ci.yml

name: CI

on:
  push:
    branches: [main, master, "release/**"]
    tags: ["v*"]
  pull_request:
    branches: [main, master, "release/**"]

jobs:
  # Local gates only: lint, types, unit/property/REST tests, evals, schema drift.
  # Does NOT certify live AKTA / PF / PCS / S3 Object Lock / remote ledger.
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        python-version: ["3.10", "3.11", "3.12"]
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up Python
        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
        with:
          python-version: ${{ matrix.python-version }}
      - name: Run CI (install, lint, typecheck, unit tests, evals)
        run: bash scripts/ci.sh

  # Institutional profile: live PostgreSQL always; live PF/PCS/AKTA when sibling
  # checkouts / org vars are configured. Fail-closed when SCOPE_REQUIRE_LIVE_CONTRACTS.
  #
  # Org/repo VARIABLES (see docs/env.institutional.example):
  #   PF_CORE_REPO | PF_CORE_REPO_CLONE_URL
  #   PCS_CORE_REPO | PCS_CORE_REPO_CLONE_URL
  #   AKTA_REPO | AKTA_REPO_CLONE_URL
  #   PF_CORE_REPO_PATH / PCS_CORE_REPO_PATH / AKTA_REPO_PATH (self-hosted)
  #   SCOPE_REQUIRE_LIVE_CONTRACTS=true
  institutional:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: scope
          POSTGRES_PASSWORD: scope
          POSTGRES_DB: scope
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U scope -d scope"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Optional sibling checkouts
        env:
          PF_CORE_REPO: ${{ vars.PF_CORE_REPO }}
          PF_CORE_REPO_CLONE_URL: ${{ vars.PF_CORE_REPO_CLONE_URL }}
          PCS_CORE_REPO: ${{ vars.PCS_CORE_REPO }}
          PCS_CORE_REPO_CLONE_URL: ${{ vars.PCS_CORE_REPO_CLONE_URL }}
          AKTA_REPO: ${{ vars.AKTA_REPO }}
          AKTA_REPO_CLONE_URL: ${{ vars.AKTA_REPO_CLONE_URL }}
          PF_CORE_REPO_PATH_VAR: ${{ vars.PF_CORE_REPO_PATH }}
          PCS_CORE_REPO_PATH_VAR: ${{ vars.PCS_CORE_REPO_PATH }}
          AKTA_REPO_PATH_VAR: ${{ vars.AKTA_REPO_PATH }}
          SCOPE_REQUIRE_LIVE_CONTRACTS: ${{ vars.SCOPE_REQUIRE_LIVE_CONTRACTS }}
        run: |
          set -euo pipefail
          mkdir -p "$HOME/siblings"

          resolve_clone() {
            local a="${1:-}" b="${2:-}"
            if [ -n "$a" ]; then echo "$a"; elif [ -n "$b" ]; then echo "$b"; else echo ""; fi
          }

          clone_or_path() {
            local label="$1" clone_url="$2" path_var="$3" dest="$4" env_name="$5"
            if [ -n "$clone_url" ]; then
              git clone --depth 1 "$clone_url" "$dest"
              echo "${env_name}=$dest" >> "$GITHUB_ENV"
              echo "Configured ${env_name} via clone ($label)"
            elif [ -n "$path_var" ]; then
              echo "${env_name}=$path_var" >> "$GITHUB_ENV"
              echo "Configured ${env_name} via pre-mounted path ($label)"
            else
              echo "No clone URL or path for $label"
              if [ "${SCOPE_REQUIRE_LIVE_CONTRACTS:-}" = "true" ] || [ "${SCOPE_REQUIRE_LIVE_CONTRACTS:-}" = "1" ] || [ "${SCOPE_REQUIRE_LIVE_CONTRACTS:-}" = "institutional" ]; then
                echo "SCOPE_REQUIRE_LIVE_CONTRACTS requires ${env_name} (set ${label} clone URL or path org var)" >&2
                exit 1
              fi
            fi
          }

