Add severity-override floor + policy audit (M1, v0.17) #282

	name: CI

	on:
	pull_request:
	push:
	branches:
	- main

	permissions:
	contents: read

	jobs:
	test:
	runs-on: ubuntu-latest
	timeout-minutes: 15

	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd

	- name: Set up Python
	uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
	with:
	python-version: "3.12"
	cache: pip

	- name: Install
	run: python -m pip install -e ".[dev]"

	- name: Lint
	run: python -m ruff check .

	- name: Compile
	run: python -m compileall -q src tests

	- name: Verify generated schemas are up to date
	run: python scripts/generate_schemas.py --check

	- name: Trust-model invariant lint (static, no user code execution)
	run: python -m pytest tests/test_adapter_static_only.py -q
	# Fails fast and visibly before the full suite when an adapter
	# under src/agents_shipgate/inputs/ introduces exec/eval/__import__/
	# compile or a dynamic-import surface (importlib/runpy/subprocess).
	# The companion live-load tests in tests/test_fixture_no_import.py
	# run as part of the main Test step below.

	- name: Test
	run: python -m pytest --cov=agents_shipgate --cov-report=term-missing --cov-fail-under=75

	- name: Build package
	run: \|
	python -m build
	python -m twine check dist/*

	- name: Dependency audit
	run: python -m pip_audit .

	- name: Generate SBOM
	run: cyclonedx-py environment --pyproject pyproject.toml -o sbom.json

	- name: Upload SBOM
	uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
	with:
	name: sbom
	path: sbom.json

Navigation Menu