diff --git a/.gitattributes b/.gitattributes index ad06ac8..c3e39a8 100644 --- a/.gitattributes +++ b/.gitattributes @@ -1,3 +1,7 @@ # Bash recipes and shims must stay LF (Git Bash / Linux CI). *.sh text eol=lf scripts/node_bin/node text eol=lf + +# These externally digested release artifacts must retain exact byte encodings. +tests/pcs/fixtures/computation-release/*.json -text +tests/pcs/fixtures/computation-rejected-release/*.json -text diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml index c6af728..8e3f228 100644 --- a/.github/workflows/benchmark.yml +++ b/.github/workflows/benchmark.yml @@ -11,6 +11,21 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Checkout pcs-core (workspace dependency) + uses: actions/checkout@v4 + with: + repository: SentinelOps-CI/pcs-core + ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b + path: pcs-core + + - name: Make PCS dependency available at uv.lock sibling path + run: | + test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml" + ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core" + + - name: Verify pinned PCS revision and repair upstream packaging metadata + run: python scripts/prepare_pcs_core_workspace.py + - uses: astral-sh/setup-uv@v4 - name: Install deps diff --git a/.github/workflows/contributor-dry-run-monthly.yml b/.github/workflows/contributor-dry-run-monthly.yml index 98ef3cc..6239a4b 100644 --- a/.github/workflows/contributor-dry-run-monthly.yml +++ b/.github/workflows/contributor-dry-run-monthly.yml @@ -10,14 +10,33 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 + + - name: Checkout pcs-core (workspace dependency) + uses: actions/checkout@v4 + with: + repository: SentinelOps-CI/pcs-core + ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b + path: pcs-core + + - name: Make PCS dependency available at uv.lock sibling path + run: | + test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml" + ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core" + + - name: Verify pinned PCS revision and repair upstream packaging metadata + run: python scripts/prepare_pcs_core_workspace.py - uses: astral-sh/setup-uv@v4 + - uses: pnpm/action-setup@v4 + with: + version: "10.0.0" - uses: actions/setup-node@v4 with: node-version: "22" cache: "pnpm" - - uses: pnpm/action-setup@v4 - with: - version: 10 + - name: Install elan for Lean build + run: | + curl -sSf https://raw.githubusercontent.com/leanprover/elan/master/elan-init.sh | sh -s -- -y --default-toolchain none + echo "$HOME/.elan/bin" >> "$GITHUB_PATH" - name: Install Python deps run: uv sync --all-packages - name: Install portal deps diff --git a/.github/workflows/corpus-validation.yml b/.github/workflows/corpus-validation.yml index ff3d34a..2b12c11 100644 --- a/.github/workflows/corpus-validation.yml +++ b/.github/workflows/corpus-validation.yml @@ -15,8 +15,16 @@ jobs: uses: actions/checkout@v4 with: repository: SentinelOps-CI/pcs-core + ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b path: pcs-core - continue-on-error: true + + - name: Make PCS dependency available at uv.lock sibling path + run: | + test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml" + ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core" + + - name: Verify pinned PCS revision and repair upstream packaging metadata + run: python scripts/prepare_pcs_core_workspace.py - uses: astral-sh/setup-uv@v4 @@ -29,7 +37,7 @@ jobs: - name: Sync PCS benchmark schemas from pcs-core if: hashFiles('pcs-core/schemas/**') != '' - run: uv run python scripts/sync_pcs_benchmark_schemas.py pcs-core + run: uv run python scripts/sync_pcs_benchmark_schemas.py pcs-core/schemas - name: Install pcs-core extra (when checked out) run: | @@ -46,11 +54,11 @@ jobs: - name: Install pcs-bench CLI if: hashFiles('pcs-bench/pyproject.toml') != '' - run: uv pip install --system -e pcs-bench + run: uv pip install --python .venv/bin/python -e pcs-bench - uses: pnpm/action-setup@v4 with: - version: 10 + version: "10.0.0" - uses: actions/setup-node@v4 with: @@ -77,7 +85,7 @@ jobs: run: uv run --project pipeline python -m sm_pipeline.cli validate-all - name: Run pipeline tests - run: uv run --project pipeline pytest + run: uv run --all-packages pytest - name: Run PCS contract tests env: diff --git a/.github/workflows/mcp-contract.yml b/.github/workflows/mcp-contract.yml index 1971c82..33e2d9d 100644 --- a/.github/workflows/mcp-contract.yml +++ b/.github/workflows/mcp-contract.yml @@ -11,6 +11,21 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 + + - name: Checkout pcs-core (workspace dependency) + uses: actions/checkout@v4 + with: + repository: SentinelOps-CI/pcs-core + ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b + path: pcs-core + + - name: Make PCS dependency available at uv.lock sibling path + run: | + test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml" + ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core" + + - name: Verify pinned PCS revision and repair upstream packaging metadata + run: python scripts/prepare_pcs_core_workspace.py - uses: astral-sh/setup-uv@v4 - name: Install deps (including MCP extras) run: uv sync --all-packages --extra mcp diff --git a/.github/workflows/pcs-bench-producer.yml b/.github/workflows/pcs-bench-producer.yml index be5906d..a826b23 100644 --- a/.github/workflows/pcs-bench-producer.yml +++ b/.github/workflows/pcs-bench-producer.yml @@ -29,8 +29,17 @@ jobs: uses: actions/checkout@v4 with: repository: SentinelOps-CI/pcs-core + ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b path: pcs-core + - name: Make PCS dependency available at uv.lock sibling path + run: | + test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml" + ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core" + + - name: Verify pinned PCS revision and repair upstream packaging metadata + run: python scripts/prepare_pcs_core_workspace.py + - name: Checkout pcs-bench uses: actions/checkout@v4 with: @@ -49,7 +58,7 @@ jobs: run: uv pip install --system -e pcs-bench - name: Sync PCS benchmark schemas - run: uv run python scripts/sync_pcs_benchmark_schemas.py pcs-core + run: uv run python scripts/sync_pcs_benchmark_schemas.py pcs-core/schemas - name: LabTrust producer gate (release-grade) env: diff --git a/.github/workflows/portal-ci.yml b/.github/workflows/portal-ci.yml index 42f5b8d..f9dc883 100644 --- a/.github/workflows/portal-ci.yml +++ b/.github/workflows/portal-ci.yml @@ -13,7 +13,7 @@ jobs: - uses: pnpm/action-setup@v4 with: - version: 10 + version: "10.0.0" - uses: actions/setup-node@v4 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 180dd5a..48faad4 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,10 +15,25 @@ jobs: steps: - uses: actions/checkout@v4 + - name: Checkout pcs-core (workspace dependency) + uses: actions/checkout@v4 + with: + repository: SentinelOps-CI/pcs-core + ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b + path: pcs-core + + - name: Make PCS dependency available at uv.lock sibling path + run: | + test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml" + ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core" + + - name: Verify pinned PCS revision and repair upstream packaging metadata + run: python scripts/prepare_pcs_core_workspace.py + - uses: astral-sh/setup-uv@v4 - uses: pnpm/action-setup@v4 with: - version: 10 + version: "10.0.0" - uses: actions/setup-node@v4 with: node-version: 22 diff --git a/.github/workflows/security-sarif.yml b/.github/workflows/security-sarif.yml index acd7b3f..9ad6849 100644 --- a/.github/workflows/security-sarif.yml +++ b/.github/workflows/security-sarif.yml @@ -15,12 +15,27 @@ jobs: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 + + - name: Checkout pcs-core (workspace dependency) + uses: actions/checkout@v4 + with: + repository: SentinelOps-CI/pcs-core + ref: 9c971f5f9da8a424924dd8f48d6a3b71a1009e1b + path: pcs-core + + - name: Make PCS dependency available at uv.lock sibling path + run: | + test -f "$GITHUB_WORKSPACE/pcs-core/python/pyproject.toml" + ln -sfn "$GITHUB_WORKSPACE/pcs-core" "$GITHUB_WORKSPACE/../pcs-core" + + - name: Verify pinned PCS revision and repair upstream packaging metadata + run: python scripts/prepare_pcs_core_workspace.py - uses: astral-sh/setup-uv@v4 - name: Install Python deps run: uv sync --all-packages - name: Generate Ruff SARIF (warning-first) run: | - uv run --project pipeline ruff check pipeline kernels kernels/conformance scripts tests --output-format sarif --exit-zero > ruff.sarif + uvx --from ruff==0.17.0 ruff check pipeline kernels kernels/conformance scripts tests --output-format sarif --exit-zero > ruff.sarif - name: Upload SARIF to code scanning uses: github/codeql-action/upload-sarif@v3 with: diff --git a/portal/app/pcs/claims/[claimId]/page.tsx b/portal/app/pcs/claims/[claimId]/page.tsx index 3738220..dbc77b4 100644 --- a/portal/app/pcs/claims/[claimId]/page.tsx +++ b/portal/app/pcs/claims/[claimId]/page.tsx @@ -22,9 +22,14 @@ export default async function PcsClaimRoute({

PCS claim not found

No imported claim with id “{claimId}”. Run{" "} - just pcs-import-bundle{" "} + + just pcs-import-bundle + {" "} then{" "} - just pcs-render-claim. + + just pcs-render-claim + + .

); diff --git a/portal/app/pcs/page.tsx b/portal/app/pcs/page.tsx index ab5fd4b..aeb6a54 100644 --- a/portal/app/pcs/page.tsx +++ b/portal/app/pcs/page.tsx @@ -16,9 +16,14 @@ export default async function PcsClaimsIndexPage() { {claimIds.length === 0 ? (

No claims imported yet. Run{" "} - just pcs-import-release{" "} + + just pcs-import-release + {" "} then{" "} - just pcs-render-claim claim-pcs-qc-release-v0.1. + + just pcs-render-claim claim-pcs-qc-release-v0.1 + + .

) : (