Repository navigation
fix(work_context): the verifier reads core's wire — a protobuf WorkContextV1 payload, not JSON #41
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.10", "3.12"] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - run: python -m pip install --upgrade pip | |
| - run: pip install -e ".[test,revision-connect,revision-grpc]" | |
| # Runs the Work Context wire-golden parity test, which pins the token | |
| # byte-for-byte to sdk-go's TestWorkContextWireGolden. | |
| - run: python -m pytest -q | |
| # src/saas_sdk/_gen must be exactly what scripts/generate.sh produces from the | |
| # proto ref recorded in SOURCE.txt: buf builds the image, strip_options.py | |
| # strips the custom options and shared descriptors, and buf.gen.yaml's remote | |
| # plugins (versions pinned there) write the bindings. A stale or edited | |
| # binding shows up as a diff. | |
| gen-drift: | |
| runs-on: ubuntu-latest | |
| env: | |
| # buf compiles the proto image the plugins consume. Pinned so a buf | |
| # release cannot move the tree; bump deliberately, as its own change. | |
| BUF_VERSION: 1.73.0 | |
| # strip_options.py rewrites the image with the protobuf runtime. Pinned | |
| # to the gencode line the bindings are built with (pyproject floor). | |
| PROTOBUF_VERSION: 5.29.3 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| path: sdk | |
| - name: read the recorded source ref | |
| id: source | |
| run: | | |
| set -euo pipefail | |
| line=$(grep -m1 -oE 'codefly-dev/module-saas-starter@v[0-9]+\.[0-9]+\.[0-9]+$' sdk/SOURCE.txt || true) | |
| if [ -z "$line" ]; then | |
| echo "::error file=SOURCE.txt::no 'codefly-dev/module-saas-starter@v<major>.<minor>.<patch>' release tag found" | |
| exit 1 | |
| fi | |
| proto=$(grep -m1 -oE 'accounts public proto: [^)]+' sdk/SOURCE.txt | sed 's/^accounts public proto: //') | |
| if [ -z "$proto" ]; then | |
| echo "::error file=SOURCE.txt::no '(accounts public proto: <path>)' line found" | |
| exit 1 | |
| fi | |
| echo "ref=${line#*@}" >> "$GITHUB_OUTPUT" | |
| echo "proto=$proto" >> "$GITHUB_OUTPUT" | |
| echo "source: codefly-dev/module-saas-starter@${line#*@} ($proto)" | |
| # The source repo is public, so the default token is enough. | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| repository: codefly-dev/module-saas-starter | |
| ref: ${{ steps.source.outputs.ref }} | |
| path: source | |
| sparse-checkout: ${{ steps.source.outputs.proto }} | |
| sparse-checkout-cone-mode: false | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - run: python -m pip install "protobuf==${PROTOBUF_VERSION}" | |
| - uses: bufbuild/buf-action@85aebf73123b5c15fd5528aaecbf9129cddf7fa7 # v1.6.0 | |
| with: | |
| version: ${{ env.BUF_VERSION }} | |
| setup_only: true | |
| - name: regenerate src/saas_sdk/_gen | |
| run: sdk/scripts/generate.sh "source/${{ steps.source.outputs.proto }}" | |
| - name: require no drift | |
| working-directory: sdk | |
| run: | | |
| set -euo pipefail | |
| if [ -z "$(git status --porcelain)" ]; then | |
| echo "src/saas_sdk/_gen reproduces byte-for-byte from module-saas-starter@${{ steps.source.outputs.ref }}" | |
| exit 0 | |
| fi | |
| echo "::error::src/saas_sdk/_gen does not match a regeneration from the ref in SOURCE.txt. Never hand-edit _gen/: regenerate it with scripts/generate.sh (README, Regenerating), or correct SOURCE.txt if it records the wrong ref." | |
| git status --short | |
| git add -A -N | |
| git --no-pager diff --stat | |
| git --no-pager diff | head -n 400 | |
| exit 1 |