feat(seeded-profile): hal0 1.0 seeded profile rework (A + B + profile catalog) #2691
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| # Cancel superseded PR runs to save runners; never cancel a push to main | |
| # (every main commit must build — required checks + the nightly greenness gate). | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| # Least privilege: CI only needs to read the repo. | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Rework de-scar guardrail (stdlib-only, fast): overdue HAL0-SUNSET shims + | |
| # scar-marker ratchet. Every de-scar PR keeps this green (baseline only falls). | |
| sunset: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.12" | |
| - name: Sunset-shim + scar-ratchet guardrail | |
| run: python scripts/check_sunset.py | |
| python: | |
| runs-on: ubuntu-latest | |
| # 3.14 is experimental until every dep ships 3.14 wheels — surface it | |
| # without reddening main. No-op on PRs, which run 3.12 only. | |
| continue-on-error: ${{ matrix.python-version == '3.14' }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| # PRs test the primary 3.12 only (fast feedback; matches the required | |
| # "python (3.12)" status check). Pushes to main test the full supported | |
| # range so Python-version drift still gates the protected branch. | |
| python-version: ${{ (github.event_name == 'pull_request' && fromJSON('["3.12"]')) || fromJSON('["3.12","3.13","3.14"]') }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-python@v6 | |
| with: | |
| python-version: ${{ matrix.python-version }} | |
| cache: pip | |
| - name: Install uv | |
| # Via pip on the setup-python interpreter — no third-party action tag | |
| # to chase (astral-sh/setup-uv@v8 didn't resolve and bricked the job). | |
| run: pip install uv | |
| - name: Install system deps | |
| # ffmpeg backs the in-container moonshine audio decoder | |
| # (packaging/toolbox/moonshine/moonshine_server.py). The redaction | |
| # tests in tests/providers/test_moonshine_server.py exercise the | |
| # real subprocess path; without ffmpeg they hit FileNotFoundError | |
| # instead of the CalledProcessError the code catches. | |
| run: sudo apt-get update && sudo apt-get install -y --no-install-recommends ffmpeg | |
| - name: Install | |
| # --frozen: fail instead of silently re-resolving if uv.lock drifts | |
| # from pyproject.toml, so CI installs the exact pinned versions — | |
| # the same ones a local `uv sync` venv gets. Fixes CI pip-installing | |
| # newer floating deps (FastAPI/Pydantic) that local venvs never see. | |
| # --python pins the venv to the matrix interpreter setup-python laid | |
| # down, so uv can't silently pick a different system python. | |
| run: uv sync --frozen --extra dev --python "$(which python)" | |
| - name: Lint | |
| run: uv run ruff check src tests | |
| - name: Format check | |
| run: uv run ruff format --check src tests | |
| - name: Test | |
| # Coverage (+ verbose) only on main pushes — it's a report, not a gate, | |
| # so PRs skip the instrumentation overhead and run a quiet, faster suite. | |
| run: uv run pytest tests/ ${{ github.event_name == 'push' && '-v --cov=hal0 --cov-report=term-missing' || '-q' }} | |
| ui: | |
| runs-on: ubuntu-latest | |
| defaults: | |
| run: | |
| working-directory: ui | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: "22" | |
| cache: npm | |
| cache-dependency-path: ui/package-lock.json | |
| - name: Install | |
| run: npm ci | |
| - name: Lint | |
| run: npm run lint | |
| - name: Build | |
| run: npm run build |