release: refresh audited v2.0.0 manifest #251
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Hermetic verification | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: verify-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| name: ${{ matrix.os }} / Python ${{ matrix.python }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| python: ['3.11', '3.12', '3.13', '3.14'] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 12 | |
| env: | |
| PYTHONDONTWRITEBYTECODE: '1' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: ${{ matrix.python }} | |
| - name: Show runtime versions | |
| run: | | |
| python3 --version | |
| bash --version | head -1 | |
| - name: Run hermetic suite and executable contracts | |
| run: make test | |
| - name: Prove tests did not mutate or create product files | |
| run: | | |
| git diff --exit-code | |
| test -z "$(git status --porcelain=v1 --untracked-files=all)" | |
| release-safety: | |
| name: Reproducible release artifact | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 8 | |
| needs: test | |
| env: | |
| PYTHONDONTWRITEBYTECODE: '1' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: '3.11' | |
| - name: Build and audit the public artifact twice | |
| run: | | |
| python3 scripts/claude-obsidian.py release build --output "$RUNNER_TEMP/first.zip" | |
| python3 scripts/claude-obsidian.py release build --output "$RUNNER_TEMP/second.zip" | |
| cmp "$RUNNER_TEMP/first.zip" "$RUNNER_TEMP/second.zip" | |
| python3 scripts/claude-obsidian.py release audit "$RUNNER_TEMP/first.zip" |