Repository navigation
memory: release PR #42 merged (acb1f78); the tag and the PyPI publica… #125
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: agent-memory | |
| # GitHub member of the forge-aware ritual floor (v4.19.0; forge-aware v4.31.0–v4.32.0) — siblings: | |
| # .gitlab/agent-memory-ci.yml (GitLab) and .azuredevops/agent-memory-ci.yml (Azure DevOps), both | |
| # installed from the tool's templates/ on their forges. | |
| # Vendor-neutral ritual floor (v4.19.0). Runs server-side on every push/PR with ZERO per-user setup — | |
| # the untrained-user-proof layer (a git hook needs per-clone activation; CI does not). Advisory by | |
| # default (annotates, never fails the build). Set repo/Actions variable AGENT_MEMORY_STRICT=1 to gate. | |
| on: | |
| push: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| memory: | |
| runs-on: ubuntu-latest | |
| env: | |
| AGENT_MEMORY_STRICT: ${{ vars.AGENT_MEMORY_STRICT }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # full history for the diff-based session-log check | |
| - name: memory-lint (deterministic integrity check) | |
| run: | | |
| if [ -f agent-skills/memory-lint/scripts/memory-lint.py ]; then | |
| # --strict makes warnings observable to this wrapper; the wrapper then preserves | |
| # advisory-by-default behavior or fails when AGENT_MEMORY_STRICT=1. | |
| python3 agent-skills/memory-lint/scripts/memory-lint.py --strict || { | |
| echo "::warning title=memory-lint::memory-lint reported issues (see log above)" | |
| [ "${AGENT_MEMORY_STRICT:-0}" = "1" ] && exit 1 || true | |
| } | |
| else | |
| echo "memory-lint not installed; skipping." | |
| fi | |
| - name: session-log presence (advisory) | |
| run: | | |
| base="${{ github.event.pull_request.base.sha }}" | |
| [ -n "$base" ] || base="${{ github.event.before }}" | |
| case "$base" in ''|0000000000000000000000000000000000000000) base="$(git rev-parse --verify --quiet HEAD~1 2>/dev/null || echo '')";; esac | |
| [ -n "$base" ] || { echo "no base ref; skipping ritual check"; exit 0; } | |
| changed="$(git diff --name-only "$base" HEAD 2>/dev/null || true)" | |
| work="$(printf '%s\n' "$changed" | grep -vE '^(memory/|\.agent/)' | grep -v '^$' || true)" | |
| logged="$(printf '%s\n' "$changed" | grep -E '^memory/sessions/.*\.md$' || true)" | |
| if [ -n "$work" ] && [ -z "$logged" ]; then | |
| echo "::warning title=agent-memory ritual::changes touched tracked files but added no memory/sessions/ log — write or enrich a session log per memory/PROTOCOL.md \"Close every session\"." | |
| [ "${AGENT_MEMORY_STRICT:-0}" = "1" ] && exit 1 || true | |
| else | |
| echo "ritual check: ok" | |
| fi | |
| - name: changed-config secret scan (advisory, v4.34.0) | |
| run: | | |
| # Push-time sibling of the pre-commit secret guard: credential-class scan of the | |
| # config files this push/PR changed (.json/.yml/.yaml/.properties/.toml/.ini/.env*). | |
| # Catches --no-verify bypasses and clones that never activated local hooks. | |
| [ -f agent-skills/memory-lint/scripts/memory-lint.py ] || { echo "memory-lint not installed; skipping."; exit 0; } | |
| base="${{ github.event.pull_request.base.sha }}" | |
| [ -n "$base" ] || base="${{ github.event.before }}" | |
| case "$base" in ''|0000000000000000000000000000000000000000) base="$(git rev-parse --verify --quiet HEAD~1 2>/dev/null || echo '')";; esac | |
| [ -n "$base" ] || { echo "no base ref; skipping config secret scan"; exit 0; } | |
| cfgs="$(git diff --name-only --diff-filter=ACMR "$base" HEAD 2>/dev/null | grep -E '(\.(json|ya?ml|properties|toml|ini|env))$|(^|/)\.env(\.[^/]+)?$' || true)" | |
| if [ -n "$cfgs" ] && [ -f .agent/secret-scan-ignore ]; then | |
| # committed, human-audited exemptions (formats that can't carry the inline waiver) | |
| cfgs="$(printf '%s\n' "$cfgs" | while IFS= read -r f; do | |
| [ -n "$f" ] || continue | |
| keep=1 | |
| while IFS= read -r pat || [ -n "$pat" ]; do | |
| case "$pat" in ''|'#'*) continue ;; esac | |
| case "$f" in $pat) keep=0; break ;; esac | |
| done < .agent/secret-scan-ignore | |
| # if/fi, not `[ ... ] && ...`: a waived LAST file would make the test the loop's | |
| # final command, fail the substitution's assignment, and abort under `-e` (v4.39.2) | |
| if [ "$keep" = "1" ]; then printf '%s\n' "$f"; fi | |
| done)" | |
| fi | |
| [ -z "$cfgs" ] && { echo "no changed config files; skipping."; exit 0; } | |
| out="$(printf '%s\n' "$cfgs" | tr '\n' '\0' | xargs -0 python3 agent-skills/memory-lint/scripts/memory-lint.py --scan-files 2>/dev/null || true)" | |
| if [ -n "$out" ]; then | |
| printf '%s\n' "$out" | |
| echo "::warning title=agent-memory secret scan::possible credential material in changed config files (see log above)" | |
| [ "${AGENT_MEMORY_STRICT:-0}" = "1" ] && exit 1 || true | |
| else | |
| echo "config secret scan: ok" | |
| fi | |
| - name: undeclared-reference check (advisory, v4.41.0) | |
| run: | | |
| # Push-time sibling of the pre-commit advisory: a memory fact edited in this push/PR must be | |
| # declared in a session log added or changed in the same range — otherwise refresh-metadata | |
| # reads the edit as non-use and the fact decays while in active use. Silent when the range | |
| # adds no session log. Catches --no-verify bypasses and clones without local hooks. | |
| [ -f agent-skills/memory-lint/scripts/memory-lint.py ] || { echo "memory-lint not installed; skipping."; exit 0; } | |
| base="${{ github.event.pull_request.base.sha }}" | |
| [ -n "$base" ] || base="${{ github.event.before }}" | |
| case "$base" in ''|0000000000000000000000000000000000000000) base="$(git rev-parse --verify --quiet HEAD~1 2>/dev/null || echo '')";; esac | |
| [ -n "$base" ] || { echo "no base ref; skipping undeclared-reference check"; exit 0; } | |
| git cat-file -e "$base^{commit}" 2>/dev/null || { echo "base $base not in the checkout; skipping."; exit 0; } | |
| out="$(python3 agent-skills/memory-lint/scripts/memory-lint.py --range "$base" HEAD 2>/dev/null | grep -F '[undeclared-reference]' || true)" | |
| if [ -n "$out" ]; then | |
| printf '%s\n' "$out" | |
| echo "::warning title=agent-memory undeclared reference::a memory fact was edited without being declared in a staged session log (see log above) — add the id to '## Memory References'" | |
| else | |
| echo "undeclared-reference check: ok" | |
| fi |