }}
	restore-keys: \|
	${{ runner.os }}-pip-
	- uses: actions/setup-python@v4
	with:
	python-version: '3.11'
	- name: Install maturin and cffi
	run: pip install maturin cffi
	- name: Build python bindings
	run: maturin build --features python-bindings

	cli-e2e:
	runs-on: ubuntu-latest
	env:
	PYO3_PYTHON: python3
	steps:
	- uses: actions/checkout@v4
	- name: Cache cargo artifacts
	uses: actions/cache@v4
	with:
	path: \|
	~/.cargo/registry
	~/.cargo/git
	target
	key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock') }}
	restore-keys: \|
	${{ runner.os }}-cargo-
	- name: Cache pip
	uses: actions/cache@v4
	with:
	path: ~/.cache/pip
	key: ${{ runner.os }}-pip-${{ hashFiles('pyproject.toml') }}
	restore-keys: \|
	${{ runner.os }}-pip-
	- uses: actions/setup-python@v4
	with:
	python-version: '3.11'
	- uses: actions-rs/toolchain@v1
	with:
	toolchain: stable
	profile: minimal
	override: true
	- name: Verify the committed toy reference is intact (pinned hash)
	# A real anti-corruption gate, not the old self-referential check: pin the
	# COMMITTED reference.fa (the one the release bundle + every other job
	# ships) to a known hash. The previous step regenerated reference.fa at
	# 1 Mbp without --length, overwriting the committed 4 kbp fixture and
	# checking freshly-generated files against freshly-generated sums (a
	# tautology that also tested a different reference than ships).
	run: \|
	echo "ce8a6df801e836f4eda0b7661a68dcd7b7a9ab247c66d4582a89dbc207554efa examples/data/illumina_toy/reference.fa" \
	\| sha256sum --check
	- name: Generate reads from the committed toy reference
	# --reference simulates reads FROM the committed reference (does not invent
	# or overwrite one), so cli-e2e exercises exactly the fixture that ships.
	run: python3 scripts/generate_toy_data.py examples/data/illumina_toy --reference examples/data/illumina_toy/reference.fa
	- name: Align to SAM
	run: \|
	cargo run --release -- align \
	--reference examples/data/illumina_toy/reference.fa \
	--reads examples/data/illumina_toy/reads_R1.fastq \
	--format sam \
	--output examples/data/illumina_toy/alignments.sam
	- name: Align to BAM
	run: \|
	cargo run --release -- align \
	--reference examples/data/illumina_toy/reference.fa \
	--reads examples/data/illumina_toy/reads_R1.fastq \
	--format bam \
	--output examples/data/illumina_toy/alignments.bam
	- name: Call variants
	run: \|
	cargo run --release -- variants \
	--reference examples/data/illumina_toy/reference.fa \
	--alignments examples/data/illumina_toy/alignments.sam \
	--mapq-threshold 5 \
	--output examples/data/illumina_toy/variants.vcf
	- name: Sanity-check outputs
	run: \|
	test -s examples/data/illumina_toy/alignments.sam
	test -s examples/data/illumina_toy/alignments.bam
	grep -q '^#CHROM' examples/data/illumina_toy/variants.vcf
	grep -q -v '^#' examples/data/illumina_toy/variants.vcf \|\| echo \"warning: no variant lines emitted\"
	- name: Build index for the bounded contract path
	run: \|
	cargo run --release -- index \
	--reference examples/data/illumina_toy/reference.fa \
	--output examples/data/illumina_toy/reference.idx
	- name: Sort the BAM for the contract path
	run: \|
	cargo run --release -- sort \
	--input examples/data/illumina_toy/alignments.bam \
	--output examples/data/illumina_toy/sorted.bam
	- name: Contract gate — fits / verify / refuse (bounded --index path)
	run: \|
	set -e
	# (1) Generous budget fits -> exit 0 + "contract: OK".
	cargo run --release -- variants --index examples/data/illumina_toy/reference.idx \
	--alignments examples/data/illumina_toy/sorted.bam \
	--memory-budget-mb 4096 --enforce \
	-o examples/data/illumina_toy/contract.vcf 2> ok.log
	grep -q "contract: OK" ok.log
	# (2) Verify the receipt without re-running -> exit 0.
	cargo run --release -- verify \
	--manifest examples/data/illumina_toy/contract.vcf.manifest.json \| grep -q "verify: OK"
	# (3) 1 MiB budget refuses up front -> exit 3, and writes no VCF.
	rm -f examples/data/illumina_toy/refused.vcf
	set +e
	cargo run --release -- variants --index examples/data/illumina_toy/reference.idx \
	--alignments examples/data/illumina_toy/sorted.bam \
	--memory-budget-mb 1 --enforce \
	-o examples/data/illumina_toy/refused.vcf 2> refuse.log
	code=$?
	set -e
	test "$code" -eq 3
	grep -q "REFUSE" refuse.log
	test ! -f examples/data/illumina_toy/refused.vcf
	- name: Exercise the rosalind-budget Action (local, from-source binary)
	uses: ./
	with:
	index: examples/data/illumina_toy/reference.idx
	alignments: examples/data/illumina_toy/sorted.bam
	budget-mb: 4096
	binary-path: target/release/rosalind
	output: examples/data/illumina_toy/action.vcf

Navigation Menu

fix: trust on-ramp + hygiene — Action snippet, install checksum, CI, verify (Act-1 PR-C) #73

Workflow file

fix: trust on-ramp + hygiene — Action snippet, install checksum, CI, verify (Act-1 PR-C) #73

Uh oh!

Workflow file for this run