chore(deps): bump actions/setup-node from 6.4.0 to 7.0.0 #1169
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # .github/workflows/ci — the per-language verification pipeline. | |
| # Header check, contracts, detector, harness, edge, collector, commit lint, and an e2e spine smoke. | |
| # NOTE: actions are version-pinned; SHA-pin (ratchet/Dependabot) before public launch — see SECURITY.md. | |
| name: ci | |
| on: | |
| push: { branches: [main] } | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| headers: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: { python-version: "3.12" } | |
| - run: python3 scripts/check_headers.py | |
| # Enforce the "contracts are the only coupling" hard rule: the permissive core must not import | |
| # the (often copyleft) evader tree or depend on a known copyleft package. | |
| - run: python3 scripts/check_license_isolation.py | |
| detector: | |
| runs-on: ubuntu-latest | |
| defaults: { run: { working-directory: detector } } | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: { enable-cache: true } | |
| - run: uv sync | |
| - run: uv run ruff check . | |
| - run: uv run ruff format --check . | |
| - run: uv run mypy | |
| - run: uv run pytest | |
| harness: | |
| runs-on: ubuntu-latest | |
| defaults: { run: { working-directory: harness } } | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: { enable-cache: true } | |
| - run: uv sync | |
| - run: uv run ruff check . | |
| - run: uv run ruff format --check . | |
| - run: uv run mypy | |
| - run: uv run pytest | |
| fleet: | |
| runs-on: ubuntu-latest | |
| defaults: { run: { working-directory: fleet } } | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: { enable-cache: true } | |
| - run: uv sync | |
| - run: uv run ruff check . | |
| - run: uv run ruff format --check . | |
| - run: uv run mypy | |
| - run: uv run pytest | |
| - run: uv run python -m skulk.catalog --check # the coordination ladder in fleet/README.md is generated | |
| contracts: | |
| runs-on: ubuntu-latest | |
| defaults: { run: { working-directory: detector } } | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: { enable-cache: true } | |
| - run: uv sync | |
| - run: uv run python -c 'from kitsune_detector.contracts import load_rule_registry; load_rule_registry(); print("contracts ok")' | |
| docs: | |
| runs-on: ubuntu-latest | |
| defaults: { run: { working-directory: harness } } | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: { enable-cache: true } | |
| - run: uv sync | |
| # The drift gate that already runs in local `task ci` — fail PRs that change the registry/corpus | |
| # without regenerating the committed auto-docs (catalogs, README stats, matrix). | |
| - run: uv run python -m kitsune_harness.readme_stats --check | |
| - run: uv run python -m kitsune_harness.readme_redteam --check | |
| - run: uv run python -m kitsune_harness.rule_catalog --check | |
| - run: uv run python -m kitsune_harness.evasion_catalog --check | |
| - run: uv run python -m kitsune_harness.report ../corpus/sessions > ../docs/matrix.md | |
| - run: git -C .. diff --exit-code -- docs/matrix.md || (echo "docs/matrix.md is STALE — run 'task docs'" >&2; exit 1) | |
| edge: | |
| runs-on: ubuntu-latest | |
| defaults: { run: { working-directory: edge } } | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | |
| with: { go-version: "1.26" } | |
| - run: gofmt -l . | tee /dev/stderr | (! read) | |
| - run: go vet ./... | |
| # `go test ./...` runs every fuzz target's SEED CORPUS (the F.Add seeds + any committed | |
| # testdata/fuzz crashers) as deterministic regression tests, so a regression that lets malformed | |
| # client bytes panic the edge — a DoS — is caught here. ACTIVE, time-bounded fuzzing (which is | |
| # nondeterministic and flakes under CI-runner contention) runs nightly in fuzz.yml instead, keeping | |
| # it off the per-PR path so a random worker-budget hiccup never red-marks an unrelated PR. | |
| - run: go test ./... -cover | |
| arena: | |
| runs-on: ubuntu-latest | |
| defaults: { run: { working-directory: arena } } | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | |
| with: { go-version: "1.26" } | |
| - run: gofmt -l . | tee /dev/stderr | (! read) | |
| - run: go vet ./... | |
| - run: go test ./... -cover | |
| arena-solver: | |
| runs-on: ubuntu-latest | |
| defaults: { run: { working-directory: evaders/arena-solver } } | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | |
| with: { go-version: "1.26" } | |
| - run: gofmt -l . | tee /dev/stderr | (! read) | |
| - run: go vet ./... | |
| - run: go test ./... -cover | |
| arena-solver-ocr: | |
| runs-on: ubuntu-latest | |
| defaults: { run: { working-directory: evaders/arena-solver-ocr } } | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: { python-version: "3.12" } | |
| # Unit deps only — the TrOCR recognizer (transformers/torch) is tier-2 IO, off the unit gate. | |
| - run: pip install ruff mypy pytest pytest-cov httpx | |
| - run: ruff check . | |
| - run: PYTHONPATH=src mypy --strict src/kitsune_arena_ocr/solver.py src/kitsune_arena_ocr/__init__.py | |
| - run: PYTHONPATH=src python -m pytest tests/ -q | |
| collector: | |
| runs-on: ubuntu-latest | |
| defaults: { run: { working-directory: collector } } | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6 | |
| with: { version: "9.12.0" } | |
| - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: { node-version: "22", cache: pnpm, cache-dependency-path: collector/pnpm-lock.yaml } | |
| - run: pnpm install --frozen-lockfile | |
| - run: pnpm run typecheck | |
| - run: pnpm run lint | |
| - run: pnpm exec prettier --check . | |
| - run: pnpm test | |
| commitlint: | |
| if: github.event_name == 'pull_request' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: { fetch-depth: 0 } | |
| - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6 | |
| e2e: | |
| runs-on: ubuntu-latest | |
| needs: [detector, harness] | |
| defaults: { run: { working-directory: harness } } | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: { enable-cache: true } | |
| - run: uv sync | |
| - name: spine smoke — vanilla scores human, naive-bot scores bot | |
| run: | | |
| out="$(uv run python -m kitsune_harness)" | |
| echo "$out" | |
| echo "$out" | grep -q "naive-bot" && echo "$out" | grep -q "| bot |" || (echo "spine smoke failed" && exit 1) |