Repository navigation
feat(assail): line-anchor Lean/Isabelle sorry findings so inline markers apply #787
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow is managed by gh actions-lock. | |
| # SPDX-License-Identifier: MPL-2.0 | |
| # This workflow is managed by gh actions-lock. | |
| # This workflow is managed by gh actions-lock. | |
| # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk> | |
| # | |
| # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate | |
| # Validates that the repo uses hyperpolymath's own formats and tools. | |
| # Companion to static-analysis-gate.yml (security) — this is for format compliance. | |
| name: Dogfood Gate | |
| on: | |
| pull_request: | |
| branches: ['**'] | |
| push: | |
| branches: [main, master] | |
| permissions: | |
| contents: read | |
| jobs: | |
| # --------------------------------------------------------------------------- | |
| # Job 1: A2ML manifest validation | |
| # --------------------------------------------------------------------------- | |
| a2ml-validate: | |
| name: Validate DEED manifests | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Check for A2ML files | |
| id: detect | |
| run: | | |
| COUNT=$(find . -type f \( -name '*.a2ml' -o -name '*.deed' \) -not -path './.git/*' | wc -l) | |
| echo "count=$COUNT" >> "$GITHUB_OUTPUT" | |
| if [ "$COUNT" -eq 0 ]; then | |
| echo "::warning::No .a2ml/.deed manifest files found. Every RSR repo should have a repo deed (<reponame>_chora.deed); legacy 0-AI-MANIFEST.a2ml accepted mid-migration — standards #837" | |
| fi | |
| - name: Validate A2ML manifests | |
| if: steps.detect.outputs.count > 0 | |
| run: bash .github/hooks/validate-a2ml.sh | |
| - name: Write summary | |
| run: | | |
| A2ML_COUNT="${{ steps.detect.outputs.count }}" | |
| if [ "$A2ML_COUNT" -eq 0 ]; then | |
| cat <<'EOF' >> "$GITHUB_STEP_SUMMARY" | |
| ## A2ML Validation | |
| :warning: **No .a2ml/.deed manifest files found.** Every RSR-compliant repo should have a repo deed (`<reponame>_chora.deed`) at its root. | |
| Copy one from [rsr-template-repo](https://github.com/hyperpolymath/rsr-template-repo). | |
| EOF | |
| else | |
| echo "## A2ML Validation" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "Scanned **${A2ML_COUNT}** manifest file(s) (.deed, or legacy .a2ml). See step output for details." >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| # --------------------------------------------------------------------------- | |
| # Job 2: K9 conformance through the canonical validator (contract v1.0.0, | |
| # D173), the same lane rsr-template-repo runs. The validator and contract | |
| # come from a pinned standards checkout; .github/hooks/validate-k9.sh is | |
| # the local wrapper, so CI and a pre-push run check the same files. | |
| # --------------------------------------------------------------------------- | |
| k9-validate: | |
| name: Validate K9 contracts | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| env: | |
| NICKEL_VERSION: '1.18.0' | |
| NICKEL_SHA256: '9cba4dd65ae9915ec61f73033aafcff307a377665a83fd8f530df086763318cb' | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Checkout canonical K9 validator and contract | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| repository: metadatastician/standards | |
| ref: 8e48b1caade08a552646adeab66558ac43b4360d | |
| path: .standards-k9 | |
| sparse-checkout: 1-formats/k9 | |
| sparse-checkout-cone-mode: true | |
| persist-credentials: false | |
| - name: Install sha256-verified Nickel CLI | |
| run: | | |
| set -euo pipefail | |
| URL="https://github.com/tweag/nickel/releases/download/${NICKEL_VERSION}/nickel-x86_64-linux" | |
| curl -sSfL --proto '=https' --proto-redir '=https' --tlsv1.2 --retry 3 -o "$RUNNER_TEMP/nickel" "$URL" | |
| echo "${NICKEL_SHA256} ${RUNNER_TEMP}/nickel" | sha256sum -c - | |
| chmod +x "$RUNNER_TEMP/nickel" | |
| echo "$RUNNER_TEMP" >> "$GITHUB_PATH" | |
| - name: Validate K9 contracts (L0–L2) | |
| run: | | |
| set -euo pipefail | |
| rm -rf "$RUNNER_TEMP/standards-k9" | |
| mv "$PWD/.standards-k9" "$RUNNER_TEMP/standards-k9" | |
| if [ ! -f "$RUNNER_TEMP/standards-k9/1-formats/k9/tools/k9-validate.sh" ]; then | |
| echo "::error::K9 validator is missing from the standards checkout" | |
