ci.yml

name: CI

# OwnAudit is pure-Python tooling (the .NET/WPF audit of STS runs on a Windows
# stand, not here), so CI runs the build-free test suites + a smoke of the SARIF
# export and dashboard build. No analyzers, no .NET — fast and deterministic.

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: test suites (bare python3)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"

      - name: fix-arm + report suites
        run: |
          set -euo pipefail
          PYTHONPATH=fix python3 fix/tests/test_ai_fix.py
          PYTHONPATH=fix python3 fix/tests/test_own_fix.py
          PYTHONPATH=fix python3 fix/tests/test_orchestrate.py
          PYTHONPATH=.   python3 identity/tests/test_pattern.py
          PYTHONPATH=.   python3 identity/tests/test_occurrence.py
          PYTHONPATH=.   python3 identity/tests/test_lineage_contract.py
          PYTHONUTF8=1 PYTHONPATH=. python3 identity/tests/test_lineage_decision.py
          PYTHONPATH=.   python3 aggregate/tests/test_normalize.py
          PYTHONPATH=.   python3 report/tests/test_sarif.py
          PYTHONPATH=.   python3 report/tests/test_baseline.py
          PYTHONPATH=.   python3 report/tests/test_rules_map.py
          PYTHONPATH=.   python3 report/tests/test_annotate.py
          PYTHONPATH=.   python3 report/tests/test_exec.py
          PYTHONPATH=.   python3 viz/tests/test_dashboard_rules.py
          PYTHONPATH=.   python3 arch/tests/test_arch.py
          PYTHONPATH=.   python3 oracle/fixtures/test_oracle_arch.py
          PYTHONPATH=.   python3 oracle/fixtures/test_oracle_runtime.py
          PYTHONPATH=.   python3 runtime/tests/test_runtime.py
          PYTHONPATH=.   python3 runtime/tests/test_member_aware.py
          PYTHONPATH=.   python3 leakmine/tests/test_leakmine.py

      - name: re-run under -O (assert-stripping safety)
        run: |
          set -euo pipefail
          PYTHONPATH=fix python3 -O fix/tests/test_ai_fix.py
          PYTHONPATH=fix python3 -O fix/tests/test_own_fix.py
          PYTHONPATH=fix python3 -O fix/tests/test_orchestrate.py
          PYTHONPATH=.   python3 -O identity/tests/test_pattern.py
          PYTHONPATH=.   python3 -O identity/tests/test_occurrence.py
          PYTHONPATH=.   python3 -O identity/tests/test_lineage_contract.py
          PYTHONUTF8=1 PYTHONPATH=. python3 -O identity/tests/test_lineage_decision.py
          PYTHONPATH=.   python3 -O aggregate/tests/test_normalize.py
          PYTHONPATH=.   python3 -O report/tests/test_sarif.py
          PYTHONPATH=.   python3 -O report/tests/test_baseline.py
          PYTHONPATH=.   python3 -O report/tests/test_rules_map.py
          PYTHONPATH=.   python3 -O report/tests/test_annotate.py
          PYTHONPATH=.   python3 -O report/tests/test_exec.py
          PYTHONPATH=.   python3 -O viz/tests/test_dashboard_rules.py
          PYTHONPATH=.   python3 -O arch/tests/test_arch.py
          PYTHONPATH=.   python3 -O oracle/fixtures/test_oracle_arch.py
          PYTHONPATH=.   python3 -O oracle/fixtures/test_oracle_runtime.py
          PYTHONPATH=.   python3 -O runtime/tests/test_runtime.py
          PYTHONPATH=.   python3 -O runtime/tests/test_member_aware.py
          PYTHONPATH=.   python3 -O leakmine/tests/test_leakmine.py