          PF_URL="$(resolve_clone "${PF_CORE_REPO:-}" "${PF_CORE_REPO_CLONE_URL:-}")"
          PCS_URL="$(resolve_clone "${PCS_CORE_REPO:-}" "${PCS_CORE_REPO_CLONE_URL:-}")"
          AKTA_URL="$(resolve_clone "${AKTA_REPO:-}" "${AKTA_REPO_CLONE_URL:-}")"

          clone_or_path "PF_CORE_REPO|PF_CORE_REPO_CLONE_URL" "$PF_URL" "${PF_CORE_REPO_PATH_VAR:-}" "$HOME/siblings/pf-core" "PF_CORE_REPO_PATH"
          clone_or_path "PCS_CORE_REPO|PCS_CORE_REPO_CLONE_URL" "$PCS_URL" "${PCS_CORE_REPO_PATH_VAR:-}" "$HOME/siblings/pcs-core" "PCS_CORE_REPO_PATH"
          clone_or_path "AKTA_REPO|AKTA_REPO_CLONE_URL" "$AKTA_URL" "${AKTA_REPO_PATH_VAR:-}" "$HOME/siblings/akta" "AKTA_REPO_PATH"
      - name: Set up Python
        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
        with:
          python-version: "3.12"
      - name: Run institutional CI profile
        env:
          SCOPE_CI_PROFILE: institutional
          SCOPE_REQUIRE_LIVE_POSTGRES: "true"
          SCOPE_LEDGER_DATABASE_URL: postgresql://scope:scope@localhost:5432/scope
          SCOPE_LEDGER_BACKEND: postgres
          SCOPE_REQUIRE_LIVE_CONTRACTS: ${{ vars.SCOPE_REQUIRE_LIVE_CONTRACTS }}
        run: bash scripts/ci.sh --institutional