| exit 1 | |
| fi | |
| if ! command -v nickel >/dev/null 2>&1; then | |
| echo "::error::nickel is required for K9 layer L2 validation" | |
| exit 1 | |
| fi | |
| STANDARDS_DIR="$RUNNER_TEMP/standards-k9" bash .github/hooks/validate-k9.sh | |
| # --------------------------------------------------------------------------- | |
| # Job 3: Empty-linter — invisible character detection | |
| # --------------------------------------------------------------------------- | |
| empty-lint: | |
| name: Empty-linter (invisible characters) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Scan for invisible characters | |
| id: lint | |
| run: | | |
| # Inline invisible character detection (from empty-linter's core patterns). | |
| # Checks for: zero-width spaces, zero-width joiners, BOM, soft hyphens, | |
| # non-breaking spaces, null bytes, and other invisible Unicode in source files. | |
| set +e | |
| PATTERNS='(*UTF)[\x00-\x08\x0B\x0C\x0E-\x1F\x{a0}\x{ad}\x{200b}-\x{200f}\x{202a}-\x{202f}\x{2060}\x{2066}-\x{2069}\x{feff}]' | |
| find "$GITHUB_WORKSPACE" \ | |
| -not -path '*/.git/*' -not -path '*/node_modules/*' \ | |
| -not -path '*/.deno/*' -not -path '*/target/*' \ | |
| -not -path '*/_build/*' -not -path '*/deps/*' \ | |
| -not -path '*/external_corpora/*' -not -path '*/.lake/*' \ | |
| -type f \( -name '*.rs' -o -name '*.ex' -o -name '*.exs' -o -name '*.res' \ | |
| -o -name '*.js' -o -name '*.ts' -o -name '*.json' -o -name '*.toml' \ | |
| -o -name '*.yml' -o -name '*.yaml' -o -name '*.kyaml' -o -name '*.md' -o -name '*.adoc' \ | |
| -o -name '*.idr' -o -name '*.zig' -o -name '*.v' -o -name '*.jl' \ | |
| -o -name '*.gleam' -o -name '*.hs' -o -name '*.ml' -o -name '*.sh' \) \ | |
| -exec grep -aPrl "$PATTERNS" {} \; > /tmp/empty-lint-results.txt 2>/dev/null | |
| EL_EXIT=$? | |
| set -e | |
| FINDINGS=$(wc -l < /tmp/empty-lint-results.txt 2>/dev/null || echo 0) | |
| echo "findings=$FINDINGS" >> "$GITHUB_OUTPUT" | |
| echo "exit_code=$EL_EXIT" >> "$GITHUB_OUTPUT" | |
| echo "ready=true" >> "$GITHUB_OUTPUT" | |
| # Emit annotations for each file with invisible chars | |
| while IFS= read -r filepath; do | |
| [ -z "$filepath" ] && continue | |
| REL_PATH="${filepath#$GITHUB_WORKSPACE/}" | |
| echo "::warning file=${REL_PATH}::Invisible Unicode characters detected (zero-width space, BOM, NBSP, etc.)" | |
| done < /tmp/empty-lint-results.txt | |
| - name: Write summary | |
| run: | | |
| if [ "${{ steps.lint.outputs.ready }}" = "true" ]; then | |
| FINDINGS="${{ steps.lint.outputs.findings }}" | |
| if [ "$FINDINGS" -gt 0 ] 2>/dev/null; then | |
| echo "## Empty-Linter Results" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "Found **${FINDINGS}** invisible character issue(s). See annotations above." >> "$GITHUB_STEP_SUMMARY" | |
| else | |
| echo "## Empty-Linter Results" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo ":white_check_mark: No invisible character issues found." >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| else | |
| echo "## Empty-Linter" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "Skipped: empty-linter not available." >> "$GITHUB_STEP_SUMMARY" | |
| fi | |
| # --------------------------------------------------------------------------- | |
| # Job 4: Groove manifest check (for repos that should expose services) | |
| # --------------------------------------------------------------------------- | |
| groove-check: | |
| name: Groove manifest check | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Check for Groove manifest | |
| id: groove | |
| run: | | |
| # Check for static or dynamic Groove endpoints | |
| HAS_MANIFEST="false" | |
| HAS_GROOVE_CODE="false" | |
| if [ -f ".well-known/groove/manifest.json" ]; then | |
| HAS_MANIFEST="true" | |
| # Validate the manifest JSON | |
| if ! jq empty .well-known/groove/manifest.json 2>/dev/null; then | |
| echo "::error file=.well-known/groove/manifest.json::Invalid JSON in Groove manifest" | |
| else | |
| SVC_ID=$(jq -r '.service_id // "unknown"' .well-known/groove/manifest.json) | |
| echo "service_id=$SVC_ID" >> "$GITHUB_OUTPUT" | |
| fi | |
| fi | |
| # Check for Groove endpoint code (Rust, Elixir, Zig, V) | |
