61 lines
2.0 KiB
YAML
61 lines
2.0 KiB
YAML
name: Verify Protocol
|
|
|
|
on:
|
|
push:
|
|
pull_request:
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: protocol-${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
module:
|
|
# This Linux job proves that private Gitea consumers can resolve the
|
|
# module identity and build the tagged Go package without a filesystem
|
|
# replacement. The full cross-language verifier remains macOS-bound.
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 10
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
|
|
with:
|
|
go-version: "1.26.5"
|
|
cache: true
|
|
cache-dependency-path: go.mod
|
|
- name: Verify private module identity and Go packages
|
|
shell: bash
|
|
run: |
|
|
test "$(go list -m -f '{{.Path}}')" = 'git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol'
|
|
if grep -Eq '^[[:space:]]*replace[[:space:]]' go.mod; then
|
|
echo 'Protocol module must not use a replace directive' >&2
|
|
exit 1
|
|
fi
|
|
go mod verify
|
|
go build ./...
|
|
go test ./... -count=1
|
|
|
|
verify:
|
|
# The Phase 3A full verifier includes Swift type-checking. The owner must
|
|
# provide a macOS runner with the pinned toolchain from the handoff.
|
|
runs-on: macos-26
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
|
|
- name: Assert pinned toolchain
|
|
shell: bash
|
|
run: |
|
|
python3 --version
|
|
go version | grep -F 'go1.26.5 '
|
|
protoc --version | grep -F 'libprotoc 35.1'
|
|
buf --version | grep -F '1.72.0'
|
|
rustc --version | grep -F '1.97.1'
|
|
swift --version | grep -F 'Swift version 6.3.3'
|
|
- name: Verify generation, breaking policy, scope, and conformance
|
|
run: make verify
|
|
- name: Verify clean regeneration
|
|
run: git diff --exit-code
|