arsvin/.github/workflows/ci.yml at main · masarray/arsvin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
name: CI

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  public-content:
    name: Validate licensing, provenance, and public wording
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Verify current GPL and commercial-license boundaries
        run: python3 scripts/verify-current-license.py

      - name: Validate public terminology neutrality
        id: neutrality
        continue-on-error: true
        run: python3 scripts/validate-public-neutrality.py

      - name: Upload terminology validation evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: arsvin-public-neutrality-report
          path: artifacts/public-neutrality-report.txt
          if-no-files-found: error
          retention-days: 14

      - name: Enforce terminology validation result
        if: steps.neutrality.outcome == 'failure'
        run: exit 1

  build-test:
    name: Build, test, and validate site
    needs: public-content
    runs-on: windows-2025
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7

      - name: Setup .NET
        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
        with:
          dotnet-version: 8.0.4xx
          cache: true
          cache-dependency-path: |
            Directory.Packages.props
            src/**/packages.lock.json
            tests/**/packages.lock.json

      - name: Verify current licensing and public wording
        run: python scripts/verify-current-license.py

      - name: Build public site and HTML documentation
        run: python scripts/build-public-site.py --output artifacts/public-site

      - name: Validate public site
        shell: pwsh
        run: .\scripts\validate-public-site.ps1 -SiteRoot artifacts/public-site

      - name: Restore locked NuGet dependency graph
        run: dotnet restore ARSVIN.sln --locked-mode

      - name: Upload committed NuGet lock evidence
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: arsvin-nuget-lockfiles
          path: |
            src/**/packages.lock.json
            tests/**/packages.lock.json
          if-no-files-found: error
          retention-days: 7

      - name: Build Publisher with warnings as errors
        run: dotnet build src/ARSVIN/ARSVIN.csproj -c Release --no-restore -warnaserror

      - name: Build Subscriber with warnings as errors
        run: dotnet build src/ARSVIN.Subscriber/ARSVIN.Subscriber.csproj -c Release --no-restore -warnaserror

      - name: Test with whole-engine and protocol-core coverage gates
        shell: pwsh
        run: .\scripts\test-with-coverage.ps1 -MinimumWholeEngineLineCoverage 14.25 -MinimumLineCoverage 72.5 -NoRestore

      - name: Upload test and coverage evidence
        if: always()
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
        with:
          name: arsvin-test-evidence
          path: artifacts/test-results
          if-no-files-found: warn
          retention-days: 14

      - name: Publisher dependency vulnerability report
        run: dotnet list src/ARSVIN/ARSVIN.csproj package --vulnerable --include-transitive

      - name: Subscriber dependency vulnerability report
        run: dotnet list src/ARSVIN.Subscriber/ARSVIN.Subscriber.csproj package --vulnerable --include-transitive