ci: add pmat comply gate (salvaged from #1) (#8) #21
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_INCREMENTAL: 0 | |
| RUSTFLAGS: "-D warnings" | |
| # Binary size budget (bytes). Stripped musl scratch target should fit in <8MB. | |
| ETL_MAX_RELEASE_BYTES: "8388608" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # Matrix entries do the actual work. The `gate` aggregator below is | |
| # what the branch ruleset on main keys off of — it requires a status | |
| # check named literally `gate`, which matrix expansion doesn't emit | |
| # (you only get `gate-matrix (toolchain)` from a strategy.matrix job). | |
| gate-matrix: | |
| name: gate-matrix (${{ matrix.toolchain }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # Pin to the workspace MSRV (1.85.0 — the channel pinned in | |
| # rust-toolchain.toml) and also test against current stable so we | |
| # catch regressions on the latest compiler. | |
| toolchain: ["1.85.0", "stable"] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| # rust-toolchain.toml pins 1.85.0 with rustfmt + clippy + | |
| # llvm-tools-preview; for the `stable` matrix entry we install | |
| # explicitly with the same components. | |
| - name: Install Rust toolchain | |
| uses: dtolnay/rust-toolchain@master | |
| with: | |
| toolchain: ${{ matrix.toolchain }} | |
| components: rustfmt, clippy, llvm-tools-preview | |
| - name: Cache cargo | |
| uses: Swatinem/rust-cache@v2 | |
| with: | |
| shared-key: gate-${{ matrix.toolchain }} | |
| # Required by `cargo llvm-cov`. Pinned versions for reproducible CI. | |
| - name: Install cargo-llvm-cov | |
| uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-llvm-cov@0.6 | |
| # cargo-audit 0.22+ and cargo-deny 0.19+ are required to parse | |
| # advisories that use CVSS 4.0. Earlier versions error with | |
| # `unsupported CVSS version: 4.0` when the advisory-db ships a | |
| # 4.0 entry (e.g. RUSTSEC-2026-0073). | |
| - name: Install cargo-deny + cargo-audit | |
| uses: taiki-e/install-action@v2 | |
| with: | |
| tool: cargo-deny@0.19,cargo-audit@0.22 | |
| # bashrs lints Makefile + Dockerfiles. provable-contracts-cli | |
| # (`pv`, shipped from paiml/aprender as `aprender-contracts-cli`) | |
| # lints the YAML contracts in contracts/. We download prebuilt | |
| # binaries from each tool's GitHub release rather than `cargo | |
| # install` so CI doesn't recompile ~5 min of source on every run. | |
| # Both ship x86_64-unknown-linux-gnu tarballs against ubuntu-latest. | |
| # Bump the *_VERSION envs below when we want a newer build. | |
| # | |
| # Only on stable: keeping this gate on stable avoids running the | |
| # lint twice across the toolchain matrix; the MSRV matrix entry | |
| # still proves the workspace itself builds on 1.85. | |
| - name: Install prebuilt CLIs (bashrs + pv + pmat) | |
| if: matrix.toolchain == 'stable' | |
| env: | |
| BASHRS_VERSION: v6.66.1 | |
| PV_VERSION: v0.31.2 | |
| PMAT_VERSION: v3.16.0 | |
| run: | | |
| set -euo pipefail | |
| install_dir="$RUNNER_TEMP/prebuilt-bin" | |
| mkdir -p "$install_dir" | |
| for tool_spec in \ | |
| "bashrs:paiml/bashrs:${BASHRS_VERSION}:bashrs-${BASHRS_VERSION}-x86_64-unknown-linux-gnu" \ | |
| "pv:paiml/aprender:${PV_VERSION}:pv-${PV_VERSION}-x86_64-unknown-linux-gnu" \ | |