| if grep -rl 'well-known/groove' --include='*.rs' --include='*.ex' --include='*.zig' --include='*.v' --include='*.res' . 2>/dev/null | head -1 | grep -q .; then | |
| HAS_GROOVE_CODE="true" | |
| fi | |
| # Check if this repo likely serves HTTP (has server/listener code) | |
| HAS_SERVER="false" | |
| if grep -rl 'TcpListener\|Bandit\|Plug.Cowboy\|httpz\|vweb\|axum::serve\|actix_web' --include='*.rs' --include='*.ex' --include='*.zig' --include='*.v' . 2>/dev/null | head -1 | grep -q .; then | |
| HAS_SERVER="true" | |
| fi | |
| echo "has_manifest=$HAS_MANIFEST" >> "$GITHUB_OUTPUT" | |
| echo "has_groove_code=$HAS_GROOVE_CODE" >> "$GITHUB_OUTPUT" | |
| echo "has_server=$HAS_SERVER" >> "$GITHUB_OUTPUT" | |
| if [ "$HAS_SERVER" = "true" ] && [ "$HAS_MANIFEST" = "false" ] && [ "$HAS_GROOVE_CODE" = "false" ]; then | |
| echo "::warning::This repo has server code but no Groove endpoint. Add .well-known/groove/manifest.json for service discovery." | |
| fi | |
| - name: Write summary | |
| run: | | |
| echo "## Groove Protocol Check" >> "$GITHUB_STEP_SUMMARY" | |
| echo "" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Check | Status |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "|-------|--------|" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Static manifest (.well-known/groove/manifest.json) | ${{ steps.groove.outputs.has_manifest }} |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Groove endpoint in code | ${{ steps.groove.outputs.has_groove_code }} |" >> "$GITHUB_STEP_SUMMARY" | |
| echo "| Has HTTP server code | ${{ steps.groove.outputs.has_server }} |" >> "$GITHUB_STEP_SUMMARY" | |
| # --------------------------------------------------------------------------- | |
| # Job 5: Dogfooding summary | |
| # --------------------------------------------------------------------------- | |
| dogfood-summary: | |
| name: Dogfooding compliance summary | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| needs: [a2ml-validate, k9-validate, empty-lint, groove-check] | |
| if: always() | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Generate dogfooding scorecard | |
| run: | | |
| SCORE=0 | |
| MAX=5 | |
| # A2ML manifest present? | |
| if find . -type f \( -name '*.a2ml' -o -name '*.deed' \) -not -path './.git/*' | head -1 | grep -q .; then | |
| SCORE=$((SCORE + 1)) | |
| A2ML_STATUS=":white_check_mark:" | |
| else | |
| A2ML_STATUS=":x:" | |
| fi | |
| # K9 contracts present? | |
| if find . \( -name '*.k9' -o -name '*.k9.ncl' \) -not -path './.git/*' | head -1 | grep -q .; then | |
| SCORE=$((SCORE + 1)) | |
| K9_STATUS=":white_check_mark:" | |
| else | |
| K9_STATUS=":x:" | |
| fi | |
| # .editorconfig present? | |
| if [ -f ".editorconfig" ]; then | |
| SCORE=$((SCORE + 1)) | |
| EC_STATUS=":white_check_mark:" | |
| else | |
| EC_STATUS=":x:" | |
| fi | |
| # Groove manifest or code? | |
| if [ -f ".well-known/groove/manifest.json" ] || grep -rl 'well-known/groove' --include='*.rs' --include='*.ex' --include='*.zig' . 2>/dev/null | head -1 | grep -q .; then | |
| SCORE=$((SCORE + 1)) | |
| GROOVE_STATUS=":white_check_mark:" | |
| else | |
| GROOVE_STATUS=":ballot_box_with_check:" | |
| fi | |
| # VeriSimDB integration? | |
| if grep -rl 'verisimdb\|VeriSimDB' --include='*.toml' --include='*.yaml' --include='*.yml' --include='*.kyaml' --include='*.json' --include='*.rs' --include='*.ex' . 2>/dev/null | head -1 | grep -q .; then | |
| SCORE=$((SCORE + 1)) | |
| VSDB_STATUS=":white_check_mark:" | |
| else | |
| VSDB_STATUS=":ballot_box_with_check:" | |
| fi | |
| cat <<EOF >> "$GITHUB_STEP_SUMMARY" | |
| ## Dogfooding Scorecard | |
| **Score: ${SCORE}/${MAX}** | |
| | Tool/Format | Status | Notes | | |
| |-------------|--------|-------| | |
| | AI manifest (0-AI-MANIFEST.deed, or legacy .a2ml) | ${A2ML_STATUS} | Required for all RSR repos | | |
| | K9 contracts | ${K9_STATUS} | Required for repos with config files | | |
| | .editorconfig | ${EC_STATUS} | Required for all repos | | |
| | Groove endpoint | ${GROOVE_STATUS} | Required for service repos | | |
| | VeriSimDB integration | ${VSDB_STATUS} | Required for stateful repos | | |
| --- | |
| *Generated by the [Dogfood Gate](https://github.com/hyperpolymath/rsr-template-repo) workflow.* | |
| *Dogfooding is guinea pig fooding — we test our tools on ourselves.* | |
| EOF | |