  # Backward-compatible alias job: live contracts only (no Postgres). Prefer
  # the institutional job for full institutional readiness.
  live-ecosystem:
    runs-on: ubuntu-latest
    if: >-
      vars.PF_CORE_REPO_PATH != '' ||
      vars.PCS_CORE_REPO_PATH != '' ||
      vars.AKTA_REPO_PATH != '' ||
      vars.SCOPE_REQUIRE_LIVE_CONTRACTS == 'true' ||
      vars.PF_CORE_REPO != '' ||
      vars.PCS_CORE_REPO != '' ||
      vars.AKTA_REPO != '' ||
      vars.PF_CORE_REPO_CLONE_URL != '' ||
      vars.PCS_CORE_REPO_CLONE_URL != '' ||
      vars.AKTA_REPO_CLONE_URL != ''
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Optional sibling checkouts
        env:
          PF_CORE_REPO: ${{ vars.PF_CORE_REPO }}
          PF_CORE_REPO_CLONE_URL: ${{ vars.PF_CORE_REPO_CLONE_URL }}
          PCS_CORE_REPO: ${{ vars.PCS_CORE_REPO }}
          PCS_CORE_REPO_CLONE_URL: ${{ vars.PCS_CORE_REPO_CLONE_URL }}
          AKTA_REPO: ${{ vars.AKTA_REPO }}
          AKTA_REPO_CLONE_URL: ${{ vars.AKTA_REPO_CLONE_URL }}
          PF_CORE_REPO_PATH_VAR: ${{ vars.PF_CORE_REPO_PATH }}
          PCS_CORE_REPO_PATH_VAR: ${{ vars.PCS_CORE_REPO_PATH }}
          AKTA_REPO_PATH_VAR: ${{ vars.AKTA_REPO_PATH }}
          SCOPE_REQUIRE_LIVE_CONTRACTS: ${{ vars.SCOPE_REQUIRE_LIVE_CONTRACTS }}
        run: |
          set -euo pipefail
          mkdir -p "$HOME/siblings"
          resolve_clone() {
            local a="${1:-}" b="${2:-}"
            if [ -n "$a" ]; then echo "$a"; elif [ -n "$b" ]; then echo "$b"; else echo ""; fi
          }
          clone_or_path() {
            local label="$1" clone_url="$2" path_var="$3" dest="$4" env_name="$5"
            if [ -n "$clone_url" ]; then
              git clone --depth 1 "$clone_url" "$dest"
              echo "${env_name}=$dest" >> "$GITHUB_ENV"
            elif [ -n "$path_var" ]; then
              echo "${env_name}=$path_var" >> "$GITHUB_ENV"
            else
              if [ "${SCOPE_REQUIRE_LIVE_CONTRACTS:-}" = "true" ] || [ "${SCOPE_REQUIRE_LIVE_CONTRACTS:-}" = "1" ] || [ "${SCOPE_REQUIRE_LIVE_CONTRACTS:-}" = "institutional" ]; then
                echo "SCOPE_REQUIRE_LIVE_CONTRACTS requires ${env_name}" >&2
                exit 1
              fi
            fi
          }
          PF_URL="$(resolve_clone "${PF_CORE_REPO:-}" "${PF_CORE_REPO_CLONE_URL:-}")"
          PCS_URL="$(resolve_clone "${PCS_CORE_REPO:-}" "${PCS_CORE_REPO_CLONE_URL:-}")"
          AKTA_URL="$(resolve_clone "${AKTA_REPO:-}" "${AKTA_REPO_CLONE_URL:-}")"
          clone_or_path "PF" "$PF_URL" "${PF_CORE_REPO_PATH_VAR:-}" "$HOME/siblings/pf-core" "PF_CORE_REPO_PATH"
          clone_or_path "PCS" "$PCS_URL" "${PCS_CORE_REPO_PATH_VAR:-}" "$HOME/siblings/pcs-core" "PCS_CORE_REPO_PATH"
          clone_or_path "AKTA" "$AKTA_URL" "${AKTA_REPO_PATH_VAR:-}" "$HOME/siblings/akta" "AKTA_REPO_PATH"
      - name: Set up Python
        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
        with:
          python-version: "3.12"
      - name: Install SCOPE (contracts first)
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e "./scientific-authorization-contracts"
          python -m pip install -e ".[dev]"
      - name: Enforce institutional live-contract profile
        if: vars.SCOPE_REQUIRE_LIVE_CONTRACTS == 'true'
        env:
          SCOPE_REQUIRE_LIVE_CONTRACTS: "true"
        run: |
          set -euo pipefail
          for var in PF_CORE_REPO_PATH PCS_CORE_REPO_PATH AKTA_REPO_PATH; do
            if [ -z "${!var:-}" ] || [ ! -d "${!var}" ]; then
              echo "Institutional profile requires $var" >&2
              exit 1
            fi
          done
      - name: Live contract tests
        env:
          SCOPE_REQUIRE_LIVE_CONTRACTS: ${{ vars.SCOPE_REQUIRE_LIVE_CONTRACTS }}
        run: pytest tests/test_live_contracts.py -m live_contract -v

  # Fail-closed dependency audit on release branches.
  dependency-audit:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/heads/release/') || startsWith(github.base_ref, 'release/') || contains(github.ref, 'release/')
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up Python
        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
        with:
          python-version: "3.12"
      - name: Install packages then audit
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e "./scientific-authorization-contracts"
          python -m pip install -e ".[dev]"
          python -m pip install pip-audit
          pip-audit --strict

  codeql:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
      actions: read
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Initialize CodeQL
        uses: github/codeql-action/init@a65a038433a26f4363cf9f029e3b9ceac831ad5d # v3.28.10
        with:
          languages: python
      - name: Autobuild
        uses: github/codeql-action/autobuild@a65a038433a26f4363cf9f029e3b9ceac831ad5d # v3.28.10
      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@a65a038433a26f4363cf9f029e3b9ceac831ad5d # v3.28.10

