Repository navigation
ci(site): hosted previews for site and spec pull requests #559
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # zkp-10.1: detached guest compilation and genuine local proofs. | |
| name: zk-exact-evaluator | |
| on: | |
| workflow_dispatch: | |
| pull_request: | |
| types: [opened, synchronize, reopened, ready_for_review] | |
| merge_group: | |
| types: [checks_requested] | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: zk-exact-evaluator-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_BUILD_JOBS: 2 | |
| # Share the guest cache across host test and Clippy build-script variants. | |
| CARGO_TARGET_DIR: ${{ github.workspace }}/zk/sparql-evaluator/target | |
| RISC0_BUILD_LOCKED: 1 | |
| jobs: | |
| exact-evaluator: | |
| name: real exact-dataset guest and proof | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 120 | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| # Two commits: a pull_request checkout is GitHub's test merge, whose | |
| # first parent is the base tip it merged into. | |
| fetch-depth: 2 | |
| - name: Resolve pull request merge parent | |
| id: merge_parent | |
| if: github.event_name == 'pull_request' | |
| # Diff the test merge against its first parent: exactly the PR's change on | |
| # the current base. The stale base.sha diff also counted every base commit | |
| # the head lacked. Anything but a two-parent merge at github.sha leaves this | |
| # empty, so classification falls back to base.sha (still fail closed). | |
| env: | |
| MERGE_SHA: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| parents=$(git rev-list --parents -n 1 HEAD) | |
| read -r commit first second extra <<< "$parents" || true | |
| if [ "$commit" = "$MERGE_SHA" ] && [ -n "${second:-}" ] && [ -z "${extra:-}" ]; then | |
| echo "sha=$first" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Classify exact-evaluator inputs (fail closed) | |
| id: changes | |
| env: | |
| EXACT_BASE_SHA: ${{ steps.merge_parent.outputs.sha || github.event.pull_request.base.sha || github.event.merge_group.base_sha || github.event.before }} | |
| EXACT_HEAD_SHA: ${{ steps.merge_parent.outputs.sha && github.sha || github.event.pull_request.head.sha || github.event.merge_group.head_sha || github.sha }} | |
| run: python3 scripts/ci_exact_evaluator_paths.py | |
| - name: Require explicit classification output | |
| env: | |
| EXECUTION_REQUIRED: ${{ steps.changes.outputs.required }} | |
| run: | | |
| case "$EXECUTION_REQUIRED" in | |
| true|false) ;; | |
| *) echo "Missing or invalid exact-evaluator classification" >&2; exit 1 ;; | |
| esac | |
| - name: Successful irrelevant-diff classification | |
| if: steps.changes.outputs.required == 'false' | |
| run: echo "No exact-evaluator inputs changed; the mandatory check remains successful." | |
| - name: Install checksum-pinned RISC Zero binaries and guest Rust | |
| if: steps.changes.outputs.required == 'true' | |
| # Official release-asset SHA256 digests, pinned with the exact SDK version. | |
| run: | | |
| set -euo pipefail | |
| tool_root="$RUNNER_TEMP/sparq-risc0-3.0.6" | |
| mkdir -p "$tool_root/bin" "$tool_root/home/toolchains/v1.97.0-rust-x86_64-unknown-linux-gnu" | |
| curl --fail --location --retry 3 https://github.com/risc0/risc0/releases/download/v3.0.6/cargo-risczero-x86_64-unknown-linux-gnu.tgz -o "$tool_root/cli.tgz" | |
| curl --fail --location --retry 3 https://github.com/risc0/rust/releases/download/r0.1.97.0/rust-toolchain-x86_64-unknown-linux-gnu.tar.gz -o "$tool_root/rust.tar.gz" | |
| echo "615d961bfb81d318db5071d7548389c850e324ac7f421c075176daf26082a60a $tool_root/cli.tgz" | sha256sum --check --strict | |
| echo "100b597d605b706bec94e1d32bfaaf5851df8d75173f986d4b56a3e90916be53 $tool_root/rust.tar.gz" | sha256sum --check --strict | |
| tar -xzf "$tool_root/cli.tgz" -C "$tool_root/bin" | |
| tar -xzf "$tool_root/rust.tar.gz" -C "$tool_root/home/toolchains/v1.97.0-rust-x86_64-unknown-linux-gnu" | |
| printf '[default_versions]\nrust = "1.97.0"\n' > "$tool_root/home/settings.toml" | |
| "$tool_root/bin/r0vm" --version | |
| echo "$tool_root/bin" >> "$GITHUB_PATH" | |
| echo "RISC0_HOME=$tool_root/home" >> "$GITHUB_ENV" | |
| echo "RISC0_SERVER_PATH=$tool_root/bin/r0vm" >> "$GITHUB_ENV" | |
| - name: Activate pinned host Rust | |
| if: steps.changes.outputs.required == 'true' | |
| run: | | |
| rustup show active-toolchain | |
| rustup component add clippy | |
| - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 | |
| if: steps.changes.outputs.required == 'true' | |
| with: | |
| key: zk-exact-evaluator-risc0-3.0.6-rust-1.97.0 | |
| workspaces: zk/sparql-evaluator | |
| save-if: ${{ github.ref == 'refs/heads/main' }} | |
| - name: Evidence export guard regressions | |
| if: steps.changes.outputs.required == 'true' | |
| run: | | |
| python3 -m unittest discover -s scripts/tests -p 'test_ci_exact_evaluator_*.py' | |
| python3 -m unittest discover -s bench/zk-bindings -p 'test_*.py' | |
| - name: Exact experiment native contract and rejection-class regressions | |
| if: steps.changes.outputs.required == 'true' | |
| # Native fixture/adapter tests; this step generates no receipt. | |
| run: cargo test --locked --manifest-path zk/sparql-evaluator/Cargo.toml -p sparq-proved-evaluator --example exact_experiment | |
| - name: Export source-bound actual guest and genuine proof evidence | |
| if: steps.changes.outputs.required == 'true' | |
| # Executes native regressions, every real guest/proof test, and Clippy. | |
| # Local path packages are rebuilt; the same exported program must verify | |
| # every persisted synthetic receipt. Missing provenance fails the job. | |
| run: python3 scripts/ci_exact_evaluator_evidence.py --output "$RUNNER_TEMP/sparq-exact-evidence" | |
| - name: Required original-fixture typed replay for all evaluator versions | |
| if: steps.changes.outputs.required == 'true' | |
| timeout-minutes: 15 | |
| # Every declared original case and both authority contexts must execute. | |
| # This native lane counts zero proofs; the real campaign above remains required. | |
| run: python3 bench/zk-bindings/exact_ci.py --output "$RUNNER_TEMP/sparq-exact-originals" | |
| - name: Upload exact artifact and campaign evidence | |
| if: always() && steps.changes.outputs.required == 'true' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: exact-evaluator-${{ github.sha }}-${{ github.run_attempt }} | |
| path: | | |
| ${{ runner.temp }}/sparq-exact-evidence | |
| ${{ runner.temp }}/sparq-exact-originals | |
| if-no-files-found: error | |
| retention-days: 30 |