agent-control-standard/.github/workflows/reference-implementation.yml at integration · GenAI-Security-Project/agent-control-standard · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# Runs the reference implementation's own tests and type check.
#
# The tree under reference-implementations/agt/ arrived with roughly 2,900 lines of
# tests, a pinned-upstream verifier, and a conformance harness, and none of it ran in
# this repository. The `test` job in deploy-pages.yml runs pytest, which collects only
# `tests/` per `testpaths` in pyproject.toml, so a TypeScript regression here would have
# reached main with every check green.
#
# No workflow expression appears inside a `run:` block. The two that appear in the
# concurrency group are an integer pull request number and a ref name GitHub validates,
# and a concurrency group is not a shell context.
#
# Scoped by path. A documentation change should not pay for a Bun install. A schema change
# does, because this tree reads the schemas at runtime.
name: Reference implementation

on:
  pull_request:
    paths:
      - "reference-implementations/**"
      # The conformance checker and the trace exporter read the schemas and
      # the Trace mappings at runtime, so a spec-only change can break them.
      - "specification/**"
      - ".github/workflows/reference-implementation.yml"
  push:
    branches: ["main", "integration"]
    paths:
      - "reference-implementations/**"
      # The conformance checker and the trace exporter read the schemas and
      # the Trace mappings at runtime, so a spec-only change can break them.
      - "specification/**"
      - ".github/workflows/reference-implementation.yml"
  workflow_dispatch:

permissions: {}

concurrency:
  group: reference-implementation-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  agt:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    defaults:
      run:
        working-directory: reference-implementations/agt
    steps:
      - name: Check out the repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          # Nothing here pushes with git, so the checkout's token has no reason to
          # stay behind in .git/config.
          persist-credentials: false

      # Pinned to an exact version rather than a moving major. The bridge in
      # packages/agt-bridge/src/opa-path.ts works around a Bun defect measured on a
      # specific version, so the runtime version is part of this tree's contract
      # rather than an implementation detail.
      - name: Install Bun
        uses: oven-sh/setup-bun@735343b667d3e6f658f44d0eca948eb6282f2b76 # v2.0.2
        with:
          bun-version: "1.3.11"

      - name: Install dependencies from the lockfile
        run: bun install --frozen-lockfile

      # The test helpers delete fixture directories with `trash` rather than `rm -rf`,
      # a deliberate safety choice by the author. `trash` is not an npm dependency of
      # this tree and `bun install` never provides it, so 26 tests fail on any machine
      # without it, including a clean runner. Pinned to an exact version because an
      # unpinned global install is a supply-chain surface. The undeclared dependency
      # itself is tracked as an issue rather than papered over here.
      - name: Install the trash CLI the test helpers shell out to
        run: bun add --global trash-cli@7.2.0

      - name: Type check
        run: bun run typecheck

      # Every envelope validates against ../../../../../specification/v0.1.0/ by
      # relative path, so this also proves the implementation still matches the
      # schemas in this repository rather than a copy of them.
      - name: Run the tests
        run: bun test