ci.yml

name: aset-network-python-sqlite CI

on:
  pull_request:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  contents: read

jobs:
  strict-profile:
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout implementation
        uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - run: python -m pip install -r requirements-dev.txt

      - name: Download exact Seed Compatibility Standard assets
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          mkdir -p .aset-standard-assets
          gh release download seed-0.3.0-alpha.3 \
            --repo attractor-set/ASET \
            --dir .aset-standard-assets \
            --pattern 'ASET-Seed-0.3.0-alpha.3-Conformance-Kit.zip' \
            --pattern 'ASET-Seed-0.3.0-alpha.3-Conformance-Kit.zip.sha256' \
            --pattern 'ASET-Seed-0.3.0-alpha.3-Compatibility-Standard.json' \
            --pattern 'ASET-Seed-0.3.0-alpha.3-Conformance-Kit.manifest.json'

      - name: Verify and materialize Seed Conformance Kit
        shell: bash
        run: |
          python - <<'PY'
          import hashlib
          import shutil
          import zipfile
          from pathlib import Path, PurePosixPath

          assets = Path('.aset-standard-assets')
          kit = assets / 'ASET-Seed-0.3.0-alpha.3-Conformance-Kit.zip'
          sidecar = assets / 'ASET-Seed-0.3.0-alpha.3-Conformance-Kit.zip.sha256'
          expected = '5ecf9b93377a062b8772b4b4b44b4d76a0997d8ba98e8711e717456abbe583db'
          actual = hashlib.sha256(kit.read_bytes()).hexdigest()
          if actual != expected or sidecar.read_text(encoding='utf-8').split()[0] != expected:
              raise SystemExit('Seed Conformance Kit identity mismatch')
          target = Path('.aset-standard')
          shutil.rmtree(target, ignore_errors=True)
          target.mkdir()
          root_name = 'ASET-Seed-0.3.0-alpha.3-Conformance-Kit'
          with zipfile.ZipFile(kit) as archive:
              for info in archive.infolist():
                  path = PurePosixPath(info.filename)
                  if path.is_absolute() or '..' in path.parts or not path.parts or path.parts[0] != root_name:
                      raise SystemExit(f'unsafe Seed kit member: {info.filename}')
                  destination = target.joinpath(*path.parts)
                  if info.is_dir():
                      destination.mkdir(parents=True, exist_ok=True)
                  else:
                      destination.parent.mkdir(parents=True, exist_ok=True)
                      destination.write_bytes(archive.read(info))
          print('SEED_CONFORMANCE_KIT_RELEASE_ASSET=PASS')
          PY

      - name: Download exact published base implementation artifacts
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          mkdir -p .upstream/base-assets
          gh release download v0.1.0 \
            --repo attractor-set/aset-python-sqlite \
            --dir .upstream/base-assets \
            --pattern 'aset-python-sqlite-source.zip' \
            --pattern 'aset-python-sqlite-source.zip.sha256' \
            --pattern 'aset_python_sqlite-*.whl'

      - name: Verify and materialize base implementation
        shell: bash
        run: |
          python - <<'PY'
          import hashlib
          import shutil
          import zipfile
          from pathlib import Path, PurePosixPath

          assets = Path('.upstream/base-assets')
          source = assets / 'aset-python-sqlite-source.zip'
          expected_source = 'b36d9525facff76b9085eafa2966b2e9ee0fd82bdfcc23fedd2208b685e9c7d4'
          if hashlib.sha256(source.read_bytes()).hexdigest() != expected_source:
              raise SystemExit('base source archive identity mismatch')
          wheels = list(assets.glob('aset_python_sqlite-*.whl'))
          if len(wheels) != 1:
              raise SystemExit(f'base wheel count={len(wheels)}')
          expected_wheel = '39a58fe4b496a44937e58172120522aad6b2ea9dc9b4e287ddd6d8efb266a765'
          if hashlib.sha256(wheels[0].read_bytes()).hexdigest() != expected_wheel:
              raise SystemExit('base wheel identity mismatch')
          target = Path('.upstream')
          with zipfile.ZipFile(source) as archive:
              for info in archive.infolist():
                  path = PurePosixPath(info.filename)
                  if path.is_absolute() or '..' in path.parts or not path.parts or path.parts[0] != 'aset-python-sqlite':
                      raise SystemExit(f'unsafe base source member: {info.filename}')
                  destination = target.joinpath(*path.parts)
                  if info.is_dir():
                      destination.mkdir(parents=True, exist_ok=True)
                  else:
                      destination.parent.mkdir(parents=True, exist_ok=True)
                      destination.write_bytes(archive.read(info))
          print('BASE_RELEASE_ARTIFACTS=PASS')
          PY

