fix(providers): 拒绝站在 A 仓验证 B 仓,并让 CODE_INTEL_REPO_ROOT 真的生效 #290
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: code-intel-ci | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| windows-build-test-package: | |
| runs-on: windows-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.14" | |
| - name: Validate repository layout and Skill package | |
| run: | | |
| python tests/test_repository_layout.py -v | |
| python tests/test_skill_package.py -v | |
| - name: Setup Rust | |
| shell: pwsh | |
| run: | | |
| rustup toolchain install | |
| rustup show active-toolchain | |
| - name: Install ripgrep | |
| shell: pwsh | |
| run: choco install ripgrep --version 14.1.0 -y --no-progress | |
| - name: Install ast-grep (pinned) | |
| shell: pwsh | |
| run: | | |
| $version = '0.42.3' | |
| $asset = 'app-x86_64-pc-windows-msvc.zip' | |
| $expected = '98acb57edae7a9f9e68657c2cc03ce25b7144bae69621fe7cf2d0492807cb623' | |
| $dir = Join-Path $env:RUNNER_TEMP 'ast-grep' | |
| New-Item -ItemType Directory -Force $dir | Out-Null | |
| $zip = Join-Path $dir $asset | |
| Invoke-WebRequest -Uri "https://github.com/ast-grep/ast-grep/releases/download/$version/$asset" -OutFile $zip | |
| $actual = (Get-FileHash -LiteralPath $zip -Algorithm SHA256).Hash.ToLowerInvariant() | |
| if ($actual -ne $expected) { throw "ast-grep artifact digest mismatch: $actual" } | |
| Expand-Archive -LiteralPath $zip -DestinationPath $dir -Force | |
| Add-Content -Path $env:GITHUB_PATH -Value $dir | |
| $reported = & (Join-Path $dir 'ast-grep.exe') --version | |
| if ("$reported" -ne "ast-grep $version") { throw "ast-grep version mismatch: $reported" } | |
| - name: Rust format | |
| shell: pwsh | |
| run: cargo fmt -p code-intel -- --check | |
| - name: Rust check | |
| shell: pwsh | |
| run: cargo check --locked | |
| - name: Rust tests and core cross-contract gate | |
| shell: pwsh | |
| run: cargo test -p code-intel --locked | |
| - name: Representative project orientation benchmark | |
| shell: pwsh | |
| run: cargo test -p code-intel --locked --test project_orientation_benchmark -- --nocapture | |
| - name: Build Rust CLI | |
| shell: pwsh | |
| run: cargo build -p code-intel --release --locked | |
| - name: Authoritative self-scan (release gate parity) | |
| shell: pwsh | |
| run: | | |
| $staging = Join-Path $env:RUNNER_TEMP "code-intel-self-scan" | |
| $authority = Join-Path $env:RUNNER_TEMP "code-intel-self-authority" | |
| New-Item -ItemType Directory -Force $authority | Out-Null | |
| ./target/release/code-intel.exe run execute --repo . --out $staging --authority-root $authority --final-name ci-self-scan --manifest orchestration/integrations.json --doctor-require-repowise false | |
| if ($LASTEXITCODE -ne 0) { | |
| throw "self-scan failed with exit code ${LASTEXITCODE}: 10 = architecture/domain gate failure, 70 = process failure; read the run manifest failures block" | |
| } | |
| - name: Validate any produced audit report (ai-safety-003) | |
| shell: pwsh | |
| run: | | |
| # The audit kernel's fail-closed validator (`audit --operation | |
| # validate`) previously ran on no automated path — see issue #34 | |
| # ai-safety-003. Departments are agent-run, not part of `run | |
| # execute`, so no audit-report.json is expected from this job | |
| # today; this step is the structural guarantee that if one ever | |
| # shows up here (repo root, orchestration/, or the self-scan | |
| # artifact directory), it is validated before anything downstream | |
| # can treat it as authoritative. | |
| $staging = Join-Path $env:RUNNER_TEMP "code-intel-self-scan" | |
