Merge pull request #958 from makenotion/worktree/lucky-harbor-6b64 #2129
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| # Fork-safety contract: every step in this workflow MUST run on a public-fork | |
| # PR with no repo secrets, no Notion token, and no internal-only fixtures. | |
| # Before adding a step, read docs/ci.md and confirm it satisfies all seven | |
| # rules in "Rules for new CI steps". Steps that need internal state belong | |
| # in a *separate workflow* that does NOT run on `pull_request` (a bare | |
| # `github.repository == 'makenotion/lore'` check is NOT fork-safe when the | |
| # workflow runs on `pull_request` — see docs/ci.md "Adding internal-state | |
| # workflows" for the safe shapes). | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Least-privilege ambient GITHUB_TOKEN: read-only for the entire workflow. | |
| # Repo-default permissions are policy-dependent; pinning at the workflow | |
| # level guarantees a fork-PR run cannot widen them. Tighten further at the | |
| # job level if a future job needs even less. | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| workflow-lint: | |
| name: Workflow lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install actionlint | |
| env: | |
| ACTIONLINT_SHA256: 8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8 | |
| ACTIONLINT_VERSION: 1.7.12 | |
| run: | | |
| install_dir="$RUNNER_TEMP/workflow-lint-bin" | |
| mkdir -p "$install_dir" | |
| curl -fsSLo actionlint.tar.gz "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" | |
| echo "${ACTIONLINT_SHA256} actionlint.tar.gz" | sha256sum -c - | |
| tar -xzf actionlint.tar.gz -C "$install_dir" actionlint | |
| chmod +x "$install_dir/actionlint" | |
| echo "$install_dir" >> "$GITHUB_PATH" | |
| - name: Run actionlint | |
| run: actionlint .github/workflows/*.yml | |
| - name: Install zizmor | |
| env: | |
| ZIZMOR_SHA256: a16853f39c9e059aed04f3f7961acb75468af67b235ae36a9faff337d61e3d24 | |
| ZIZMOR_VERSION: 1.25.0 | |
| run: | | |
| install_dir="$RUNNER_TEMP/workflow-lint-bin" | |
| mkdir -p "$install_dir" | |
| curl -fsSLo zizmor.tar.gz "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz" | |
| echo "${ZIZMOR_SHA256} zizmor.tar.gz" | sha256sum -c - | |
| tar -xzf zizmor.tar.gz -C "$install_dir" zizmor | |
| chmod +x "$install_dir/zizmor" | |
| echo "$install_dir" >> "$GITHUB_PATH" | |
| - name: Run zizmor | |
| run: zizmor --min-severity medium --format github --no-progress .github/workflows | |
| ci: | |
| name: Format, lint, typecheck, test | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| persist-credentials: false | |
| - name: Setup Node.js | |
| uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0 | |
| with: | |
| node-version: 20 | |
| cache: npm | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Format check | |
| run: npm run format:check | |
| - name: Version sync check | |
| run: npm run version:check | |
| - name: Lint | |
| run: npm run lint | |
| - name: Typecheck | |
| run: npm run typecheck | |
| - name: Test | |
| run: npm test | |
| - name: Build | |
| run: npm run build | |
| - name: Eval starter suite | |
| run: node dist/cli.js eval run evals/suites/lore-core.yaml --out evals/results/lore-core-ci.json --min-lift 0.5 --max-harm 0.0 --baseline evals/baselines/lore-core.json | |
| - name: Upload eval artifact | |
| if: ${{ always() && hashFiles('evals/results/lore-core-ci.json') != '' }} | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: lore-core-eval-result | |
| path: evals/results/lore-core-ci.json |