  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Generate SBOM
        uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
        with:
          path: .
          format: spdx-json
          output-file: sbom.spdx.json
      - name: Upload SBOM artifact
        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
        with:
          name: sbom-spdx
          path: sbom.spdx.json

  # Release tags (refs/tags/v*): mandatory gates — not skippable via repo vars.
  release-acceptance:
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: scope
          POSTGRES_PASSWORD: scope
          POSTGRES_DB: scope
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U scope -d scope"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up Python
        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
        with:
          python-version: "3.12"
      - name: Install SCOPE (contracts first)
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e "./scientific-authorization-contracts"
          python -m pip install -e ".[dev,postgres]"
      - name: Contract wheel identity
        env:
          SCOPE_REQUIRE_LIVE_CONTRACTS: "true"
        run: pytest tests/test_contract_wheel_identity.py -v
      - name: Acceptance suite
        run: pytest tests/test_scope_2_2_acceptance.py -v
      - name: Live Postgres ledger tests
        env:
          SCOPE_REQUIRE_LIVE_POSTGRES: "true"
          SCOPE_LEDGER_DATABASE_URL: postgresql://scope:scope@localhost:5432/scope
          SCOPE_LEDGER_BACKEND: postgres
        run: pytest -m live_postgres -v
      - name: AKTA wheel interop (fail-closed on tags)
        env:
          SCOPE_REQUIRE_LIVE_CONTRACTS: "true"
          AKTA_REPO_PATH: ${{ vars.AKTA_REPO_PATH }}
          AKTA_WHEEL_PATH: ${{ vars.AKTA_WHEEL_PATH }}
        run: |
          set -euo pipefail
          if [ -n "${AKTA_WHEEL_PATH:-}" ] && [ -f "${AKTA_WHEEL_PATH}" ]; then
            python -m pip install "${AKTA_WHEEL_PATH}"
          fi
          pytest tests/test_akta_wheel_interop.py -v
          python scripts/run_akta_interop_conformance.py

  # SCOPE 2.2: on release tags, force acceptance + wheel identity + interop
  # regardless of optional live-ecosystem org vars (fail closed if AKTA missing).
  release-gate:
    runs-on: ubuntu-latest
    if: startsWith(github.ref, 'refs/tags/')
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: scope
          POSTGRES_PASSWORD: scope
          POSTGRES_DB: scope
        ports:
          - 5432:5432
        options: >-
          --health-cmd "pg_isready -U scope -d scope"
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Set up Python
        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
        with:
          python-version: "3.12"
      - name: Install contracts then SCOPE
        run: |
          python -m pip install --upgrade pip
          python -m pip install -e "./scientific-authorization-contracts"
          python -m pip install -e ".[dev,postgres]"
      - name: Contract wheel identity + 2.2 acceptance
        run: |
          pytest tests/test_contract_wheel_identity.py tests/test_scope_2_2_acceptance.py \
            tests/test_operation_covers_properties.py tests/test_control_evidence_fail_closed.py -v
      - name: PostgreSQL ledger tests
        env:
          SCOPE_REQUIRE_LIVE_POSTGRES: "true"
          SCOPE_LEDGER_DATABASE_URL: postgresql://scope:scope@localhost:5432/scope
          SCOPE_LEDGER_BACKEND: postgres
        run: pytest tests/test_postgres_ledger.py -m live_postgres -v || pytest tests -k postgres -v --maxfail=5
      - name: Clean-venv package smoke
        run: python scripts/check_clean_venv_imports.py
      - name: AKTA interop (fail closed on tags)
        env:
          SCOPE_REQUIRE_AKTA_INTEROP: "release"
        run: |
          python scripts/run_akta_interop_conformance.py
          pytest tests/test_akta_wheel_interop.py -v
      - name: Dependency audit
        run: |
          python -m pip install pip-audit
          pip-audit --strict