docs(negotiation-ref): document verify_chain() reason partition — unreached vs. ran-and-failed #335
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main, master] | |
| pull_request: | |
| branches: [main, master] | |
| jobs: | |
| audit: | |
| name: Audit + lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.11" | |
| - name: Audit — no ALBY references (must be phoenixd) | |
| run: | | |
| if grep -ri "alby" . --include="*.py" --include="*.md" --include="*.json" --include="Dockerfile" -l 2>/dev/null | grep -v ".git/"; then | |
| echo "FAIL: ALBY reference found — should be phoenixd" | |
| exit 1 | |
| fi | |
| - name: Audit — no hardcoded local paths | |
| run: | | |
| if grep -rn "sys.path.insert.*dell7568" . --include="*.py" 2>/dev/null; then | |
| echo "FAIL: hardcoded local path" | |
| exit 1 | |
| fi | |
| - name: Audit — .env not tracked | |
| run: | | |
| if git ls-files .env 2>/dev/null | grep -q .; then | |
| echo "FAIL: .env is tracked in git" | |
| exit 1 | |
| fi | |
| - name: Audit — no hardcoded credentials in tracked files | |
| run: | | |
| # Match KEY=<non-empty value>. Skips empty placeholders (KEY="" or KEY=) | |
| # and excludes .env, workflows, and the audit job itself. | |
| # Check only code files (.py, .js, .ts, .json, .yml, .yaml, .sh, .toml). | |
| # Skip .md (docs/placeholders), Dockerfile (ENV decls), .env, workflows. | |
| files=$(git ls-files '*.py' '*.js' '*.ts' '*.json' '*.yml' '*.yaml' '*.sh' '*.toml' 2>/dev/null | grep -v "^\.github/workflows/" || true) | |
| if [ -z "$files" ]; then exit 0; fi | |
| if echo "$files" | xargs grep -HnE '(PRIVATE_KEY|API_KEY|SECRET|PASSWORD)=["'\'']?[^"'\'' ]' 2>/dev/null; then | |
| echo "FAIL: hardcoded credential found" | |
| exit 1 | |
| fi | |
| - name: Python syntax check | |
| run: | | |
| python -m compileall -q . || exit 1 | |
| - name: Install dependencies | |
| run: | | |
| if [ -f requirements.txt ]; then | |
| pip install -r requirements.txt | |
| fi | |
| - name: Run tests if present | |
| run: | | |
| if [ -d tests ] || ls test_*.py 2>/dev/null | grep -q .; then | |
| pip install pytest | |
| pytest -q || exit 1 | |
| else | |
| echo "No tests — skipping" | |
| fi | |
| - name: Secret scan — gitleaks | |
| uses: gitleaks/gitleaks-action@v2 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| args: detect --redact -q |