name: Lean Verification
on:
push:
branches: [main]
pull_request:
branches: [main]
jobs:
verify:
name: Proofs and fixture freshness
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0
- name: Detect verification-relevant changes
id: changes
run: |
if [ "${{ github.event_name }}" = "push" ]; then
echo "relevant=true" >> "$GITHUB_OUTPUT"
elif git diff --name-only "origin/${{ github.base_ref }}...HEAD" \
| grep -qE '^(verification/|tests/fixtures/lean/|\.github/workflows/lean\.yml)'; then
echo "relevant=true" >> "$GITHUB_OUTPUT"
else
echo "relevant=false" >> "$GITHUB_OUTPUT"
echo "No verification-relevant changes; proof check is a no-op for this PR."
fi
- name: Forbid proof-surface escape hatches
run: |
! grep -rnE '\bsorry\b|\badmit\b|\baxiom\b|\bnative_decide\b|implemented_by' \
verification --include='*.lean'
- name: Install elan
if: steps.changes.outputs.relevant == 'true'
run: |
curl -sSfL https://elan.lean-lang.org/elan-init.sh | sh -s -- -y --no-modify-path --default-toolchain none
echo "$HOME/.elan/bin" >> "$GITHUB_PATH"
- name: Cache Lean toolchain
if: steps.changes.outputs.relevant == 'true'
uses: actions/cache@v4
with:
path: ~/.elan
key: elan-${{ runner.os }}-${{ hashFiles('verification/lean-toolchain') }}
- name: Check proofs
if: steps.changes.outputs.relevant == 'true'
working-directory: verification
run: lake build
- name: Check committed fixtures are fresh
if: steps.changes.outputs.relevant == 'true'
working-directory: verification
run: |
lake exe gen_vectors > ../tests/fixtures/lean/cctp_v2_vectors.json
git diff --exit-code ../tests/fixtures/lean/cctp_v2_vectors.json