| $searchRoots = @("orchestration", $staging) | Where-Object { Test-Path $_ } | |
| $reports = @() | |
| if (Test-Path "audit-report.json") { $reports += (Resolve-Path "audit-report.json").Path } | |
| foreach ($root in $searchRoots) { | |
| $reports += Get-ChildItem -LiteralPath $root -Recurse -Filter "audit-report.json" -File -ErrorAction SilentlyContinue | | |
| Select-Object -ExpandProperty FullName | |
| } | |
| $reports = $reports | Select-Object -Unique | |
| if (-not $reports) { | |
| Write-Host "No audit-report.json produced by this run; nothing to validate." | |
| } | |
| foreach ($report in $reports) { | |
| Write-Host "Validating audit report: $report" | |
| ./target/release/code-intel.exe audit --operation validate --repo . --report $report | |
| if ($LASTEXITCODE -ne 0) { | |
| throw "audit report failed --operation validate (exit ${LASTEXITCODE}): $report -- an unvalidated audit report must never be treated as authoritative" | |
| } | |
| } | |
| - name: PowerShell parser checks | |
| shell: pwsh | |
| run: | | |
| $files = @( | |
| "legacy/code-intel.ps1", | |
| "legacy/invoke-code-intel.ps1", | |
| "legacy/run-code-intel.ps1", | |
| "legacy/Invoke-ScopedRepowise.ps1", | |
| "legacy/Find-CodeIntelProjects.ps1", | |
| "legacy/Invoke-GitHubSolutionResearch.ps1", | |
| "legacy/Invoke-ModelChannelDelegate.ps1", | |
| "legacy/Invoke-SentruxAgentTool.ps1", | |
| "legacy/scripts/tests/test-code-intel-pipeline.ps1", | |
| "legacy/scripts/tests/test-stable-wrapper-e2e.ps1", | |
| "legacy/scripts/tests/test-primary-launchers.ps1", | |
| "legacy/scripts/tests/test-github-solution-research.ps1", | |
| "legacy/scripts/tests/test-hospital-trust-contract.ps1", | |
| "legacy/scripts/tests/test-dag-facade.ps1", | |
| "legacy/scripts/tests/test-atomic-capability-contract.ps1", | |
| "legacy/scripts/tests/test-project-discovery.ps1", | |
| "legacy/scripts/tests/test-project-management-support.ps1", | |
| "legacy/scripts/tests/Test-CodeIntelProjectConformance.ps1", | |
| "legacy/scripts/tests/test-code-intel-project-conformance.ps1", | |
| "legacy/Invoke-MultiAgentMergeQueue.ps1", | |
| "legacy/scripts/tests/test-multi-agent-merge-queue.ps1", | |
| "legacy/scripts/tests/test-integration-orchestration.ps1", | |
| "legacy/scripts/tests/Test-Python314PonCompatibility.ps1", | |
| "legacy/scripts/tests/test-python314-pon-compatibility.ps1", | |
| "legacy/scripts/tests/test-scoped-repowise-security.ps1", | |
| "legacy/scripts/tests/test-scoped-repowise-worktree.ps1", | |
| "legacy/scripts/tests/test-skill-development-benchmark.ps1", | |
| "legacy/scripts/tests/test-retirement-packets.ps1", | |
| "legacy/tools/New-BetaPackage.ps1", | |
| "legacy/tools/Test-BetaPackage.ps1" | |
| ) | |
| foreach ($file in $files) { | |
| $tokens = $null | |
| $errs = $null | |
| $null = [System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path $file), [ref]$tokens, [ref]$errs) | |
| if ($errs) { | |
| Write-Host $file | |
| $errs | Select-Object Message,Extent | Format-List | |
| exit 1 | |
| } | |
| } | |
| - name: Secret pattern guard | |
| shell: pwsh | |
| run: | | |
| $patterns = @( | |
| "sk-[A-Za-z0-9_-]{20,}", | |
| "ghp_[A-Za-z0-9_]{20,}", | |
| "github_pat_[A-Za-z0-9_]{20,}", | |
| "AKIA[0-9A-Z]{16}" | |
| ) | |
| $files = git ls-files | |
| $hits = @() | |
| foreach ($file in $files) { | |
| if ($file -match "^(target/|artifacts/|cache/)" -or $file -match "\.(png|jpg|jpeg|gif|zip|exe)$") { | |
| continue | |
| } | |
| $text = Get-Content -LiteralPath $file -Raw -ErrorAction SilentlyContinue | |
| foreach ($pattern in $patterns) { | |
