Repository navigation
feat(docker-sandbox-kit): bind a Sandbox Kit v3 descriptor as a declared TRACE policy #144
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: agentrust-codex tests | |
| on: | |
| pull_request: | |
| paths: | |
| - ".agents/plugins/marketplace.json" | |
| - "plugins/agentrust-codex/**" | |
| - ".github/workflows/agentrust-codex-tests.yml" | |
| - "README.md" | |
| push: | |
| branches: [main] | |
| paths: | |
| - ".agents/plugins/marketplace.json" | |
| - "plugins/agentrust-codex/**" | |
| - ".github/workflows/agentrust-codex-tests.yml" | |
| - "README.md" | |
| permissions: | |
| contents: read | |
| jobs: | |
| drift-without-signing: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.9", "3.11", "3.13"] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "${{ matrix.python-version }}" | |
| - name: Run capture tests without the signing packages | |
| run: | | |
| # The local package goes in with --no-deps: it has no runtime | |
| # dependencies of its own, so nothing here resolves against PyPI. | |
| # capture-core.txt rather than a flat 8.4.2 pin: it resolves | |
| # pytest per Python version, so only the 3.9 leg of this matrix | |
| # takes 8.4.2. See the lock for why 3.9 has no fixed pytest. | |
| pip install --require-hashes -r requirements/capture-core.txt | |
| pip install --no-deps ./packages/agentrust-capture-core | |
| python -m pytest plugins/agentrust-codex/tests -q | |
| signing: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| python-version: ["3.11", "3.12", "3.13"] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "${{ matrix.python-version }}" | |
| - name: Run signing and conformance tests | |
| run: | | |
| # The local package goes in with --no-deps: it has no runtime | |
| # dependencies of its own, so nothing here resolves against PyPI. | |
| pip install --require-hashes -r requirements/pytest-9.txt | |
| pip install --no-deps ./packages/agentrust-capture-core | |
| # The plugin's own requirements are the subject of this test, so they | |
| # stay resolved from PyPI rather than pinned. | |
| pip install -r plugins/agentrust-codex/requirements.txt | |
| python -m pytest plugins/agentrust-codex/tests -q | |
| structure: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| - name: Validate integration and plugin structure | |
| run: | | |
| pip install --require-hashes -r requirements/codex-schema.txt | |
| python plugins/agentrust-codex/tests/validate_structure.py |