lm15-java/.github/workflows/java.yml at main · lm15-dev/lm15-java · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
name: java

on:
  push:
  pull_request:

# The test pipeline only reads the checkout; never grant it more.
permissions:
  contents: read

jobs:
  test:
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest]
        java: ['21', '25']
        include:
          - os: macos-15
            java: '21'
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: ${{ matrix.java }}
          cache: maven
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Check out pinned contract
        # Cross-repo gate: the lm15-contract vet harness grades this checkout
        # at the SHA pinned in CONTRACT_PIN (playbooks/port.md rule 1). The
        # contract's shim registry expects the port at the sibling path
        # ../lm15-java.
        run: |
          PIN=$(tr -d '[:space:]' < CONTRACT_PIN)
          [[ "$PIN" =~ ^[0-9a-f]{40}$ ]] || { echo 'Invalid CONTRACT_PIN'; exit 1; }
          git clone --no-checkout https://github.com/lm15-dev/lm15-contract.git ../lm15-contract
          git -C ../lm15-contract checkout --detach "$PIN"
          if [ ! -e ../lm15-java ]; then
            ln -s "$GITHUB_WORKSPACE" ../lm15-java
          fi
      - name: Build and unit tests
        run: mvn -B -q package
      - name: Use the packaged JAR outside the checkout
        shell: bash
        run: |
          smoke_dir=$(mktemp -d)
          cp target/lm15.jar examples/Offline.java "$smoke_dir/"
          cd "$smoke_dir"
          javac -cp lm15.jar Offline.java
          java -cp "lm15.jar:." Offline
      - name: Contract harness (pinned)
        run: python3 tools/check_contract.py --contract ../lm15-contract --direction all
      - name: Compare independent requests with pinned reference
        shell: bash
        run: |
          git clone --no-checkout https://github.com/lm15-dev/lm15-python.git ../lm15-python
          git -C ../lm15-python checkout --detach 3bbbd3ee1bab40a1a61cc74db120c4a8eb7eb22b
          python3 tools/differential.py --contract ../lm15-contract --python-repo ../lm15-python --verify-documented-fixes
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: java-validation-${{ matrix.os }}-${{ matrix.java }}
          path: |
            target/surefire-reports/
            harness-reports/
      - name: Contract checkout stays clean
        if: always()
        run: |
          test -d ../lm15-contract/.git
          test -z "$(git -C ../lm15-contract status --porcelain --untracked-files=all)"