Skip to content

Commit a19fca4

Browse files
frawarefraware
authored
Merge pull request #21 from SentinelOps-CI/feat/swebench-gate-vm-bundle
Feat/swebench gate vm bundle
2 parents 819cacc + 3350550 commit a19fca4

60,149 files changed

Lines changed: 37524 additions & 6775417 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.devcontainer/devcontainer.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"name": "Provability Fabric",
3+
"image": "mcr.microsoft.com/devcontainers/base:jammy",
4+
"features": {
5+
"ghcr.io/devcontainers/features/rust:1": {
6+
"profile": "default"
7+
},
8+
"ghcr.io/devcontainers/features/go:1": {
9+
"version": "1.23"
10+
},
11+
"ghcr.io/devcontainers/features/node:1": {
12+
"version": "20"
13+
},
14+
"ghcr.io/devcontainers/features/python:1": {
15+
"version": "3.11"
16+
}
17+
},
18+
"customizations": {
19+
"vscode": {
20+
"extensions": [
21+
"rust-lang.rust-analyzer",
22+
"golang.go",
23+
"leanprover.lean4"
24+
]
25+
}
26+
},
27+
"postCreateCommand": "curl -fsSL https://raw.githubusercontent.com/leanprover/elan/v4.2.1/elan-init.sh | sh -s -- -y --default-toolchain none",
28+
"remoteUser": "vscode"
29+
}

‎.env.example‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Provability-Fabric: example environment variables for fork maintainers and deployment
2+
# Copy to .env and adjust. Not required for CLI-only (minimal) usage.
3+
# See docs/reference/configuration.md and docs/guides/reuse-and-extend.md
4+
5+
# ---------- Branding / tenant ----------
6+
# Tenant or org identifier used by platform services and middleware
7+
# TENANT_ID=demo-tenant
8+
9+
# ---------- API / service base URLs ----------
10+
# Used by api-gateway and services when calling each other (e.g. in Docker or production)
11+
# SPEC_SERVICE_URL=http://spec-service:8001
12+
# PROOF_SERVICE_URL=http://proof-service:8002
13+
# BUILD_SERVICE_URL=http://build-orchestrator:8003
14+
# EVIDENCE_SERVICE_URL=http://evidence-service:8004
15+
# REPLAY_SERVICE_URL=http://replay-service:8005
16+
# RUNTIME_SERVICE_URL=http://runtime-sidecar:8006
17+
18+
# ---------- Data stores ----------
19+
# DATABASE_URL=postgres://user:password@host:5432/dbname
20+
# REDIS_URL=redis://host:6379
21+
22+
# ---------- Feature flags ----------
23+
# Opt-in telemetry at API gateway (default: unset or false = disabled)
24+
# TELEMETRY_DEFAULT_ENABLED=false
25+
26+
# ---------- CERT / bundle hashes (middleware, sidecar) ----------
27+
# Set by build or deployment; middleware reads these for CERT payloads
28+
# CERT_POLICY_HASH=
29+
# CERT_PROOF_HASH=
30+
# CERT_AUTOMATA_HASH=
31+
# CERT_LABELER_HASH=

‎.flake8‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
[flake8]
2+
max-line-length = 120
3+
extend-ignore = E501, E128, E203, E712, E722, W291, W293, W391, F401, F841, F541
4+
exclude = .git,__pycache__,.lake,build,dist,node_modules

‎.gitattributes‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,10 @@
11
# Normalize line endings
22
* text=auto eol=lf
33

4+
# WSL/bash and shebang scripts must stay LF (avoid "python3\r" from CRLF)
5+
experiments/scripts/*.py text eol=lf
6+
experiments/scripts/*.sh text eol=lf
7+
48
# Treat binaries correctly
59
*.png binary
610
*.jpg binary

