fix(lint): drop gitignored candidates from ambiguous wikilink resolution #266
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Hermetic verification | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: verify-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test: | |
| name: ${{ matrix.os }} / Python ${{ matrix.python }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: [ubuntu-latest, macos-latest] | |
| python: ['3.11', '3.12', '3.13', '3.14'] | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 12 | |
| env: | |
| PYTHONDONTWRITEBYTECODE: '1' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: ${{ matrix.python }} | |
| - name: Show runtime versions | |
| run: | | |
| python3 --version | |
| bash --version | head -1 | |
| - name: Run hermetic suite and executable contracts | |
| run: make test | |
| - name: Prove tests did not mutate or create product files | |
| run: | | |
| git diff --exit-code | |
| test -z "$(git status --porcelain=v1 --untracked-files=all)" | |
| windows-smoke: | |
| # The full suite exercises dirfd confinement, symlinks, fcntl, and bash — | |
| # deliberately unsupported on native Windows. This job runs the portable | |
| # surface (schema/package/contract validation plus the Windows | |
| # compatibility suite) as an explicit allowlist so a skip can never be | |
| # mistaken for a pass. | |
| name: windows-latest / Python 3.12 (portable surface) | |
| runs-on: windows-latest | |
| timeout-minutes: 10 | |
| env: | |
| PYTHONDONTWRITEBYTECODE: '1' | |
| defaults: | |
| run: | |
| shell: bash | |
| steps: | |
| - name: Disable line-ending translation before checkout | |
| # The runner image ships autocrlf=true globally; frontmatter parsing | |
| # and content hashing require byte-exact LF checkouts. Must run | |
| # before actions/checkout writes any file. | |
| run: git config --global core.autocrlf false | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: '3.12' | |
| - name: Show runtime versions | |
| run: python --version | |
| - name: Run portable-surface tests | |
| run: | | |
| set -eu | |
| for test_file in \ | |
| tests/test_package_validation.py \ | |
| tests/test_knowledge_contracts.py \ | |
| tests/test_contracts.py \ | |
| tests/test_benchmark_tools.py \ | |
| tests/test_windows_compat.py; do | |
| echo "=== $test_file ===" | |
| python "$test_file" | |
| done | |
| - name: Run portable validators | |
| run: | | |
| python scripts/claude-obsidian.py package validate | |
| python scripts/claude-obsidian.py contracts --check-only | |
| - name: Prove tests did not mutate or create product files | |
| run: | | |
| git diff --exit-code | |
| test -z "$(git status --porcelain=v1 --untracked-files=all)" | |
| release-safety: | |
| name: Reproducible release artifact | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 8 | |
| needs: test | |
| env: | |
| PYTHONDONTWRITEBYTECODE: '1' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Set up Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: '3.11' | |
| - name: Build and audit the public artifact twice | |
| run: | | |
| python3 scripts/claude-obsidian.py release build --output "$RUNNER_TEMP/first.zip" | |
| python3 scripts/claude-obsidian.py release build --output "$RUNNER_TEMP/second.zip" | |
| cmp "$RUNNER_TEMP/first.zip" "$RUNNER_TEMP/second.zip" | |
| python3 scripts/claude-obsidian.py release audit "$RUNNER_TEMP/first.zip" |