test: stub the model in the require-policy tests #72
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| pull_request: | |
| jobs: | |
| python: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| python-version: ["3.10", "3.12"] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| # Project is stdlib-only; no pip install needed. Node is present so | |
| # tests/test_jail.py (the path-jail security boundary) actually runs | |
| # instead of self-skipping -- jail.mjs has zero npm dependencies, so | |
| # a bare `node` on PATH is all it needs. | |
| # | |
| # Same reasoning for bubblewrap: it is the Linux mechanism behind | |
| # core/sandbox.py, and without it tests/test_sandbox.py's | |
| # exploit-regression class has no sandbox to assert against. That class | |
| # now ERRORS rather than skipping when no mechanism exists, so this step | |
| # is what keeps the HIGH-severity guard (model-authored scripts must not | |
| # reach credentials or the network) actually enforced in CI. | |
| - name: Install bubblewrap (Linux OS sandbox for model-authored scripts) | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y bubblewrap | |
| # Ubuntu 24.04 restricts unprivileged user namespaces by default, | |
| # which bwrap requires; without this it fails with | |
| # "Creating new namespace failed: Operation not permitted". | |
| sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 || true | |
| # Fail fast and loudly here rather than as a confusing test error. | |
| bwrap --ro-bind / / --unshare-net -- /bin/true | |
| echo "bwrap functional" | |
| - run: python3 -m unittest discover -s tests | |
| ui: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-node@v4 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| cache-dependency-path: ui/package-lock.json | |
| - working-directory: ui | |
| run: npm ci | |
| - working-directory: ui | |
| run: npx tsc --noEmit | |
| - working-directory: ui | |
| run: npm run build | |
| bench-selftest: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| # Zero API spend, no secrets: proves every A/B safety scorer still | |
| # discriminates its good ref from its bad ref before anyone trusts a | |
| # live benchmark run against it. | |
| - run: python3 -m evals.ab.run --selftest | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - run: pipx run --spec 'ruff==0.15.22' ruff check . | |
| installer: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run install.sh against this checkout | |
| run: | | |
| export CODECOUNCIL_HOME="$RUNNER_TEMP/cc-home" | |
| export CODECOUNCIL_REPO_URL="file://$GITHUB_WORKSPACE" | |
| sh install.sh | |
| test -x "$HOME/.local/bin/codecouncil" | |
| test -f "$HOME/.codecouncil/env" | |
| - name: Launcher runs and prints usage | |
| run: | | |
| export CODECOUNCIL_HOME="$RUNNER_TEMP/cc-home" | |
| "$HOME/.local/bin/codecouncil" --help | |
| - name: Re-run is idempotent (update path) | |
| run: | | |
| export CODECOUNCIL_HOME="$RUNNER_TEMP/cc-home" | |
| export CODECOUNCIL_REPO_URL="file://$GITHUB_WORKSPACE" | |
| sh install.sh |