      - name: Download exact Network Extension release snapshot
        env:
          GH_TOKEN: ${{ github.token }}
        shell: bash
        run: |
          mkdir -p .network-release-assets
          gh release download v0.1.0-alpha.2 \
            --repo attractor-set/aset-network-extension \
            --dir .network-release-assets \
            --pattern 'ASET-Network-Extension-Repository-Snapshot.zip' \
            --pattern 'ASET-Network-Extension-Repository-Snapshot.zip.sha256'

      - name: Verify and materialize Network Extension snapshot
        shell: bash
        run: |
          python - <<'PY'
          import hashlib
          import zipfile
          from pathlib import Path, PurePosixPath

          assets = Path('.network-release-assets')
          snapshot = assets / 'ASET-Network-Extension-Repository-Snapshot.zip'
          sidecar = assets / 'ASET-Network-Extension-Repository-Snapshot.zip.sha256'
          expected = '38f76499e56ece9b16773180462f69bf0b76f1aee28334e14fda157ef74a0855'
          actual = hashlib.sha256(snapshot.read_bytes()).hexdigest()
          if actual != expected or sidecar.read_text(encoding='utf-8').split()[0] != expected:
              raise SystemExit('Network release snapshot identity mismatch')
          target = Path('.upstream')
          with zipfile.ZipFile(snapshot) as archive:
              for info in archive.infolist():
                  path = PurePosixPath(info.filename)
                  if path.is_absolute() or '..' in path.parts or not path.parts or path.parts[0] != 'ASET-Network-Extension':
                      raise SystemExit(f'unsafe Network snapshot member: {info.filename}')
                  relative = PurePosixPath('aset-network-extension', *path.parts[1:])
                  destination = target.joinpath(*relative.parts)
                  if info.is_dir():
                      destination.mkdir(parents=True, exist_ok=True)
                  else:
                      destination.parent.mkdir(parents=True, exist_ok=True)
                      destination.write_bytes(archive.read(info))
          print('NETWORK_RELEASE_SNAPSHOT=PASS')
          PY

      - name: Install exact published base wheel and implementation under test
        shell: bash
        run: |
          base_wheel=$(find .upstream/base-assets -maxdepth 1 -name 'aset_python_sqlite-*.whl' -print -quit)
          python -m pip install --no-deps "$base_wheel"
          python -m pip install --no-deps --editable .

      - name: Run complete strict extension profile gate
        shell: bash
        run: |
          base_wheel=$(find .upstream/base-assets -maxdepth 1 -name 'aset_python_sqlite-*.whl' -print -quit)
          python tools/profile_gate.py \
            --seed-root .aset-standard/ASET-Seed-0.3.0-alpha.3-Conformance-Kit \
            --seed-kit .aset-standard-assets/ASET-Seed-0.3.0-alpha.3-Conformance-Kit.zip \
            --base-root .upstream/aset-python-sqlite \
            --base-source-archive .upstream/base-assets/aset-python-sqlite-source.zip \
            --base-wheel "$base_wheel" \
            --network-root .upstream/aset-network-extension \
            --network-snapshot .network-release-assets/ASET-Network-Extension-Repository-Snapshot.zip \
            --require-docker

      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: aset-network-python-sqlite-assurance
          if-no-files-found: warn
          path: |
            dist/aset-network-python-sqlite-source.zip
            dist/aset-network-python-sqlite-source.zip.sha256
            dist/wheel/*.whl
            dist/blackbox-release-audit.json
            dist/blackbox-release-audit.md

  demonstrator-smoke:
    needs: strict-profile
    runs-on: ubuntu-24.04
    steps:
      - name: Checkout implementation
        uses: actions/checkout@v4

      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
          cache: pip

      - name: Install demo material generator dependency
        run: python -m pip install cryptography==46.0.4

      - name: Generate ephemeral demo identities
        run: python tools/generate_demo_material.py

      - name: Start guided demonstrator
        run: docker compose -f examples/demonstrator/compose.yml up --build --detach

      - name: Exercise guided demonstrator against real nodes
        run: python tools/demonstrator_gate.py

      - name: Stop guided demonstrator
        if: always()
        run: docker compose -f examples/demonstrator/compose.yml down --volumes --remove-orphans