| "pmat:paiml/paiml-mcp-agent-toolkit:${PMAT_VERSION}:pmat-${PMAT_VERSION}-x86_64-unknown-linux-gnu" | |
| do | |
| IFS=: read -r bin repo ver archive <<< "$tool_spec" | |
| url="https://github.com/${repo}/releases/download/${ver}/${archive}.tar.gz" | |
| echo "Downloading $bin from $url" | |
| curl -sSfL "$url" | tar xz -C "$install_dir" | |
| mv "$install_dir/$archive/$bin" "$install_dir/$bin" | |
| chmod +x "$install_dir/$bin" | |
| "$install_dir/$bin" --version | |
| done | |
| echo "$install_dir" >> "$GITHUB_PATH" | |
| - name: Lint Makefile + Dockerfiles (bashrs) | |
| if: matrix.toolchain == 'stable' | |
| run: bashrs lint Makefile Dockerfile Dockerfile.distroless-cc | |
| - name: Lint contracts (pv) | |
| if: matrix.toolchain == 'stable' | |
| run: pv lint contracts/ | |
| # Salvaged from PR #1 (closed): pmat is paiml's quality + compliance | |
| # check. Runs the same compliance ruleset that gates other paiml | |
| # repos. Stable-only — same reasoning as bashrs/pv: keeps the gate | |
| # from running twice across the toolchain matrix. | |
| - name: pmat comply | |
| if: matrix.toolchain == 'stable' | |
| run: pmat comply | |
| - name: Format | |
| run: cargo fmt --all -- --check | |
| - name: Clippy | |
| run: cargo clippy --workspace --all-targets -- -D warnings | |
| - name: Doc (warnings = errors) | |
| env: | |
| RUSTDOCFLAGS: "-D warnings" | |
| run: cargo doc --workspace --no-deps | |
| - name: Test | |
| run: cargo test --workspace --all-targets | |
| - name: Doc-test | |
| run: cargo test --workspace --doc | |
| - name: Coverage (must be 100% lines) | |
| run: cargo llvm-cov --workspace --fail-under-lines 100 | |
| - name: Audit | |
| run: cargo audit --deny warnings | |
| - name: Deny | |
| run: cargo deny check | |
| - name: Release build | |
| run: cargo build --release --workspace | |
| # Hard binary-size budget. The scratch-musl container target should be | |
| # well under 8 MB. If a dependency suddenly bloats the binary CI fails | |
| # before that ships. | |
| - name: Binary size budget | |
| run: | | |
| set -euo pipefail | |
| bin="target/release/etl" | |
| test -f "$bin" | |
| size_bytes=$(stat -c%s "$bin") | |
| echo "etl binary size: ${size_bytes} bytes" | |
| if [ "$size_bytes" -gt "${ETL_MAX_RELEASE_BYTES}" ]; then | |
| echo "::error::etl binary (${size_bytes} bytes) exceeds budget (${ETL_MAX_RELEASE_BYTES} bytes)" | |
| exit 1 | |
| fi | |
| # Smoke-test the criterion benches. `--test` runs each bench's | |
| # measurement loop once without recording samples — proves the | |
| # bench harness compiles and runs end-to-end without burning CI | |
| # time on full statistical measurements. | |
| - name: Bench (smoke) | |
| run: cargo bench --workspace -- --test | |
| # Aggregator. The branch ruleset on `main` requires a status check | |
| # named exactly `gate`; the matrix above only emits `gate-matrix | |
| # (toolchain)`. This job collapses the matrix into a single check so | |
| # PRs can merge without --admin overrides. | |
| gate: | |
| name: gate | |
| needs: gate-matrix | |
| runs-on: ubuntu-latest | |
| if: always() | |
| steps: | |
| - name: Verify matrix succeeded | |
| run: | | |
| if [ "${{ needs.gate-matrix.result }}" != "success" ]; then | |
| echo "::error::gate-matrix did not all pass (result=${{ needs.gate-matrix.result }})" | |
| exit 1 | |
| fi |