lesscode/.github/workflows/native-core.yml at main · norandom/lesscode · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
name: Native core correctness

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  linux-dagger:
    name: Native core Linux via Dagger
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - name: Run Dagger and export Linux evidence
        uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1
        with:
          version: '0.21.8'
          call: evidence --source . --revision ${{ github.sha }} export --path ${{ runner.temp }}/native-core-evidence
      - name: Enforce Dagger check result
        uses: dagger/dagger-for-github@27b130bf0f79a7f6fbbbe0fbca6760dc9bb40a77 # v8.4.1
        with:
          version: '0.21.8'
          call: check --source . --revision ${{ github.sha }}
      - name: Retain Linux evidence including failures
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: native-core-ubuntu-24.04-${{ github.run_attempt }}
          path: ${{ runner.temp }}/native-core-evidence/
          if-no-files-found: warn
          retention-days: 14
  step-guard:
    # The repository holds itself to its own boundary: a step branch arrives
    # only with an accepted verdict, or an override on the ledger, for exactly
    # the content it has. The guard runs nothing; it reads the commit. A branch
    # that no declaration names, such as main, passes as "not a step branch".
    name: Step guard
    runs-on: ubuntu-24.04
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
          # The guard reads the step's base commit, so the history is needed.
          fetch-depth: 0
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Install pinned Rust
        run: rustup toolchain install 1.98.1 --profile minimal
      - name: Build lesscode-core from this commit
        run: cargo build --locked --bins --manifest-path native/Cargo.toml
      - name: Guard the pushed branch
        env:
          BRANCH: ${{ github.head_ref || github.ref_name }}
        run: native/target/debug/lesscode-core step guard --branch "$BRANCH" --revision HEAD
  native:
    name: Native core ${{ matrix.os }}
    runs-on: ${{ matrix.os }}
    timeout-minutes: 30
    strategy:
      fail-fast: false
      matrix:
        os: [windows-2025, macos-15, macos-15-intel, ubuntu-24.04-arm]
    defaults:
      run:
        shell: bash
    steps:
      - name: Initialize runner evidence
        run: |
          mkdir -p "$RUNNER_TEMP/native-core-evidence"
          printf '%s\n' "$RUNNER_OS/$RUNNER_ARCH" > "$RUNNER_TEMP/native-core-evidence/runner.txt"
          printf '%s\n' "$GITHUB_SHA" > "$RUNNER_TEMP/native-core-evidence/source-revision.txt"
      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
        with:
          persist-credentials: false
      - name: Install pinned Rust and development components
        id: toolchain
        run: |
          set +e
          rustup toolchain install 1.98.1 --profile minimal --component rustfmt --component clippy 2>&1 | tee "$RUNNER_TEMP/native-core-evidence/toolchain.log"
          status=${PIPESTATUS[0]}
          printf '%s\n' "$status" > "$RUNNER_TEMP/native-core-evidence/toolchain.exit-code"
          exit "$status"
      - name: Install pinned native test runner
        run: bash tools/install_nextest.sh
      - name: Check native correctness with locked dependencies
        id: checks
        run: bash tools/check_native.sh "$RUNNER_TEMP/native-core-evidence"
      - name: Record platform outcome
        if: always()
        env:
          TOOLCHAIN_OUTCOME: ${{ steps.toolchain.outcome }}
          CHECKS_OUTCOME: ${{ steps.checks.outcome }}
        run: |
          mkdir -p "$RUNNER_TEMP/native-core-evidence"
          {
            printf 'Runner: %s/%s\n' "$RUNNER_OS" "$RUNNER_ARCH"
            printf 'Source: %s\n' "$GITHUB_SHA"
            printf 'Toolchain: %s\nChecks: %s\n' "$TOOLCHAIN_OUTCOME" "$CHECKS_OUTCOME"
            printf '%s\n' 'A failed, cancelled, or skipped check is not passing platform evidence.'
          } | tee "$RUNNER_TEMP/native-core-evidence/outcome.txt" >> "$GITHUB_STEP_SUMMARY"
      - name: Retain raw results including failures
        if: always()
        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
        with:
          name: native-core-${{ matrix.os }}-${{ github.run_attempt }}
          path: ${{ runner.temp }}/native-core-evidence/
          if-no-files-found: warn
          retention-days: 14