| if ($text -match $pattern) { | |
| $hits += "$file matches $pattern" | |
| } | |
| } | |
| } | |
| if ($hits.Count -gt 0) { | |
| $hits | ForEach-Object { Write-Host $_ } | |
| throw "Secret-like patterns found." | |
| } | |
| - name: Install portable pipeline | |
| shell: pwsh | |
| run: .\legacy\install-code-intel-pipeline.ps1 -RepoPath . -RepairSkillLinks -RequireRepowise:$false -Json | |
| - name: Add pipeline tools PATH | |
| shell: pwsh | |
| run: Add-Content -Path $env:GITHUB_PATH -Value "$env:LOCALAPPDATA\code-intel\bin" | |
| - name: Doctor | |
| shell: pwsh | |
| # T3 (#48): the tool/runtime probe is native now; the PowerShell entry | |
| # point is a thin forwarder onto this same subcommand. | |
| run: code-intel doctor bootstrap --repo-path . --no-require-repowise | |
| - name: GitHub research contract tests | |
| shell: pwsh | |
| run: .\legacy/scripts/tests/test-github-solution-research.ps1 -RepoPath . | |
| - name: Project discovery contract tests | |
| shell: pwsh | |
| run: .\legacy/scripts/tests/test-project-discovery.ps1 -RepoPath . | |
| - name: Project management support contract tests | |
| shell: pwsh | |
| run: .\legacy/scripts/tests/test-project-management-support.ps1 -RepoPath . | |
| - name: Atomic capability contract tests | |
| shell: pwsh | |
| run: .\legacy/scripts/tests/test-atomic-capability-contract.ps1 -RepoPath . | |
| - name: Skill development benchmark contract tests | |
| shell: pwsh | |
| run: .\legacy/scripts/tests/test-skill-development-benchmark.ps1 -RepoPath . | |
| - name: Hospital fail-closed contract tests | |
| shell: pwsh | |
| run: .\legacy/scripts/tests/test-hospital-trust-contract.ps1 | |
| - name: Scoped Repowise trust-boundary tests | |
| shell: pwsh | |
| run: | | |
| .\legacy/scripts/tests/test-scoped-repowise-security.ps1 | |
| .\legacy/scripts/tests/test-scoped-repowise-worktree.ps1 | |
| - name: Scoped Repowise manifest validator tests | |
| run: python .\test-scoped-repowise-validator.py | |
| - name: Core PowerShell regression tests | |
| shell: pwsh | |
| run: .\legacy/scripts/tests/test-regression-fixes.ps1 | |
| - name: Compatibility retirement packets | |
| shell: pwsh | |
| run: .\legacy/scripts/tests/test-retirement-packets.ps1 | |
| - name: Python 3.14 and project conformance | |
| shell: pwsh | |
| run: | | |
| .\legacy/scripts/tests/test-python314-pon-compatibility.ps1 | |
| .\legacy/scripts/tests/test-integration-orchestration.ps1 | |
| .\legacy/scripts/tests/test-code-intel-project-conformance.ps1 | |
| - name: Pipeline smoke | |
| shell: pwsh | |
| run: .\legacy/scripts/tests/test-code-intel-pipeline.ps1 -RepoPath . -SkipRepowise -AllowGraphMissing -SkipSentruxGate -SkipGitHubResearch -Mode normal | |
| - name: Stable wrapper authoritative outcome E2E | |
| shell: pwsh | |
| run: .\legacy/scripts/tests/test-stable-wrapper-e2e.ps1 | |
| - name: Model channel and automation regression suites | |
| shell: pwsh | |
| run: | | |
| $tests = @( | |
| ".\legacy/tests/test-model-channel-delegate.ps1" | |
| ".\legacy/tests/test-model-channel-degraded-pipeline.ps1" | |
| ".\legacy/tests/test-automatic-pull-request.ps1" | |
| ".\legacy/tests/test-automatic-pull-request-flow.ps1" | |
| ".\legacy/tests/test-follow-up-automation.ps1" | |
| ) | |
| foreach ($test in $tests) { | |
| & pwsh -NoProfile -File $test | |
| if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } | |
| } | |
| - name: Primary launcher contract tests | |
| shell: pwsh | |
| run: | | |
| & pwsh -NoProfile -File .\legacy/scripts/tests/test-primary-launchers.ps1 | |
