adversarial.yml

# Adversarial / malformed evidence seed validation.
name: adversarial

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  adversarial-seed:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4

      - name: Setup Python
        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
        with:
          python-version: "3.12"

      - name: Install uv (SHA-pinned)
        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
        with:
          enable-cache: true

      - name: Install dependencies (frozen lock required)
        run: |
          set -euo pipefail
          test -f uv.lock
          uv sync --frozen --extra dev --extra sympy
          echo "$PWD/.venv/bin" >> "$GITHUB_PATH"

      - name: Validate adversarial seed catalog
        run: python scripts/validate_adversarial_seed.py

      - name: Executable adversarial cases
        run: python scripts/run_adversarial_executable.py

      - name: Canonical JSON vector check
        run: |
          python - <<'PY'
          import json
          from pathlib import Path
          from adapters.common.canonical import canonical_dumps, sha256_digest
          path = Path("evidence/conformance/vectors/canonical_json_vectors.json")
          data = json.loads(path.read_text(encoding="utf-8"))
          for case in data["cases"]:
              assert canonical_dumps(case["input"]) == case["canonical"], case["id"]
              assert sha256_digest(case["input"]) == case["digest"], case["id"]
          print(f"canonical vectors ok ({len(data['cases'])})")
          PY