ci: fix unresolvable setup-python pin - #2
Merged
Conversation
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
kingztech2019
added a commit
to kingztech2019/integrations
that referenced
this pull request
Jul 8, 2026
…(PR agentrust-io#11) Blocking agentrust-io#1 — Remove schema/trace-claim.json from repo root. Per CONTRIBUTING.md, the TRACE schema lives in trace-spec upstream and must not be added to this repo. Moves the file to integrations/comply54/tests/fixtures/trace-claim.json where it is a local regression fixture, not a canonical schema claim. SCHEMA_PATH updated accordingly. Blocking agentrust-io#2 — Back the Level 0 conformance claim with agentrust-trace-tests. Adds TestLevel0Conformance (4 tests) that run trace_tests.runner.run() from agentrust-trace-tests 0.1.0 against allow/deny/escalate/audit payloads with cnf.jwk populated. All four Level 0 modules (TR-ENV, TR-SIG, TR-POL) pass with no FAIL findings. TR-SIG correctly reports UNVERIFIED (not FAIL) for plain trace records at Level 0. agentrust-trace-tests replaces jsonschema in requirements.txt (jsonschema remains available transitively and for schema regression tests — install with: pip install -r requirements.txt jsonschema pytest). Total tests: 30 (was 26). README and test count updated. Signed-off-by: oluwajuwon omotayo <ginuxtechacademy@gmail.com>
imran-siddique
pushed a commit
that referenced
this pull request
Jul 25, 2026
…ory compliance) (#11) * feat: add comply54 → TRACE v0.1 integration (Level 0) Adds a comply54 integration that converts a ComplianceResult from the comply54 African regulatory compliance library into a signed TRACE v0.1 JWT (Ed25519, Level 0 software-only conformance). What's included: - integration.yaml — schema-validated manifest - src/comply54_to_trace.py — adapter: ComplianceResult JSON → TRACE JWT - tests/test_comply54_to_trace.py — 20 passing tests covering appraisal mapping, envelope fields, comply54 extension claims, and JWT signing - requirements.txt — PyJWT + cryptography - README.md — usage, conformance table, limitations Decision mapping: allow → affirming | audit → advisory | escalate → warning | deny → contraindicated Policy bundle hash: SHA-256 of sorted comply54 pack IDs (reproducible). Conforms to TRACE v0.1 at Level 0. Hardware fields are placeholders. Signed-off-by: oluwajuwon omotayo <oluwajuwon.omotayo@ginuxai.com> Signed-off-by: oluwajuwon omotayo <ginuxtechacademy@gmail.com> * chore: remove pycache from comply54 integration Signed-off-by: oluwajuwon omotayo <oluwajuwon.omotayo@ginuxai.com> Signed-off-by: oluwajuwon omotayo <ginuxtechacademy@gmail.com> * docs(comply54): fix test setup command to include adapter requirements Per carloshvp review: `pip install pytest` alone misses PyJWT and cryptography. Now uses `pip install -r requirements.txt pytest` so a clean environment has all dependencies before running the 20 tests. * fix(comply54): address CHANGES_REQUESTED from imran-siddique (PR #11) - Fix blocker: map comply54 `audit` to TRACE `warning` (was `advisory`, which is not in the appraisal.status enum) - Add AUDIT_RESULT fixture and test_audit_maps_to_warning to cover the previously untested audit path - Add schema/trace-claim.json — TRACE v0.1 core JSON Schema with appraisal.status enum and additionalProperties:false at root - Add TestSchemaConformance (5 tests) — validates all four outcome payloads against trace-claim.json; documents that the comply54 extension claim is stripped before core-schema validation (RFC 7519 §4.3 private-claim profile) - Add jsonschema>=4.21.0 to requirements.txt - Update README: fix mapping table, add audit->warning rationale, add Extension-claim profile section, update test count to 26 - Fix maintainer.email in integration.yaml 26 passed (was 20) * fix(comply54): address two blocking items from imran-siddique review (PR #11) Blocking #1 — Remove schema/trace-claim.json from repo root. Per CONTRIBUTING.md, the TRACE schema lives in trace-spec upstream and must not be added to this repo. Moves the file to integrations/comply54/tests/fixtures/trace-claim.json where it is a local regression fixture, not a canonical schema claim. SCHEMA_PATH updated accordingly. Blocking #2 — Back the Level 0 conformance claim with agentrust-trace-tests. Adds TestLevel0Conformance (4 tests) that run trace_tests.runner.run() from agentrust-trace-tests 0.1.0 against allow/deny/escalate/audit payloads with cnf.jwk populated. All four Level 0 modules (TR-ENV, TR-SIG, TR-POL) pass with no FAIL findings. TR-SIG correctly reports UNVERIFIED (not FAIL) for plain trace records at Level 0. agentrust-trace-tests replaces jsonschema in requirements.txt (jsonschema remains available transitively and for schema regression tests — install with: pip install -r requirements.txt jsonschema pytest). Total tests: 30 (was 26). README and test count updated. Signed-off-by: oluwajuwon omotayo <ginuxtechacademy@gmail.com> * fix(comply54): address all TRACE conformance issues from review Four root-cause fixes: 1. comply54_to_trace_payload() was missing cnf — the function now accepts an optional key= parameter (defaults to load_or_generate_key()) and always includes cnf.jwk in the returned payload. Previously cnf was added post-hoc in main(), so every non-CLI caller produced a cnf-less payload that failed the canonical schema. 2. Digest placeholders were "sha256:not-attested" — invalid per the canonical pattern ^sha(256:[0-9a-f]{64}|384:[0-9a-f]{96})$. Changed model.weights_digest and build_provenance.digest to "sha256:" + "0"*64 (all-zeros, the correct Level 0 not-attested placeholder). 3. Local fixture schema (tests/fixtures/trace-claim.json) was too weak: - cnf missing from top-level required array - required: ["jwk"] missing inside cnf object (so cnf:{} would pass) - no digest pattern on weights_digest or build_provenance.digest All three gaps now match the canonical schema constraints. 4. integration.yaml tested_against.agentrust-trace was "0.2.0"; corrected to "0.1.0" (the released version used). Additional fixes: - Add test_signature_is_cryptographically_verified: decodes the JWT using the actual Ed25519 public key (not verify_signature:False), proving the signing/verification cycle is valid end-to-end. - Add requirements-dev.txt (jsonschema>=4.0.0, pytest>=7.0.0) to declare test-only dependencies explicitly rather than relying on jsonschema being a transitive dep of agentrust-trace-tests. - README: remove "not-attested" description; update test count to 31; update test install command to use requirements-dev.txt. 31 tests pass (27 unit/schema + 4 agentrust-trace-tests Level 0). Signed-off-by: oluwajuwon omotayo <ginuxtechacademy@gmail.com> --------- Signed-off-by: oluwajuwon omotayo <oluwajuwon.omotayo@ginuxai.com> Signed-off-by: oluwajuwon omotayo <ginuxtechacademy@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The validate workflow pinned actions/setup-python to a SHA that does not exist (copied from an inaccurate report), so validate has been red since the initial commit. Repinned to the verified v6.2.0 release SHA.
Generated with Claude Code