mirror of
https://github.com/safishamsi/graphify.git
synced 2026-10-14 16:09:26 +00:00
Andre Brait
3b3ad322a6
Pi has no PreToolUse hook, so the installed hook-guard policy never ran
there. graphify/pi/ ships a Pi package (Node built-ins only, no
node_modules) that runs `graphify hook-guard read|search` before Pi's
read, grep, find and search-style bash calls: strict-mode denials become
tool_call blocks, and guidance arrives as a graphify system reminder.
Only local targets inside the project are checked, the hook uses the first
`graphify` on PATH outside the project, and every call is bounded and
fails open.
`graphify pi guard install|uninstall` delegates registration to Pi's own
`pi install|remove <dir>`; `graphify pi guard path` prints the package
directory. Oh My Pi reads the same `pi` manifest key, so
`omp plugin install "$(graphify pi guard path)"` loads it there too,
where guidance uses OMP's passive tool-call context channel.
(cherry picked from commit a6281363bb)
130 lines
4.4 KiB
YAML
130 lines
4.4 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: ["v1", "v2", "v3", "v4", "v5", "v6", "v7", "v8", "main"]
|
|
pull_request:
|
|
branches: ["v1", "v2", "v3", "v4", "v5", "v6", "v7", "v8", "main"]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
skillgen-check:
|
|
# Fast lint-style guard: the skill files under graphify/ are generated from
|
|
# the fragments in tools/skillgen/. This fails if someone hand-edited a
|
|
# generated file or forgot to re-run the generator and bless expected/, and it
|
|
# runs the build-time validators that guard per-host coverage, the file_type
|
|
# enum, the monolith round-trips, and the always-on round-trips.
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
# The audit-coverage, monolith-roundtrip, and always-on-roundtrip
|
|
# validators read blobs from origin/v8. A shallow checkout omits that
|
|
# ref, so fetch the full history here and the validators run for real
|
|
# (rather than skipping). The other jobs stay shallow.
|
|
fetch-depth: 0
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@v8.1.0
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
# --frozen keeps uv from re-resolving and rewriting uv.lock as a side
|
|
# effect of `uv run`; the lock is committed and must not churn in CI.
|
|
- name: Check generated skill artifacts are up to date
|
|
run: uv run --frozen python -m tools.skillgen --check
|
|
|
|
- name: Audit per-host v8 coverage
|
|
run: uv run --frozen python -m tools.skillgen --audit-coverage
|
|
|
|
- name: Check the file_type enum is a singleton
|
|
run: uv run --frozen python -m tools.skillgen --schema-singleton
|
|
|
|
- name: Round-trip the monoliths against v8
|
|
run: uv run --frozen python -m tools.skillgen --monolith-roundtrip
|
|
|
|
- name: Round-trip the always-on blocks against v8
|
|
run: uv run --frozen python -m tools.skillgen --always-on-roundtrip
|
|
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
python-version: ["3.10", "3.12", "3.13", "3.14"]
|
|
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
with:
|
|
# test_skillgen.py reads pre-split skill bodies from the immutable
|
|
# baseline commit via `git show`; a shallow checkout omits that history
|
|
# and the baseline tests fail. Full history mirrors the skillgen-check job.
|
|
fetch-depth: 0
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@v8.1.0
|
|
with:
|
|
python-version: ${{ matrix.python-version }}
|
|
|
|
# --frozen installs straight from the committed uv.lock without re-resolving
|
|
# or rewriting it, so CI never churns the lock.
|
|
- name: Install dependencies
|
|
run: uv sync --all-extras --frozen
|
|
|
|
- name: Run tests
|
|
run: uv run --frozen pytest tests/ -q --tb=short
|
|
|
|
- name: Verify install works end-to-end
|
|
run: |
|
|
uv run --frozen graphify --help
|
|
uv run --frozen graphify install
|
|
|
|
pi-guard:
|
|
# tests/pi.test.ts loads the real extension (Node built-ins only, no
|
|
# node_modules, as when installed) against the real installed Python CLI.
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@v8.1.0
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install bun
|
|
uses: oven-sh/setup-bun@v2
|
|
with:
|
|
bun-version: 1.4.0
|
|
|
|
- name: Install dependencies
|
|
run: uv sync --frozen
|
|
|
|
- name: Run Pi guard tests
|
|
run: GRAPHIFY_TEST_CLI=$PWD/.venv/bin/graphify bun test tests/pi.test.ts
|
|
|
|
security-scan:
|
|
# The dev deps include bandit and pip-audit. Run them in CI so a new
|
|
# HIGH-severity finding or vulnerable dependency is caught on the PR that
|
|
# introduces it, rather than at the next manual audit.
|
|
# Non-blocking for now (continue-on-error) to avoid breaking CI on
|
|
# pre-existing findings; remove continue-on-error after the initial
|
|
# cleanup pass.
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v6
|
|
|
|
- name: Install uv
|
|
uses: astral-sh/setup-uv@v8.1.0
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install dependencies
|
|
run: uv sync --frozen
|
|
|
|
- name: bandit (static security analysis)
|
|
continue-on-error: true
|
|
run: uv run --frozen bandit -r graphify -ll
|
|
|
|
- name: pip-audit (dependency vulnerabilities)
|
|
continue-on-error: true
|
|
run: uv run --frozen pip-audit --strict
|