validate.yml

name: Validate StyleGallery

on:
  workflow_dispatch:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: stylegallery-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  validate:
    name: Validate StyleGallery contracts
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Node
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install pinned validation dependencies
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Syntax and whitespace
        run: |
          node scripts/repository-source-inventory.mjs --json
          node -c scripts/component-state-workflow-contract.mjs
          node -c scripts/consumer-evidence-governance-contract.mjs
          node -c scripts/validate-governance.mjs
          node -c scripts/test-validate-governance.mjs
          node -c scripts/validate-domains.mjs
          node -c scripts/test-validate-domains.mjs
          node -c scripts/validate-design-terminology.mjs
          node -c scripts/test-validate-design-terminology.mjs
          node -c scripts/validate-consumer-reference.mjs
          node -c scripts/test-validate-consumer-reference.mjs
          node -c scripts/consumer-reference-case-runner.mjs
          node -c scripts/governed-profile-registry.mjs
          node -c scripts/promotion-attestation-contract.mjs
          node -c scripts/validate-promotion-rfc.mjs
          node -c scripts/test-validate-promotion-rfc.mjs
          node -c scripts/json-schema-formats.mjs
          node -c scripts/consumer-conformance-contract.mjs
          node -c scripts/validate-consumer-conformance.mjs
          node -c scripts/test-validate-consumer-conformance.mjs
          node -c consumer-reference/fixtures/consumer-conformance/e2e-fixture.mjs
          node -c scripts/page-evidence-contract.mjs
          node -c scripts/page-evidence-fixture.mjs
          node -c scripts/create-page-evidence-session.mjs
          node -c scripts/finalize-page-evidence.mjs
          node -c scripts/validate-page-evidence.mjs
          node -c scripts/test-validate-page-evidence.mjs
          node -c scripts/audit-evidence-freshness.mjs
          node -c scripts/test-audit-evidence-freshness.mjs
          node -c tests/fixtures/consumer-conformance-scenarios.mjs
          node -c tests/helpers/render-consumer-conformance.mjs
          node -c tests/consumer-conformance.spec.mjs
          node -c scripts/test-consumer-conformance-sentinel.mjs
          node -c scripts/baseline-schema-parity.mjs
          node -c scripts/test-component-state-source-contract.mjs
          node -e 'JSON.parse(require("fs").readFileSync("consumer-reference/schema/consumer-conformance-record.schema.json"))'
          node -e 'JSON.parse(require("fs").readFileSync("consumer-reference/schema/page-evidence-session.schema.json"))'
          node -e 'JSON.parse(require("fs").readFileSync("consumer-reference/schema/page-evidence-manifest.schema.json"))'
          node -e 'JSON.parse(require("fs").readFileSync("consumer-reference/schema/promotion-rfc.schema.json"))'
          node -e 'JSON.parse(require("fs").readFileSync("consumer-reference/policies/shared-experimental.json"))'
          node -e 'JSON.parse(require("fs").readFileSync("consumer-reference/schema/visual-evidence.schema.json"))'
          bun run test:source-inventory
          bun run test:json-schema-formats
          bun run test:consumer-conformance:matrix
          git diff --check

      - name: Generated artifacts are current
        run: |
          node scripts/generate-patterns.mjs
          node scripts/build-reference-artifacts.mjs --adapter style-dictionary --fail-on-warning --json
          node scripts/generate-consumer-reference-evidence.mjs --json
          node scripts/agent-native/v2/generate-material-registry.mjs
          git diff --exit-code

      - name: OKF structure validation
        run: |
          node scripts/validate-okf.mjs --json
          node scripts/test-validate-okf.mjs --json

      - name: Pattern contract validation
        run: |
          node scripts/validate-patterns.mjs --min-count 46 --json

      - name: Markdown link check
        run: node scripts/validate-links.mjs --json

      - name: Information architecture check
        run: |
          node scripts/validate-ia.mjs --json
          node scripts/test-validate-ia.mjs --json

      - name: Vocabulary and scannability check
        run: |
          node scripts/validate-vocabulary.mjs --json
          node scripts/test-validate-vocabulary.mjs --json

