scpn-control/.github/workflows/ci.yml at main · anulum/scpn-control · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
# SPDX-License-Identifier: AGPL-3.0-or-later
# Commercial license available
# © Concepts 1996–2026 Miroslav Šotek. All rights reserved.
# © Code 2020–2026 Miroslav Šotek. All rights reserved.
# ORCID: 0009-0009-3560-0851
# Contact: www.anulum.li | protoscience@anulum.li
# SCPN Control — CI coordinator and stable aggregate gate.

name: CI

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions: {}

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: true

jobs:
  static-governance:
    uses: ./.github/workflows/ci-static-governance.yml

  python-quality:
    uses: ./.github/workflows/ci-python-quality.yml
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  build-package:
    uses: ./.github/workflows/ci-build-package.yml

  native-polyglot:
    uses: ./.github/workflows/ci-native-polyglot.yml

  native-coverage:
    needs: [python-quality, native-polyglot]
    uses: ./.github/workflows/ci-native-coverage.yml
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  evidence-reproducibility:
    uses: ./.github/workflows/ci-evidence-reproducibility.yml

  python-benchmark:
    needs: python-quality
    uses: ./.github/workflows/ci-python-benchmark.yml

  rust-benchmark:
    uses: ./.github/workflows/ci-rust-benchmark.yml

  security-supply-chain:
    uses: ./.github/workflows/ci-security-supply-chain.yml

  product-deployment:
    uses: ./.github/workflows/ci-product-deployment.yml
    secrets:
      SCPN_CONTROL_STUDIO_DEPLOY_KEY: ${{ secrets.SCPN_CONTROL_STUDIO_DEPLOY_KEY }}
      SCPN_CONTROL_STUDIO_KNOWN_HOSTS: ${{ secrets.SCPN_CONTROL_STUDIO_KNOWN_HOSTS }}

  ci-gate:
    needs:
      - static-governance
      - python-quality
      - build-package
      - native-polyglot
      - native-coverage
      - evidence-reproducibility
      - python-benchmark
      - rust-benchmark
      - security-supply-chain
      - product-deployment
    runs-on: ubuntu-latest
    if: always()
    steps:
      - name: Require every CI responsibility to pass
        env:
          CATEGORY_RESULTS: ${{ toJSON(needs) }}
        run: |
          python - <<'PY'
          import json
          import os

          results = json.loads(os.environ["CATEGORY_RESULTS"])
          failures = {
              name: value["result"]
              for name, value in results.items()
              if value["result"] != "success"
          }
          if failures:
              raise SystemExit(f"CI category gate failed: {failures}")
          print("CI category gate passed")
          PY