| if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } | |
| - name: Conformance evidence suites | |
| shell: pwsh | |
| run: | | |
| $tests = @( | |
| ".\legacy/scripts/tests/test-sentrux-failure-normalization.ps1" | |
| ".\legacy/scripts/tests/test-codenexus-adapter-contract.ps1" | |
| ".\legacy/scripts/tests/test-transactional-publication.ps1" | |
| ) | |
| foreach ($test in $tests) { | |
| & pwsh -NoProfile -File $test | |
| if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } | |
| } | |
| - name: Package | |
| shell: pwsh | |
| run: | | |
| & pwsh -NoProfile -File ./legacy/tools/New-BetaPackage.ps1 -ExecutablePath ./target/release/code-intel.exe -OutputDirectory ./dist -PackageName code-intel-pipeline-windows-beta | |
| if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } | |
| - name: Verify beta package | |
| shell: pwsh | |
| run: | | |
| & pwsh -NoProfile -File ./legacy/tools/Test-BetaPackage.ps1 -ZipPath ./dist/code-intel-pipeline-windows-beta.zip -Json | |
| if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } | |
| - name: Upload package artifact | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: code-intel-pipeline-windows | |
| path: | | |
| dist/code-intel-pipeline-windows-beta.zip | |
| dist/code-intel-pipeline-windows-beta.zip.sha256 | |
| dist/code-intel-pipeline-windows-beta.release-manifest.json | |
| cross-platform-smoke: | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| os: | |
| - windows-latest | |
| - macos-latest | |
| - ubuntu-latest | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Python | |
| uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 | |
| with: | |
| python-version: "3.14" | |
| - name: Validate repository layout and Skill package | |
| run: | | |
| python tests/test_repository_layout.py -v | |
| python tests/test_skill_package.py -v | |
| - name: Setup Rust | |
| shell: pwsh | |
| run: | | |
| rustup toolchain install | |
| rustup show active-toolchain | |
| - name: Install ripgrep | |
| shell: pwsh | |
| run: | | |
| if ($IsWindows) { | |
| choco install ripgrep --version 14.1.0 -y --no-progress | |
| } | |
| elseif ($IsMacOS) { | |
| brew install ripgrep | |
| } | |
| else { | |
| sudo apt-get update | |
| sudo apt-get install -y ripgrep | |
| } | |
| - name: Install ast-grep (pinned) | |
| shell: pwsh | |
| run: | | |
| $version = '0.42.3' | |
| if ($IsWindows) { | |
| $asset = 'app-x86_64-pc-windows-msvc.zip' | |
| $expected = '98acb57edae7a9f9e68657c2cc03ce25b7144bae69621fe7cf2d0492807cb623' | |
| } | |
| elseif ($IsMacOS) { | |
| $asset = 'app-aarch64-apple-darwin.zip' | |
| $expected = '12a870c414c90208f338649b0b53d9659b724b680edaf9da9c151275dad3e41a' | |
| } | |
| else { | |
| $asset = 'app-x86_64-unknown-linux-gnu.zip' | |
| $expected = '4191ac4247d183c502778e740a68b7cf45fe477b6423c43b8b8d6e732ba3b333' | |
| } | |
| $dir = Join-Path $env:RUNNER_TEMP 'ast-grep' | |
| New-Item -ItemType Directory -Force $dir | Out-Null | |
| $zip = Join-Path $dir $asset | |
| Invoke-WebRequest -Uri "https://github.com/ast-grep/ast-grep/releases/download/$version/$asset" -OutFile $zip | |
| $actual = (Get-FileHash -LiteralPath $zip -Algorithm SHA256).Hash.ToLowerInvariant() | |
| if ($actual -ne $expected) { throw "ast-grep artifact digest mismatch: $actual" } | |
| Expand-Archive -LiteralPath $zip -DestinationPath $dir -Force | |
| $binary = if ($IsWindows) { 'ast-grep.exe' } else { 'ast-grep' } | |
| if (-not $IsWindows) { chmod +x (Join-Path $dir $binary) } | |
| Add-Content -Path $env:GITHUB_PATH -Value $dir | |
| $reported = & (Join-Path $dir $binary) --version | |