      - name: Governance lifecycle check
        run: |
          node scripts/validate-governance.mjs --json
          node scripts/test-validate-governance.mjs --json

      - name: Domain topology and provenance check
        run: |
          node scripts/validate-domains.mjs --json
          node scripts/test-validate-domains.mjs
          node scripts/validate-design-terminology.mjs --json
          node scripts/test-validate-design-terminology.mjs

      - name: Consumer reference receiver contract
        run: |
          node scripts/validate-consumer-reference.mjs --json
          node scripts/test-validate-consumer-reference.mjs --json

      - name: JSON CLI output integrity
        run: node scripts/test-json-cli-output.mjs

      - name: Agent-native operation and protocol contracts
        run: bun run test:agent-native

      - name: Source-bound material v2 contracts
        run: |
          node scripts/agent-native/v2/validate-material-registry.mjs
          node scripts/agent-native/v2/test-material-admission.mjs
          node scripts/agent-native/v2/test-material-registry.mjs
          node scripts/agent-native/v2/test-material-query.mjs
          node scripts/agent-native/v2/test-material-context.mjs
          node scripts/agent-native/v2/test-sg-material-cli.mjs
          node scripts/agent-native/v2/test-material-mcp.mjs
          node scripts/agent-native/v2/test-material-mcp-stdio.mjs
          node scripts/agent-native/v2/test-sg-material-package.mjs

      - name: Shared promotion and experimental lifecycle policy contracts
        run: |
          node scripts/validate-promotion-rfc.mjs --json
          node scripts/test-validate-promotion-rfc.mjs --json
          node scripts/validate-lifecycle-disposition.mjs --json
          node scripts/test-lifecycle-disposition.mjs

      - name: Consumer migration and page-evidence contracts
        run: |
          node scripts/test-validate-consumer-conformance.mjs --case valid-runtime-proof --json
          node scripts/test-validate-consumer-conformance.mjs --json
          node scripts/test-validate-page-evidence.mjs --json
          node scripts/test-audit-evidence-freshness.mjs --json

      - name: Portable token artifact integrity
        run: |
          node scripts/validate-reference-artifacts.mjs --manifest consumer-reference/generated/manifest.json --json
          node scripts/test-reference-adapters.mjs --json

      - name: Compound component state and evidence integrity
        run: |
          node scripts/test-component-state-source-contract.mjs
          node scripts/validate-component-state.mjs --json
          node scripts/test-validate-component-state.mjs --json
          node scripts/generate-consumer-reference-evidence.mjs --check --json
          node scripts/test-generate-consumer-reference-evidence.mjs --json

      - name: Chromium baseline manifest integrity
        run: |
          node scripts/validate-baseline-manifest.mjs --json
          node scripts/test-validate-baseline-manifest.mjs --json
          node scripts/test-calibration-raw-contract.mjs
          node scripts/test-summarize-sentinel-calibration.mjs
          node scripts/validate-renderer-purity.mjs --json
          node scripts/test-renderer-purity.mjs

      - name: Webpage workflow check
        run: |
          node scripts/validate-webpage-workflow.mjs --json
          node scripts/test-validate-webpage-workflow.mjs --json

      - name: Pattern count and category coverage
        run: node scripts/validate-catalog.mjs --json

      - name: Pattern adversarial fixtures
        run: node scripts/test-validate-patterns.mjs --json

  consumer-conformance:
    name: Consumer conformance Chromium matrix comparison
    runs-on: ubuntu-24.04
    env:
      CONSUMER_CONFORMANCE_IMAGE_ID: sha256:57b65fdc9ceabe0ef613124c7bbe2babcf9362c4d85e382fe3b03604e84b428a
    container:
      image: mcr.microsoft.com/playwright:v1.61.0-noble@sha256:57b65fdc9ceabe0ef613124c7bbe2babcf9362c4d85e382fe3b03604e84b428a
      options: --platform linux/amd64
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup pinned Node 22
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22.18.0

      - name: Install unzip for Bun setup
        run: apt-get update && apt-get install -y --no-install-recommends unzip

