name: CI
on:
push:
branches: [main]
pull_request:
types: [opened, synchronize, reopened, edited]
jobs:
check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6.0.2
with:
fetch-depth: 0
- name: Install Python CI dependencies
run: python3 -m pip install --requirement scripts/ci/requirements.txt
- name: Check plugin version sync
run: python3 scripts/ci/check_plugin_version_sync.py
- name: Self-test public benchmark claims
run: python3 scripts/ci/check_public_claims.py --self-test
- name: Test documentation contracts
run: python3 scripts/ci/test_check_documentation_contracts.py
- name: Check documentation contracts
run: python3 scripts/ci/check_documentation_contracts.py
- name: Test SessionStart artifact runner
run: python3 scripts/ci/test_run_sessionstart_context_gate_smoke.py
- name: Check source file size guard
run: python3 scripts/ci/check_file_size.py
- name: Check active-memory write boundary
run: python3 scripts/ci/check_active_memory_writes.py
- name: Self-test active-memory write boundary
run: python3 scripts/ci/check_active_memory_writes.py --self-test
- name: Check module dependency direction
run: python3 scripts/ci/check_module_dependencies.py --base "${{ github.event.pull_request.base.sha || github.event.before }}"
- name: Self-test module dependency direction
run: python3 scripts/ci/check_module_dependencies.py --self-test
- name: Check migration concerns
run: python3 scripts/ci/check_migration_concerns.py
- name: Check release workflows
run: python3 scripts/ci/check_release_workflows.py
- name: Test plugin runtime scripts
run: node --test plugins/remem/scripts/remem-runtime.test.js plugins/remem/apps/remem/request-security.test.js plugins/remem/apps/remem/server.test.js npm/remem/scripts/install.test.js
- name: Check spec lifecycle
if: github.event_name == 'pull_request'
env:
GITHUB_PR_TITLE: ${{ github.event.pull_request.title }}
GITHUB_PR_BODY: ${{ github.event.pull_request.body }}
run: python3 scripts/ci/check_spec_lifecycle.py "${{ github.event.pull_request.base.sha }}" HEAD
- name: Check version bump
if: github.event_name == 'pull_request'
run: python3 scripts/ci/check_version_bump.py "${{ github.event.pull_request.base.sha }}" HEAD
- uses: dtolnay/rust-toolchain@1.97.0
with:
components: clippy, rustfmt
- uses: Swatinem/rust-cache@v2
- name: Build current remem and prove isolated SessionStart smoke
run: python3 scripts/ci/run_sessionstart_context_gate_smoke.py
- name: Generate public benchmark authority verdict
run: cargo run --locked -- bench verify --root eval/public --json-out "$RUNNER_TEMP/remem-public-bench-verify.json"
- name: Check public benchmark claims
run: python3 scripts/ci/check_public_claims.py --verdict "$RUNNER_TEMP/remem-public-bench-verify.json"
- name: Check public and lifecycle surfaces
run: python3 scripts/ci/check_public_surface.py
- name: Check published surface baseline
env:
GH_TOKEN: ${{ github.token }}
run: python3 scripts/ci/check_surface_baseline.py "${{ github.event.pull_request.base.sha || github.event.before }}"
- name: Self-test surface lifecycle guard
run: python3 scripts/ci/check_public_surface.py --self-test
- name: Self-test REST surface fingerprints
run: python3 scripts/ci/surface_lifecycle_rest.py
- run: cargo fmt --check
- run: cargo check --no-default-features --bin remem-hook
- run: cargo clippy --all-targets -- -D warnings
- name: Run native web API smoke
run: scripts/smoke_native_web_api.sh
- name: Run extraction baseline gate
run: cargo run -- eval-extraction --json --check-baseline > /tmp/remem-extraction-eval.json
- name: Run eval regression gates
run: cargo run -- eval-gates --json-out /tmp/remem-eval-gates.json
- name: Prove eval gate blocks constructed regression
run: |
set +e
cargo run -- eval-gates --simulate-golden-regression --json-out /tmp/remem-eval-gates-regression.json > /tmp/remem-eval-gates-regression.log 2>&1
code=$?
set -e
cat /tmp/remem-eval-gates-regression.log
if [ "$code" -eq 0 ]; then
echo "expected simulated eval regression to fail"
exit 1
fi
grep -q "golden.slice.temporal.hit_at_k regressed" /tmp/remem-eval-gates-regression.log
- name: Prove capacity gate blocks constructed regression
run: |
set +e
cargo run -- eval-gates --simulate-capacity-regression --json-out /tmp/remem-eval-gates-capacity-regression.json > /tmp/remem-eval-gates-capacity-regression.log 2>&1
code=$?
set -e
cat /tmp/remem-eval-gates-capacity-regression.log
if [ "$code" -eq 0 ]; then
echo "expected simulated capacity regression to fail"
exit 1
fi
grep -q "capacity.degradation.fused.recall_at_k_loss increased" /tmp/remem-eval-gates-capacity-regression.log
- name: Upload eval gate artifact
if: always()
uses: actions/upload-artifact@v4
with:
name: remem-eval-gates
path: |
/tmp/remem-extraction-eval.json
/tmp/remem-eval-gates.json
/tmp/remem-eval-gates-regression.json
/tmp/remem-eval-gates-regression.log
/tmp/remem-eval-gates-capacity-regression.json
/tmp/remem-eval-gates-capacity-regression.log
- name: Run production tests without eval
run: cargo test --no-default-features --features local-onnx
- name: Run eval tests
run: cargo test --features eval --lib eval --test e2e_eval
windows_local_embedding_security:
runs-on: windows-latest
steps:
- uses: actions/checkout@v6.0.2
- uses: dtolnay/rust-toolchain@stable
- uses: Swatinem/rust-cache@v2
- name: Check Windows local embedding integration
run: cargo check --locked --all-targets
- name: Test Windows local embedding filesystem security
run: cargo test --locked --lib retrieval::embedding::local_semantic