oikosbot/.github/workflows/ci.yml at main · hyperpolymath/oikosbot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
# This workflow is managed by gh actions-lock.
# SPDX-License-Identifier: MPL-2.0
# This workflow is managed by gh actions-lock.
# SPDX-FileCopyrightText: 2025 Jonathan D.A. Jewell
#
# OikosBot - Continuous Integration

name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
permissions: read-all
jobs:
  haskell:
    name: Haskell Analyzer
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1
      - name: Setup Haskell
        uses: haskell-actions/setup@v2.12.1
        with:
          ghc-version: "9.4"
          cabal-version: "3.10"
      - name: Cache Cabal
        uses: actions/cache@v6.1.0
        with:
          path: |
            ~/.cabal/packages
            ~/.cabal/store
            analyzers/code-haskell/dist-newstyle
          key: cabal-${{ runner.os }}-ghc9.4-${{ hashFiles('analyzers/code-haskell/oikos-analyzer.cabal') }}
      - name: Build Haskell analyzer
        working-directory: analyzers/code-haskell
        run: |
          cabal update
          cabal build all
      - name: Test Haskell analyzer
        working-directory: analyzers/code-haskell
        run: cabal test all
  rust:
    name: Rust Workspace
    runs-on: ubuntu-latest
    timeout-minutes: 20
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1
      - name: Cache cargo
        uses: actions/cache@v6.1.0
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            target
          key: cargo-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
      # Uses the runner's preinstalled stable toolchain (no third-party action).
      # NB: the default workspace deliberately EXCLUDES crates/oikosbot-fleet so
      # OikosBot builds with no dependency on hyperpolymath/gitbot-fleet.
      - name: Format check
        run: cargo fmt --check
      - name: Build (standalone workspace)
        run: cargo build --workspace --locked
      - name: Test (standalone workspace)
        run: cargo test --workspace --locked
      - name: Eclexia adapter feature and rejection checks
        run: bash tests/test-eclexia-adapter.sh
      - name: Clippy (informational)
        run: cargo clippy --workspace
        continue-on-error: true
  affine:
    name: AffineScript Scaffold
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1
      - name: Check shell wrapper syntax
        run: bash -n bot-integration-affine/check.sh
  security:
    name: Security Checks
    runs-on: ubuntu-latest
    timeout-minutes: 15
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7.0.1
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@v0.36.0
        with:
          scan-type: "fs"
          scan-ref: "."
          severity: "CRITICAL,HIGH"
          format: "sarif"
          output: "trivy-results.sarif"
        continue-on-error: true
      - name: Upload Trivy scan results
        uses: github/codeql-action/upload-sarif@v4.38.1
        with:
          sarif_file: "trivy-results.sarif"
        continue-on-error: true