claude-code-sdlc/.github/workflows/ci.yml at master · splashthree/claude-code-sdlc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
name: CI

# The plugin's own rail — the same checks RELEASING.md requires before any release.
#
#   test        — full pytest suite, incl. the golden-repo compose test (real payload +
#                 flagship profile, snapshot-asserted tree) and the payload<->install-map
#                 completeness tripwire. BLOCKS.
#   test-windows — the same suite on windows-latest. The plugin is authored on Windows and
#                 ships PowerShell hooks, so Linux-only CI cannot see console-encoding or
#                 line-ending faults. BLOCKS.
#   sync-check  — harness/ is GENERATED from delivery-standard/kit and must never drift.
#                 BLOCKS. A red here means the kit's main moved without a plugin sync.
#   actionlint  — lints the workflows the harness EMITS, composed and token-stubbed the
#                 way a real repo would run them. BLOCKS (verified clean at adoption).

on:
  push:
    branches: [ master ]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  test:
    name: pytest (suite + golden repo)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v8.3.2
      - run: uv run --project scripts pytest scripts/tests -q

  # The plugin is developed on Windows but CI ran only on Linux, so two Windows-only defects
  # reached master unseen: a cp1252 console fault (fixed in 1.3.0) and a CRLF test fixture.
  # A separate job rather than a matrix on `test`, so the existing check name is unchanged.
  # The runner's default CRLF checkout is deliberate — it mirrors the dev machine this is
  # meant to protect; the suite must pass with either line-ending style.
  test-windows:
    name: pytest (Windows)
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v8.3.2
      - run: uv run --project scripts pytest scripts/tests -q

  sync-check:
    name: harness == kit (generated-copy invariant)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      # The kit source of truth (public repo, no token needed).
      - uses: actions/checkout@v7
        with:
          repository: MCKRUZ/intent-driven-development
          ref: main
          path: kit-source
      - uses: astral-sh/setup-uv@v8.3.2
      # harness/ is generated — never hand-edited. If this is red, the kit's main branch
      # moved without a plugin sync. Fix locally:
      #   uv run --project scripts scripts/sync_kit.py --kit <delivery-standard>/kit
      # then commit the regenerated payload (chore: sync harness payload ...).
      - run: uv run --project scripts scripts/sync_kit.py --kit kit-source/kit --check

  actionlint:
    name: actionlint (emitted workflows)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: astral-sh/setup-uv@v8.3.2
      - name: Compose the flagship install
        run: |
          uv run --project scripts scripts/install_harness.py \
            --payload harness --target /tmp/golden-repo \
            --profile profiles/microsoft-enterprise/profile.yaml
      - name: Stub adaptation tokens
        # The emitted reference workflows carry <<TOKENS>> that a repo fills during
        # Phase-3 adaptation; stub them so actionlint sees the post-adaptation shape.
        run: sed -i -E 's/<<[^>]+>>/STUB/g; s/<PLACEHOLDER>/STUB/g' /tmp/golden-repo/.github/workflows/*.yml
      - name: Lint emitted workflows
        # Pinned + checksum-verified (the standard's supply-chain rule). shellcheck is
        # disabled: the run: bodies are stack-templated references, not final shell.
        run: |
          set -euo pipefail
          curl -fsSL -o actionlint.tar.gz \
            https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz
          echo "8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8  actionlint.tar.gz" | sha256sum -c -
          tar -xzf actionlint.tar.gz actionlint
          ./actionlint -shellcheck= /tmp/golden-repo/.github/workflows/*.yml