| if ("$reported" -ne "ast-grep $version") { throw "ast-grep version mismatch: $reported" } | |
| - name: Rust format | |
| shell: pwsh | |
| run: cargo fmt -p code-intel -- --check | |
| - name: Rust check | |
| shell: pwsh | |
| run: cargo check --locked | |
| - name: Rust tests and core cross-contract gate | |
| shell: pwsh | |
| run: cargo test -p code-intel --locked | |
| - name: Build Rust CLI | |
| shell: pwsh | |
| run: cargo build -p code-intel --release --locked | |
| - name: Authoritative self-scan (release gate parity) | |
| shell: pwsh | |
| run: | | |
| $binary = if ($IsWindows) { "./target/release/code-intel.exe" } else { "./target/release/code-intel" } | |
| $staging = Join-Path ([IO.Path]::GetTempPath()) "code-intel-self-scan" | |
| $authority = Join-Path ([IO.Path]::GetTempPath()) "code-intel-self-authority" | |
| if (Test-Path $staging) { Remove-Item -Recurse -Force $staging } | |
| New-Item -ItemType Directory -Force $authority | Out-Null | |
| & $binary run execute --repo . --out $staging --authority-root $authority --final-name ci-self-scan --manifest orchestration/integrations.json --doctor-require-repowise false | |
| if ($LASTEXITCODE -ne 0) { | |
| throw "self-scan failed with exit code ${LASTEXITCODE}: 10 = architecture/domain gate failure, 70 = process failure; read the run manifest failures block" | |
| } | |
| - name: Validate any produced audit report (ai-safety-003) | |
| shell: pwsh | |
| run: | | |
| # See the matching step in the windows-build-test-package job: | |
| # departments are agent-run, not part of `run execute`, so this is | |
| # a structural guarantee for whenever an audit-report.json does | |
| # show up, not an expectation that one exists today. | |
| $binary = if ($IsWindows) { "./target/release/code-intel.exe" } else { "./target/release/code-intel" } | |
| $staging = Join-Path ([IO.Path]::GetTempPath()) "code-intel-self-scan" | |
| $searchRoots = @("orchestration", $staging) | Where-Object { Test-Path $_ } | |
| $reports = @() | |
| if (Test-Path "audit-report.json") { $reports += (Resolve-Path "audit-report.json").Path } | |
| foreach ($root in $searchRoots) { | |
| $reports += Get-ChildItem -LiteralPath $root -Recurse -Filter "audit-report.json" -File -ErrorAction SilentlyContinue | | |
| Select-Object -ExpandProperty FullName | |
| } | |
| $reports = $reports | Select-Object -Unique | |
| if (-not $reports) { | |
| Write-Host "No audit-report.json produced by this run; nothing to validate." | |
| } | |
| foreach ($report in $reports) { | |
| Write-Host "Validating audit report: $report" | |
| & $binary audit --operation validate --repo . --report $report | |
| if ($LASTEXITCODE -ne 0) { | |
| throw "audit report failed --operation validate (exit ${LASTEXITCODE}): $report -- an unvalidated audit report must never be treated as authoritative" | |
| } | |
| } | |
| - name: PowerShell parser checks | |
| shell: pwsh | |
| run: | | |
| $files = @( | |
| "legacy/code-intel.ps1", | |
| "legacy/invoke-code-intel.ps1", | |
| "legacy/run-code-intel.ps1", | |
| "legacy/Invoke-ScopedRepowise.ps1", | |
| "legacy/Find-CodeIntelProjects.ps1", | |
| "legacy/Invoke-GitHubSolutionResearch.ps1", | |
| "legacy/Invoke-ModelChannelDelegate.ps1", | |
| "legacy/Invoke-SentruxAgentTool.ps1", | |
| "legacy/scripts/tests/test-code-intel-pipeline.ps1", | |
| "legacy/scripts/tests/test-stable-wrapper-e2e.ps1", | |
| "legacy/scripts/tests/test-primary-launchers.ps1", | |
| "legacy/scripts/tests/test-github-solution-research.ps1", | |
| "legacy/scripts/tests/test-hospital-trust-contract.ps1", | |