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install exact conformance dependencies
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Verify default inventory and cleanup boundary
        run: |
          bunx playwright test tests/consumer-conformance.spec.mjs --project=chromium --reporter=line --list
          node scripts/test-consumer-conformance-sentinel.mjs --json --case ci-cleanup-symlink

      - name: Execute authenticated full and candidate matrix comparison
        run: bun run test:consumer-conformance:matrix:execute

  consumer-page-evidence:
    name: Consumer page-evidence raster capture (nonblocking)
    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-24.04
    continue-on-error: true
    env:
      CONSUMER_CONFORMANCE_CAPTURE_DIR: .tmp/consumer-page-evidence
      PAGE_EVIDENCE_ARTIFACT_ROOT: ${{ github.workspace }}/.tmp/consumer-page-evidence-consumer/evidence/session
      PAGE_EVIDENCE_CASE_ID: state-w1024-focus
      PAGE_EVIDENCE_CONSUMER_ROOT: ${{ github.workspace }}/.tmp/consumer-page-evidence-consumer
      PAGE_EVIDENCE_PACKET_DIR: ${{ github.workspace }}/.tmp/consumer-page-evidence-packet
      PAGE_EVIDENCE_RECORD: ${{ github.workspace }}/.tmp/consumer-page-evidence-consumer/records/consumer-conformance.json
      PAGE_EVIDENCE_RUNNER_RESULT: runner/responsive-layout.json
      PAGE_EVIDENCE_SCENARIO_ID: responsive-layout
    container:
      image: mcr.microsoft.com/playwright:v1.61.0-noble@sha256:57b65fdc9ceabe0ef613124c7bbe2babcf9362c4d85e382fe3b03604e84b428a
      options: --platform linux/amd64
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Setup Node 22
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22

      - name: Install unzip for Bun setup
        run: apt-get update && apt-get install -y --no-install-recommends unzip

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install exact capture dependencies
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Prepare synthetic consumer sources
        run: >-
          node scripts/run-consumer-page-evidence-ci.mjs prepare
          --consumer-root "$PAGE_EVIDENCE_CONSUMER_ROOT"
          --record "$PAGE_EVIDENCE_RECORD"
          --artifact-root "$PAGE_EVIDENCE_ARTIFACT_ROOT"

      - name: Create source-bound page-evidence session
        run: |
          consumer_sha=$(git -C "$PAGE_EVIDENCE_CONSUMER_ROOT" rev-parse HEAD)
          env -u GITHUB_REPOSITORY -u GITHUB_HEAD_REF -u GITHUB_REF_NAME \
            GITHUB_SHA="$consumer_sha" node scripts/create-page-evidence-session.mjs \
            --root "$PAGE_EVIDENCE_CONSUMER_ROOT" \
            --record "$PAGE_EVIDENCE_RECORD" \
            --artifact-root "$PAGE_EVIDENCE_ARTIFACT_ROOT" \
            --json

      - name: Verify synthetic page-evidence identity
        run: >-
          node scripts/run-consumer-page-evidence-ci.mjs verify-session
          --consumer-root "$PAGE_EVIDENCE_CONSUMER_ROOT"
          --artifact-root "$PAGE_EVIDENCE_ARTIFACT_ROOT"

      - name: Capture the selected consumer conformance raster
        run: |
          cd "$PAGE_EVIDENCE_CONSUMER_ROOT"
          CONSUMER_CONFORMANCE_CAPTURE_DIR= bunx playwright test tests/consumer-conformance.spec.mjs --project=chromium --reporter=line --grep "state-w1024-focus"

      - name: Finalize the page-evidence session
        run: |
          review_by=$(node -e 'process.stdout.write(new Date(Date.now() + 14 * 24 * 60 * 60 * 1000).toISOString())')
          env -u GITHUB_REPOSITORY -u GITHUB_HEAD_REF -u GITHUB_REF_NAME -u GITHUB_SHA \
            node scripts/finalize-page-evidence.mjs \
            --root "$PAGE_EVIDENCE_CONSUMER_ROOT" \
            --artifact-root "$PAGE_EVIDENCE_ARTIFACT_ROOT" \
            --runner-result "$PAGE_EVIDENCE_RUNNER_RESULT" \
            --review-by "$review_by" \
            --json

