kylrix/.github/workflows/ota-verify-native-linux.yml at master · Kylrix/kylrix · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
# ota:managed-github-projection v1 identity=sha256:52218b0207b404fe7c0124b258d7b7170700a33fa75caf3bdd813186db9b97f4
name: Ota governance ('verify')

on:
  workflow_call:
    inputs:
      ota_projection_identity:
        description: Ota-managed projection identity
        required: true
        type: string
      ota_runner:
        description: GitHub runner selected by the human-owned caller
        required: false
        default: 'ubuntu-latest'
        type: string
      ota_target_os:
        description: Target operating system bound into the Ota projection
        required: true
        type: string

jobs:
  ota_ota_verify_verify:
    name: 'ota.verify.verify (linux/native)'
    runs-on: ${{ inputs.ota_runner }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
      - uses: ota-run/setup@493cba84bf7f7c11c9e8e996d832d93a89c62184
        with:
          source: contract
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
        with:
          node-version: '>=22'
          package-manager-cache: false
      - name: Verify Ota projection identity
        run: ota ci projection --workflow 'verify' --mode native --target-os ${{ inputs.ota_target_os }} --expect-identity ${{ inputs.ota_projection_identity }} --json
      - name: Validate contract
        run: ota validate . --json
      - name: Diagnose contract lane
        run: ota doctor --workflow 'verify' --mode native --json
      - name: Discover safe execution surface
        run: ota tasks --safe --use --json
      - name: Preview contract lane
        run: ota up --workflow 'verify' --mode native --agent --dry-run --json
      - name: Execute finite contract task
        run: ota run 'verify' --mode native --agent
      - name: Archive workflow readiness receipt
        run: ota receipt --workflow 'verify' --mode native --archive --json
  ota_ota_refusal_canary_task_selfhost_up:
    name: 'ota.refusal-canary.task.selfhost-up (linux/native)'
    runs-on: ${{ inputs.ota_runner }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
      - uses: ota-run/setup@493cba84bf7f7c11c9e8e996d832d93a89c62184
        with:
          source: contract
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
        with:
          node-version: '>=22'
          package-manager-cache: false
      - name: Verify Ota projection identity
        run: ota ci projection --workflow 'verify' --mode native --target-os ${{ inputs.ota_target_os }} --expect-identity ${{ inputs.ota_projection_identity }} --json
      - name: Prove agent refusal canary
        run: ota run --agent --expect-refusal --mode native --json 'selfhost:up'
  ota_ota_refusal_canary_workflow_selfhost:
    name: 'ota.refusal-canary.workflow.selfhost (linux/native)'
    runs-on: ${{ inputs.ota_runner }}
    steps:
      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
      - uses: ota-run/setup@493cba84bf7f7c11c9e8e996d832d93a89c62184
        with:
          source: contract
      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444
        with:
          node-version: '>=22'
          package-manager-cache: false
      - name: Verify Ota projection identity
        run: ota ci projection --workflow 'verify' --mode native --target-os ${{ inputs.ota_target_os }} --expect-identity ${{ inputs.ota_projection_identity }} --json
      - name: Prove agent refusal canary
        run: ota up --agent --expect-refusal --workflow 'selfhost' --mode native --json