‎.github/WORKFLOWS.md‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# GitHub Actions workflow map
2+
3+
High-level grouping of files under `.github/workflows/`. Open each file for exact `on:` triggers.
4+
5+
## Core CI
6+
7+
- **ci.yml** — Main PR/push CI: Buf lint, path filter, reusable prepare / Lean / Rust / Go-Node / extended.
8+
- **ci-weekly-full.yml** — Scheduled full matrix plus Buf (catches drift when PRs used doc-only skips).
9+
- **ci-nightly-pytest.yml** — Nightly Python/integration/red-team sweep.
10+
- **reusable-ci-prepare.yml** — Gates, impacted selection, DSSE fixture test.
11+
- **reusable-ci-lean.yml** — Elan + `lean-toolchain`, Lake builds, Lean gates, proofbench.
12+
- **reusable-ci-rust.yml** — `cargo build` / `test` / `clippy` workspace and sidecar lib tests.
13+
- **reusable-ci-go-node.yml** — Spectral, Go CLI/admission, ledger/SDK tests, console/demo builds, `services/*` Go build.
14+
- **reusable-ci-extended.yml** — Red-team, k6 smoke, integration pytest, optional cosign on push.
15+
16+
## Security and compliance
17+
18+
codeql.yaml, scorecards.yml (OpenSSF Scorecard), sbom-diff.yaml, release-sbom.yml (CycloneDX on GitHub Release), **dependency-review.yml** (vulnerable deps + license policy on PRs), **cargo-deny.yml** (Rust licenses / advisories / `deny.toml`), **actionlint.yml** (workflow YAML static checks), wasm-scan.yaml, proto-compat.yaml, compliance.yaml, privacy-test.yaml, operational-excellence.yaml, redteam.yaml, trust-fire-ga-test.yaml, jwks-validate.yml, cert-validate.yml, platform-cert-validate.yml, revocation-sync.yaml, allowlist-sync.yaml.
19+
20+
## Lean, proofs, policy
21+
22+
lean-morph.yml, lean-offline.yaml, lean-style.yaml, morph-replay.yml, nightly-replay.yml, replay.yml, platform-replay.yml, policy-build.yml, policy-gates.yaml, policy-pr-proof.yml, proof-bot.yaml, proof-fuzz.yaml, paper-conformance.yaml, dfa.yaml, spec-ai.yaml, standards-pin.yml.
23+
24+
## Benchmarks and performance
25+
26+
bench-nightly-criterion.yaml, bench-swebench-smoke.yaml, bench-swebench-stress-scheduled.yaml, bench-swebench-unit.yaml, perf.yaml, performance-gate.yaml, perf-proofmeter.yaml, platform-perf-smoke.yml, art-benchmark.yaml, loadtest.yaml, edge-load.yaml.
27+
28+
## Platform, adapters, demos
29+
30+
adapters-ci.yml, integration.yaml, demo-e2e.yml, marketplace-e2e.yaml, egress.yml, pf-ci.yaml, pf-reusable-caller.yaml, pf-cross-repo-consumer.yaml, publish-updates.yaml, release.yaml, multiarch-build.yaml, docs-build.yaml, docs-deploy.yaml.
31+
32+
## Misc automation
33+
34+
pr-comments.yml, cla-bot.yaml, bundle-check.yaml, dep-graph.yaml, verify-publish-bundle.yaml, fuzz.yaml, heartbeat-test.yaml, incident-e2e.yaml, incident-test.yaml, opa-test.yaml, rbac-test.yaml, billing-test.yaml, slo-gates.yaml, dr-cross.yaml, chaos-nightly.yaml.
35+
36+
## Maintenance
37+
38+
When adding a workflow, add a one-line note in the appropriate section above so others can discover it without scanning the directory.

‎.github/actions/cache-cargo/action.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
# Copyright 2025 Provability-Fabric Contributors
3+
#
4+
# Restore (and at job end save) cargo registry, git checkouts, and target dir.
5+
# Use key-suffix to separate caches (e.g. "" for general, "-criterion-deps" for Criterion runs).
6+
7+
name: Cache Cargo
8+
description: Restore/save cargo registry, git, and target with configurable key suffix.
9+
10+
inputs:
11+
key-suffix:
12+
description: "Suffix for cache key (e.g. '' or '-criterion-deps'). No leading hyphen if empty."
13+
required: false
14+
default: ""
15+
16+
runs:
17+
using: composite
18+
steps:
19+
- name: Cache cargo
20+
uses: actions/cache@v4
21+
with:
22+
path: |
23+
~/.cargo/registry
24+
~/.cargo/git
25+
target
26+
key: ${{ runner.os }}-cargo${{ inputs.key-suffix }}-${{ hashFiles('**/Cargo.lock') }}
27+
restore-keys: |
28+
${{ runner.os }}-cargo${{ inputs.key-suffix }}-