| "legacy/scripts/tests/test-dag-facade.ps1", | |
| "legacy/scripts/tests/test-atomic-capability-contract.ps1", | |
| "legacy/scripts/tests/test-project-discovery.ps1", | |
| "legacy/scripts/tests/test-project-management-support.ps1", | |
| "legacy/scripts/tests/Test-CodeIntelProjectConformance.ps1", | |
| "legacy/scripts/tests/test-code-intel-project-conformance.ps1", | |
| "legacy/Invoke-MultiAgentMergeQueue.ps1", | |
| "legacy/scripts/tests/test-multi-agent-merge-queue.ps1", | |
| "legacy/scripts/tests/test-integration-orchestration.ps1", | |
| "legacy/scripts/tests/Test-Python314PonCompatibility.ps1", | |
| "legacy/scripts/tests/test-python314-pon-compatibility.ps1", | |
| "legacy/scripts/tests/test-scoped-repowise-security.ps1", | |
| "legacy/scripts/tests/test-scoped-repowise-worktree.ps1", | |
| "legacy/scripts/tests/test-skill-development-benchmark.ps1", | |
| "legacy/scripts/tests/test-retirement-packets.ps1", | |
| "legacy/tools/New-BetaPackage.ps1", | |
| "legacy/tools/Test-BetaPackage.ps1" | |
| ) | |
| foreach ($file in $files) { | |
| $tokens = $null | |
| $errs = $null | |
| $null = [System.Management.Automation.Language.Parser]::ParseFile((Resolve-Path $file), [ref]$tokens, [ref]$errs) | |
| if ($errs) { | |
| Write-Host $file | |
| $errs | Select-Object Message,Extent | Format-List | |
| exit 1 | |
| } | |
| } | |
| - name: Secret pattern guard | |
| shell: pwsh | |
| run: | | |
| $patterns = @( | |
| "sk-[A-Za-z0-9_-]{20,}", | |
| "ghp_[A-Za-z0-9_]{20,}", | |
| "github_pat_[A-Za-z0-9_]{20,}", | |
| "AKIA[0-9A-Z]{16}" | |
| ) | |
| $files = git ls-files | |
| $hits = @() | |
| foreach ($file in $files) { | |
| if ($file -match "^(target/|artifacts/|cache/)" -or $file -match "\.(png|jpg|jpeg|gif|zip|exe)$") { | |
| continue | |
| } | |
| $text = Get-Content -LiteralPath $file -Raw -ErrorAction SilentlyContinue | |
| foreach ($pattern in $patterns) { | |
| if ($text -match $pattern) { | |
| $hits += "$file matches $pattern" | |
| } | |
| } | |
| } | |
| if ($hits.Count -gt 0) { | |
| $hits | ForEach-Object { Write-Host $_ } | |
| throw "Secret-like patterns found." | |
| } | |
| - name: Install portable pipeline | |
| shell: pwsh | |
| run: | | |
| $result = ./legacy/install-code-intel-pipeline.ps1 -RepoPath . -RepairSkillLinks -RequireRepowise:$false -Json | ConvertFrom-Json | |
| Add-Content -Path $env:GITHUB_PATH -Value $result.paths.bin | |
| - name: Doctor | |
| shell: pwsh | |
| # T3 (#48): native probe; the PowerShell entry point now forwards here. | |
| run: code-intel doctor bootstrap --repo-path . --no-require-repowise --json | |
| - name: Hospital fail-closed contract tests | |
| shell: pwsh | |
| run: ./legacy/scripts/tests/test-hospital-trust-contract.ps1 | |
| - name: Atomic capability contract tests | |
| shell: pwsh | |
| run: ./legacy/scripts/tests/test-atomic-capability-contract.ps1 -RepoPath . | |
| - name: Scoped Repowise manifest validator tests | |
| run: python ./test-scoped-repowise-validator.py | |
| - name: Python 3.14 compatibility lane | |
| shell: pwsh | |
| run: ./legacy/scripts/tests/test-python314-pon-compatibility.ps1 | |
| - name: Multi-agent merge queue contract | |
| shell: pwsh | |
| run: ./legacy/scripts/tests/test-multi-agent-merge-queue.ps1 | |
| - name: Pipeline smoke | |
| shell: pwsh | |
| run: ./legacy/scripts/tests/test-code-intel-pipeline.ps1 -RepoPath . -SkipRepowise -AllowGraphMissing -SkipSentruxCheck -SkipSentruxGate -SkipGitHubResearch -Mode normal | |
| - name: Hardcoded path scan | |
| shell: pwsh | |
| run: ./legacy/tools/check-hardcoded-paths.ps1 |