      - name: Validate the completed page-evidence packet
        run: |
          env -u GITHUB_REPOSITORY -u GITHUB_HEAD_REF -u GITHUB_REF_NAME -u GITHUB_SHA \
            node scripts/validate-page-evidence.mjs \
            --root "$PAGE_EVIDENCE_CONSUMER_ROOT" \
            --artifact-root "$PAGE_EVIDENCE_ARTIFACT_ROOT" \
            --json

      - name: Package only validated page evidence
        run: >-
          node scripts/run-consumer-page-evidence-ci.mjs package
          --consumer-root "$PAGE_EVIDENCE_CONSUMER_ROOT"
          --artifact-root "$PAGE_EVIDENCE_ARTIFACT_ROOT"
          --output "$PAGE_EVIDENCE_PACKET_DIR"

      - name: Upload optional consumer page evidence
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: consumer-page-evidence-${{ github.run_id }}-${{ github.sha }}
          path: ${{ env.PAGE_EVIDENCE_PACKET_DIR }}/
          if-no-files-found: warn
          retention-days: 14

      - name: Clean up synthetic consumer
        if: always()
        run: >-
          node scripts/run-consumer-page-evidence-ci.mjs cleanup
          --consumer-root "$PAGE_EVIDENCE_CONSUMER_ROOT"

  chromium-sentinel:
    name: Chromium reference sentinel (nonblocking)
    runs-on: ubuntu-24.04
    continue-on-error: true
    container:
      image: mcr.microsoft.com/playwright:v1.61.0-noble@sha256:57b65fdc9ceabe0ef613124c7bbe2babcf9362c4d85e382fe3b03604e84b428a
      options: --platform linux/amd64
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Setup Node 22
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22

      - name: Install unzip for Bun setup
        run: apt-get update && apt-get install -y --no-install-recommends unzip

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install exact sentinel dependencies
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Run ordinary immutable Chromium sentinel
        run: bun run test:sentinel -- --reporter=line

      - name: Run Chromium sentinel semantic negative controls
        run: node scripts/test-consumer-reference-sentinel.mjs

  component-state-evidence:
    name: Chromium component-state evidence (nonblocking)
    runs-on: ubuntu-24.04
    continue-on-error: true
    env:
      STATE_EVIDENCE_ROOT: .tmp/consumer-reference-state
      SENTINEL_CONTAINER_IMAGE: mcr.microsoft.com/playwright:v1.61.0-noble@sha256:57b65fdc9ceabe0ef613124c7bbe2babcf9362c4d85e382fe3b03604e84b428a
    container:
      image: mcr.microsoft.com/playwright:v1.61.0-noble@sha256:57b65fdc9ceabe0ef613124c7bbe2babcf9362c4d85e382fe3b03604e84b428a
      options: --platform linux/amd64
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - name: Setup Node 22
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22

      - name: Install unzip for Bun setup
        run: apt-get update && apt-get install -y --no-install-recommends unzip

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install exact component-state dependencies
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Run component-state artifact and session adversarial harness
        run: node scripts/test-validate-component-state-artifacts.mjs

      - name: Capture and validate closed component-state evidence
        shell: bash
        run: |
          set -o pipefail
          node scripts/create-component-state-session.mjs \
            --output "$STATE_EVIDENCE_ROOT/capture-session.json" \
            --json
          STATE_ARTIFACT_DIR="$STATE_EVIDENCE_ROOT/runtime" \
            STATE_SESSION_RECEIPT="$STATE_EVIDENCE_ROOT/capture-session.json" \
            bun run test:component-state:runtime -- --reporter=line
          node scripts/finalize-component-state-evidence.mjs \
            --artifact-root "$STATE_EVIDENCE_ROOT" \
            --output "$STATE_EVIDENCE_ROOT/runtime-manifest.json" \
            --json
          node scripts/validate-component-state.mjs \
            --artifact-root "$STATE_EVIDENCE_ROOT" \
            --runtime-manifest "$STATE_EVIDENCE_ROOT/runtime-manifest.json" \
            --json

      - name: Run component-state runtime negative controls
        run: bun run test:component-state:runtime-negative

