ci.yml

name: aset-python-sqlite CI

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  test-and-conformance:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout implementation
        uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - run: python -m pip install -r requirements-dev.txt
      - run: python -m pip install --no-deps --editable .

      - name: Read locked Compatibility Standard release
        id: standard-lock
        shell: bash
        run: |
          python - <<'PY' >> "$GITHUB_OUTPUT"
          import json
          from pathlib import Path

          lock = json.loads(Path("canon.lock.json").read_text(encoding="utf-8"))
          standard = lock["standard"]
          version = standard["release_version"]
          print("tag=" + lock["source"]["tag"])
          print("release_version=" + version)
          print("kit_sha256=" + standard["conformance_kit_sha256"].removeprefix("sha256:"))
          print("kit=ASET-Seed-" + version + "-Conformance-Kit.zip")
          print("checksum=ASET-Seed-" + version + "-Conformance-Kit.zip.sha256")
          print("identity=ASET-Seed-" + version + "-Compatibility-Standard.json")
          print("manifest=ASET-Seed-" + version + "-Conformance-Kit.manifest.json")
          PY

      - name: Download immutable ASET Compatibility Standard assets
        env:
          GH_TOKEN: ${{ github.token }}
          ASET_TAG: ${{ steps.standard-lock.outputs.tag }}
          KIT: ${{ steps.standard-lock.outputs.kit }}
          CHECKSUM: ${{ steps.standard-lock.outputs.checksum }}
          IDENTITY: ${{ steps.standard-lock.outputs.identity }}
          MANIFEST: ${{ steps.standard-lock.outputs.manifest }}
        shell: bash
        run: |
          mkdir -p .aset-standard-assets
          gh release download "$ASET_TAG" \
            --repo attractor-set/ASET \
            --dir .aset-standard-assets \
            --pattern "$KIT" \
            --pattern "$CHECKSUM" \
            --pattern "$IDENTITY" \
            --pattern "$MANIFEST"

      - name: Verify and materialize exact Conformance Kit
        env:
          VERSION: ${{ steps.standard-lock.outputs.release_version }}
          KIT: ${{ steps.standard-lock.outputs.kit }}
          CHECKSUM: ${{ steps.standard-lock.outputs.checksum }}
          IDENTITY: ${{ steps.standard-lock.outputs.identity }}
          KIT_SHA256: ${{ steps.standard-lock.outputs.kit_sha256 }}
        shell: bash
        run: |
          python - <<'PY'
          import hashlib
          import json
          import os
          import shutil
          import zipfile
          from pathlib import Path, PurePosixPath

          assets = Path(".aset-standard-assets")
          kit = assets / os.environ["KIT"]
          checksum = assets / os.environ["CHECKSUM"]
          identity = assets / os.environ["IDENTITY"]
          expected = os.environ["KIT_SHA256"]
          actual = hashlib.sha256(kit.read_bytes()).hexdigest()
          if actual != expected:
              raise SystemExit(f"locked Conformance Kit SHA-256 mismatch: {actual}")
          checksum_value = checksum.read_text(encoding="utf-8").split()[0]
          if checksum_value != expected:
              raise SystemExit("published checksum asset does not match canon.lock.json")

          target = Path(".aset-standard")
          if target.exists():
              shutil.rmtree(target)
          target.mkdir()
          root_name = f"ASET-Seed-{os.environ['VERSION']}-Conformance-Kit"
          with zipfile.ZipFile(kit) as archive:
              for info in archive.infolist():
                  path = PurePosixPath(info.filename)
                  if path.is_absolute() or ".." in path.parts or not path.parts or path.parts[0] != root_name:
                      raise SystemExit(f"unsafe Conformance Kit member: {info.filename}")
                  destination = target.joinpath(*path.parts)
                  if info.is_dir():
                      destination.mkdir(parents=True, exist_ok=True)
                  else:
                      destination.parent.mkdir(parents=True, exist_ok=True)
                      destination.write_bytes(archive.read(info))
          embedded = target / root_name / "STANDARD.json"
          if embedded.read_bytes() != identity.read_bytes():
              raise SystemExit("published standard identity differs from Conformance Kit STANDARD.json")
          print("SEED_CONFORMANCE_KIT_SHA256=" + actual)
          print("SEED_CONFORMANCE_KIT_RELEASE_ASSET=PASS")
          PY

      - name: Verify repository manifest
        run: python tools/rebuild_manifest.py --check

      - name: Verify exact Compatibility Standard binding
        run: >-
          python tools/verify_canon_lock.py
          --canon-root .aset-standard/ASET-Seed-${{ steps.standard-lock.outputs.release_version }}-Conformance-Kit
          --standard-identity .aset-standard-assets/${{ steps.standard-lock.outputs.identity }}
          --standard-kit .aset-standard-assets/${{ steps.standard-lock.outputs.kit }}

      - name: Run complete profile and release gate
        run: >-
          python tools/profile_gate.py
          --canon-root .aset-standard/ASET-Seed-${{ steps.standard-lock.outputs.release_version }}-Conformance-Kit

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: aset-python-sqlite-conformance
          if-no-files-found: warn
          path: |
            dist/conformance-results.json
            dist/aset-python-sqlite-source.zip
            dist/aset-python-sqlite-source.zip.sha256
            dist/wheel/*.whl
            dist/blackbox-release-audit.json
            dist/blackbox-release-audit.md