  linetol-policy:
    # OwnAudit#59. Run-Audit.ps1 itself cannot run in CI — it wants a worktree, a
    # build and a Windows stand — so the clustering-tolerance decision lives in a
    # pure function (scripts/LineTolPolicy.ps1) that can. The issue is explicit
    # that this must not be accepted by reading the code, hence a real interpreter
    # on a real Windows runner.
    #
    # Both shells on Windows: the script's own examples invoke `pwsh`, but a stand
    # that still has only Windows PowerShell 5.1 must not silently get different
    # tolerances. Ubuntu covers the pwsh-on-Linux path a contributor is likely to
    # use locally.
    name: line-tol policy matrix (${{ matrix.os }} / pwsh)
    strategy:
      fail-fast: false
      matrix:
        os: [windows-latest, ubuntu-latest]
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - name: Resolve-LineTol decision matrix
        shell: pwsh
        run: ./scripts/tests/Test-LineTolPolicy.ps1

  linetol-policy-ps51:
    # Split out rather than folded into the matrix above: `shell:` accepts no
    # expression, so `${{ matrix.shell }}` is rejected by the workflow schema.
    # Launching the interpreter by hand from bash would sidestep that, but GitHub
    # sets $ErrorActionPreference and the invocation form per shell, and a fidelity
    # test should run under the shell it claims to cover, not near it.
    name: line-tol policy matrix (windows-latest / Windows PowerShell 5.1)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - name: Resolve-LineTol decision matrix
        shell: powershell
        run: ./scripts/tests/Test-LineTolPolicy.ps1

  runner-shell-contract:
    # OwnAudit#64. The runners are pwsh-only; the contract is that Windows
    # PowerShell 5.1 can still READ them and refuse them for a true reason,
    # instead of dying on a syntax error inside a word in a comment. Windows only:
    # the defect is Windows 5.1 decoding a BOM-less file in the system ANSI
    # codepage, and no Linux runner reproduces it.
    name: runner shell contract (windows-latest / pwsh)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - name: ASCII, #Requires, and parse under pwsh
        shell: pwsh
        run: ./scripts/tests/Test-RunnerShellContract.ps1

  runner-shell-contract-ps51:
    # The leg that actually covers the defect. Split out for the same reason as
    # linetol-policy-ps51: `shell:` accepts no expression, so a matrix cannot
    # carry it. Here the suite invokes each runner for real and asserts the
    # refusal names the version and leaves no -Out directory behind.
    name: runner shell contract (windows-latest / Windows PowerShell 5.1)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - name: 5.1 reads the runners and refuses them by version
        shell: powershell
        run: ./scripts/tests/Test-RunnerShellContract.ps1

  audit-report:
    name: SARIF export + dashboard smoke
    runs-on: ubuntu-latest
    needs: test
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false
      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"

      # GitHub-friendly SARIF (warning+), plus metrics.json / report.md.
      # Runs against the committed synthetic fixture, not the stand-only sts_audit
      # corpus, so CI stays green (and leaks nothing) once sts_audit is removed.
      - name: Export audit artifacts
        run: PYTHONPATH=. python3 -m report.cli --min-level warning --findings viz/fixtures/findings.json

      # Catches Python/JS-template regressions in the dashboards (no unit tests there).
      # Points at viz/fixtures (synthetic golden set) for the same reason as above.
      # The arch dashboard renders empty-state here (graph.json/runtime.json are stand-only).
      - name: Build dashboards (smoke)
        run: |
          set -euo pipefail
          # raw path: renders straight from findings.json
          python3 viz/build_dashboard.py viz/fixtures
          # FP-judge triaged path: merge the overlay (also exercises apply_verdicts'
          # staleness guard + merge), then re-render — build_dashboard auto-prefers the
          # freshly written findings-triaged.json and renders the triage view.
          python3 viz/apply_verdicts.py --findings viz/fixtures/findings.json \
            --overlay viz/fixtures/fp-verdicts.json --out viz/fixtures/findings-triaged.json
          python3 viz/build_dashboard.py viz/fixtures
          python3 viz/build_arch_dashboard.py

      - name: Upload artifacts
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: ownnet-audit
          path: report/out/
          if-no-files-found: error

      # To surface findings in the Security tab when running against the STS repo
      # itself, drop the cap (export the full set) and upload to code scanning:
      #   permissions: { security-events: write }
      #   - run: PYTHONPATH=. python3 -m report.cli --max-results 0
      #   - uses: github/codeql-action/upload-sarif@v3
      #     with: { sarif_file: report/out/ownnet-audit.sarif }
      # (Skipped here: findings.json paths point at the external STS tree, not OwnAudit.)