‎.github/dependabot.yml‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: cargo
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
open-pull-requests-limit: 10
8+
groups:
9+
cargo-minor-patch:
10+
patterns:
11+
- "*"
12+
update-types:
13+
- minor
14+
- patch
15+
16+
- package-ecosystem: github-actions
17+
directory: /
18+
schedule:
19+
interval: weekly
20+
groups:
21+
actions:
22+
patterns:
23+
- "*"
24+
25+
- package-ecosystem: pip
26+
directory: /docs
27+
schedule:
28+
interval: weekly
29+
30+
- package-ecosystem: npm
31+
directory: /runtime/ledger
32+
schedule:
33+
interval: weekly
34+
groups:
35+
ledger-npm:
36+
patterns:
37+
- "*"
38+
39+
- package-ecosystem: npm
40+
directory: /core/sdk/typescript
41+
schedule:
42+
interval: weekly
43+
groups:
44+
sdk-npm:
45+
patterns:
46+
- "*"
47+
48+
- package-ecosystem: npm
49+
directory: /marketplace/ui
50+
schedule:
51+
interval: weekly
52+
groups:
53+
marketplace-npm:
54+
patterns:
55+
- "*"
56+
57+
- package-ecosystem: npm
58+
directory: /console
59+
schedule:
60+
interval: weekly
61+
groups:
62+
console-npm:
63+
patterns:
64+
- "*"
65+
66+
- package-ecosystem: npm
67+
directory: /demos/verifiable-mcp-fraud
68+
schedule:
69+
interval: weekly
70+
groups:
71+
demo-npm:
72+
patterns:
73+
- "*"
74+
75+
- package-ecosystem: gomod
76+
directory: /core/cli/pf
77+
schedule:
78+
interval: weekly
79+
groups:
80+
pf-cli-go:
81+
patterns:
82+
- "*"
83+
84+
- package-ecosystem: gomod
85+
directory: /runtime/admission-controller
86+
schedule:
87+
interval: weekly
88+
89+
- package-ecosystem: gomod
90+
directory: /services/api-gateway
91+
schedule:
92+
interval: weekly
93+
94+
- package-ecosystem: gomod
95+
directory: /services/evidence-service
96+
schedule:
97+
interval: weekly
98+
99+
- package-ecosystem: gomod
100+
directory: /services/spec-service
101+
schedule:
102+
interval: weekly
103+
104+
- package-ecosystem: gomod
105+
directory: /services/replay-service
106+
schedule:
107+
interval: weekly
108+
109+
- package-ecosystem: gomod
110+
directory: /services/proof-service
111+
schedule:
112+
interval: weekly
113+
114+
- package-ecosystem: gomod
115+
directory: /services/build-orchestrator
116+
schedule:
117+
interval: weekly
118+
119+
- package-ecosystem: gomod
120+
directory: /services/policy-diff-service
121+
schedule:
122+
interval: weekly

‎.github/workflows/actionlint.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
# Validates workflow YAML (expressions, permissions, runner labels).
3+
name: Actionlint
4+
5+
on:
6+
push:
7+
branches: [main]
8+
paths:
9+
- ".github/workflows/**"
10+
pull_request:
11+
branches: [main]
12+
paths:
13+
- ".github/workflows/**"
14+
15+
permissions:
16+
contents: read
17+
18+
jobs:
19+
actionlint:
20+
runs-on: ubuntu-latest
21+
steps:
22+
- uses: actions/checkout@v4
23+
24+
# Pinned image tag (not :latest) for reproducible lint runs.
25+
- name: Check workflows
26+
shell: bash
27+
run: |
28+
docker run --rm \
29+
-v "${GITHUB_WORKSPACE}:/workspace" \
30+
-w /workspace \
31+
rhysd/actionlint:1.7.12 \
32+
-color

‎.github/workflows/adapters-ci.yml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ jobs:
5555
- uses: actions/checkout@v4
5656
- uses: actions/setup-go@v5
5757
with:
58-
go-version: "1.21"
58+
go-version: "1.23"
5959
- name: Build
6060
run: |
6161
cd adapters/gochi-cert-middleware
@@ -64,3 +64,17 @@ jobs:
6464
- name: CERT schema quick check (go)
6565
run: |
6666
echo 'ok'
67+
68+
rust-adapters:
69+
runs-on: ubuntu-latest
70+
steps:
71+
- uses: actions/checkout@v4
72+
- uses: dtolnay/rust-toolchain@stable
73+
with:
74+
toolchain: stable
75+
- name: Build Rust adapters
76+
run: |
77+
cargo build -p httpget-adapter -p fileread-adapter
78+
- name: Test Rust adapters
79+
run: |
80+
cargo test -p httpget-adapter -p fileread-adapter

0 commit comments

Comments
 (0)