fix(loopops): enforce maxRuntimeMinutes, real evaluators, maxAttempts… #44

	name: Niyam CI

	on:
	push:
	branches: [ main ]
	pull_request:
	branches: [ main ]

	permissions:
	contents: read
	id-token: write
	attestations: write

	jobs:
	niyam-verify:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4
	with:
	fetch-depth: 0 # Essential for git diff target branch checks

	- name: Set up Python
	uses: actions/setup-python@v5
	with:
	python-version: '3.11'
	cache: 'pip'

	- name: Install dependencies and SBOM Tool
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"
	curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh \| sh -s -- -b /usr/local/bin

	- name: Run Tests
	run: \|
	pytest tests/test_init.py tests/test_cli.py tests/test_scan.py tests/test_governance_smoke.py

	- name: Run Niyam Readiness Scan (Dogfooding)
	run: \|
	# Use the baseline to ignore existing findings in documentation/fixtures
	niyam scan . --baseline .niyam/scan-baseline.json --fail-on critical

	- name: Generate Evidence Report
	run: \|
	niyam evidence . --output niyam-readiness-report.md

	- name: Run Niyam CI Verification
	run: \|
	niyam ci verify --target main --strict

	- name: Generate SBOM
	run: \|
	syft . -o spdx-json=sbom.spdx.json

	- name: Attest Build Provenance
	uses: actions/attest-build-provenance@v1
	with:
	subject-path: 'sbom.spdx.json'

	- name: Upload Evidence Artifacts
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: niyam-evidence
	path: \|
	niyam-readiness-report.md
	.niyam/runs/**/evidence.md
	.niyam/runs/**/mission-plan.yaml
	sbom.spdx.json
	retention-days: 14

Navigation Menu