      - name: Upload claim-scoped component-state evidence
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: consumer-reference-state-${{ github.run_id }}-${{ github.sha }}
          path: ${{ env.STATE_EVIDENCE_ROOT }}/
          if-no-files-found: error
          retention-days: 14

  chromium-calibration:
    name: Chromium 20-run calibration (nonblocking)
    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-24.04
    continue-on-error: true
    container:
      image: mcr.microsoft.com/playwright:v1.61.0-noble@sha256:57b65fdc9ceabe0ef613124c7bbe2babcf9362c4d85e382fe3b03604e84b428a
      options: --platform linux/amd64
    steps:
      - name: Checkout
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      - name: Setup Node 22
        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
        with:
          node-version: 22

      - name: Install unzip for Bun setup
        run: apt-get update && apt-get install -y --no-install-recommends unzip

      - name: Setup Bun
        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
        with:
          bun-version: 1.3.14

      - name: Install exact calibration dependencies
        run: bun install --frozen-lockfile --ignore-scripts

      - name: Capture 20 unique raw calibration runs
        shell: bash
        env:
          SENTINEL_CONTAINER_IMAGE: mcr.microsoft.com/playwright:v1.61.0-noble@sha256:57b65fdc9ceabe0ef613124c7bbe2babcf9362c4d85e382fe3b03604e84b428a
        run: |
          set +e
          failed=0
          mkdir -p calibration-artifacts
          artifact_name="chromium-sentinel-calibration-${GITHUB_RUN_ID}-${GITHUB_SHA}"
          checkout_sha="$(git -c safe.directory="$GITHUB_WORKSPACE" rev-parse HEAD)"
          for run in $(seq 1 20); do
            run_dir="calibration-artifacts/run-$(printf '%02d' "$run")"
            mkdir -p "$run_dir"
            SENTINEL_ARTIFACT_DIR="$run_dir" SENTINEL_CALIBRATION_RUN="$run" \
              bunx playwright test tests/consumer-reference-sentinels.spec.mjs \
                --project=chromium --grep "canonical consumer reference" --reporter=json \
                > "$run_dir/playwright.json" 2> "$run_dir/playwright.stderr"
            test_exit=$?
            if [ "$test_exit" -ne 0 ]; then failed=1; fi
            printf '{"schema_version":"1.0","run":%s,"exit_code":%s}\n' "$run" "$test_exit" > "$run_dir/exit.json"
          done
          validation_output="${RUNNER_TEMP}/chromium-calibration-validation-${GITHUB_RUN_ID}.json"
          node scripts/summarize-sentinel-calibration.mjs \
            --input calibration-artifacts \
            --output calibration-artifacts/calibration.json \
            --repository "changeroa/StyleGallery" \
            --execution-repository "$GITHUB_REPOSITORY" \
            --workflow ".github/workflows/validate.yml" \
            --run-id "$GITHUB_RUN_ID" \
            --run-attempt "$GITHUB_RUN_ATTEMPT" \
            --sha "$GITHUB_SHA" \
            --checkout-sha "$checkout_sha" \
            --head-sha "${{ github.event.pull_request.head.sha || github.sha }}" \
            --artifact-name "$artifact_name" \
            --json > "$validation_output"
          summary_exit=$?
          mv "$validation_output" calibration-artifacts/calibration-validation.json
          printf '{"repository":"%s","execution_repository":"%s","run_id":"%s","sha":"%s","artifact_name":"%s","platform":"linux/amd64","architecture":"amd64","container_image":"%s"}\n' \
            "changeroa/StyleGallery" "$GITHUB_REPOSITORY" "$GITHUB_RUN_ID" "$GITHUB_SHA" "$artifact_name" "$SENTINEL_CONTAINER_IMAGE" \
            > calibration-artifacts/workflow-metadata.json
          if [ "$summary_exit" -ne 0 ]; then failed=1; fi
          exit "$failed"

      - name: Upload raw Chromium calibration evidence
        if: always()
        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
        with:
          name: chromium-sentinel-calibration-${{ github.run_id }}-${{ github.sha }}
          path: calibration-artifacts/
          if-no-files-found: error
          retention-days: 14