forjar 1.6.2

Rust-native Infrastructure as Code — bare-metal first, BLAKE3 state, provenance tracing
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

# Sovereign CI — calls reusable workflow from paiml/.github
# Change once in paiml/.github → applies to all repos
#
# Jobs provided by sovereign-ci.yml:
#   test: cargo test --lib (self-hosted clean-room)
#   lint: cargo clippy --all-targets -- -D warnings + cargo fmt --check
#   coverage: cargo llvm-cov + codecov upload
#   security: cargo audit (ubuntu-latest, continue-on-error)
#   provenance: SLSA attest-build-provenance
#   gate: aggregates test+lint results
name: CI

on:
  push:
    branches: [main, master]
  pull_request:
    branches: [main, master]
  workflow_dispatch:

concurrency:
  group: ci-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  ci:
    uses: paiml/.github/.github/workflows/sovereign-ci.yml@main
    with:
      repo: ${{ github.event.repository.name }}
    secrets: inherit

  # Release preflight: a stale Cargo.lock must fail PR CI, not the tag.
  # Every v1.4.x release failed because Cargo.toml was bumped without
  # committing the refreshed Cargo.lock — release.yml's `cargo package`
  # then dirties the tree and skips release creation entirely.
  lockfile:
    name: lockfile-preflight
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
      - name: Verify Cargo.lock is committed and current
        run: cargo package --locked --no-verify

  # Regression guard (#179): every shipped standalone example config must pass
  # `forjar validate`. The sovereign-ci `test` job only runs `cargo test --lib`,
  # so this integration test (tests/examples_validate.rs) needs an explicit step.
  # Deterministic and offline — validate never opens a network/SSH connection.
  examples-validate:
    name: examples-validate
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
      - name: Validate all standalone example configs
        run: cargo test --locked --test examples_validate

  # Top-level gate: satisfies org ruleset which requires check named "gate".
  # The reusable workflow produces "ci / gate" but rulesets need exact match on "gate".
  gate:
    runs-on: ubuntu-latest
    needs: [ci, lockfile, examples-validate]
    if: always()
    steps:
      - name: Check required jobs
        run: |
          if [ "${{ needs.ci.result }}" != "success" ]; then
            echo "ci failed: ${{ needs.ci.result }}"
            exit 1
          fi
          if [ "${{ needs.lockfile.result }}" != "success" ]; then
            echo "lockfile preflight failed: ${{ needs.lockfile.result }}"
            exit 1
          fi
          if [ "${{ needs.examples-validate.result }}" != "success" ]; then
            echo "examples-validate failed: ${{ needs.examples-validate.result }}"
            exit 1
          fi
          echo "All required jobs passed"