Repository navigation
fix(release): include independent recovery anchor modules in runtime … #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Disposable Windows context recovery | |
| on: | |
| push: | |
| branches: | |
| - acceptance/context-recovery/** | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| source-gates: | |
| runs-on: windows-latest | |
| timeout-minutes: 90 | |
| defaults: | |
| run: | |
| shell: pwsh | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install verified source dependencies | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| npm ci | |
| if ($LASTEXITCODE -ne 0) { throw 'Source dependencies failed.' } | |
| npm ci --prefix plugins/hpm-local-evidence --ignore-scripts | |
| if ($LASTEXITCODE -ne 0) { throw 'Local evidence build dependencies failed.' } | |
| rustup default stable | |
| if ($LASTEXITCODE -ne 0) { throw 'Native build toolchain failed.' } | |
| - name: Require unified source gates | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| npm run verify | |
| if ($LASTEXITCODE -ne 0) { throw 'Unified verification failed.' } | |
| npm audit --audit-level=high | |
| if ($LASTEXITCODE -ne 0) { throw 'Dependency audit failed.' } | |
| context-recovery: | |
| needs: source-gates | |
| runs-on: windows-latest | |
| timeout-minutes: 90 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| scenario: [n08, n09] | |
| defaults: | |
| run: | |
| shell: pwsh | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ github.sha }} | |
| persist-credentials: false | |
| - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 | |
| with: | |
| node-version: 22 | |
| cache: npm | |
| - name: Install verified source dependencies | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| npm ci | |
| if ($LASTEXITCODE -ne 0) { throw 'Source dependencies failed.' } | |
| npm ci --prefix plugins/hpm-local-evidence --ignore-scripts | |
| if ($LASTEXITCODE -ne 0) { throw 'Local evidence build dependencies failed.' } | |
| rustup default stable | |
| if ($LASTEXITCODE -ne 0) { throw 'Native build toolchain failed.' } | |
| - name: Build runner-local payload and fixed review plan | |
| env: | |
| SCENARIO: ${{ matrix.scenario }} | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| node scripts/prepare-context-hosted-run.js $env:SCENARIO | |
| if ($LASTEXITCODE -ne 0) { throw 'Fixed payload preparation failed.' } | |
| - name: Run fixed scenario under original bounded Job | |
| env: | |
| SCENARIO: ${{ matrix.scenario }} | |
| run: | | |
| $ErrorActionPreference = 'Stop' | |
| ./scripts/qualify-context-hosted.ps1 -Case $env:SCENARIO | |
| - name: Record bounded outcome | |
| if: always() | |
| env: | |
| SCENARIO: ${{ matrix.scenario }} | |
| JOB_STATUS: ${{ job.status }} | |
| run: | | |
| @( | |
| 'Context scenario: ' + $env:SCENARIO + '; job result: ' + $env:JOB_STATUS | |
| 'Exact source checkout: ' + $env:GITHUB_SHA | |
| 'When their preparation stages run, payload, synthetic credentials, original evidence, DPAPI keys and certificates are generated only on this disposable runner.' | |
| 'No private local acceptance directory or old installer artifact is an input. No payload, key, database or request body is uploaded.' | |
| 'Not qualified: save/revoke durable ACK, commit/publication in progress, backup rollback, installation lifecycle, full N09, 24-hour capacity, real providers or production activation.' | |
| ) >> $env:GITHUB_STEP_SUMMARY |