gauntlet-nightly #27
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: gauntlet-nightly | |
| on: | |
| schedule: | |
| - cron: "17 4 * * *" # ~04:17 UTC | |
| workflow_dispatch: | |
| jobs: | |
| nightly: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 | |
| with: | |
| go-version: "1.23.x" | |
| - name: Build | |
| run: go build -o bin/curbpack ./cmd/curbpack | |
| - name: Claim safety | |
| run: ./scripts/claim-safety.sh | |
| - name: Redteam pilot scoreboard | |
| run: ./scripts/redteam-pilot.sh | |
| - name: Full baseline ratchet | |
| run: ./scripts/gauntlet-ratchet.sh | |
| - name: UX killers — demo sandbox + init non-destructive + hooks idempotent | |
| run: | | |
| set -euo pipefail | |
| BIN="$GITHUB_WORKSPACE/bin/curbpack" | |
| # demo must not touch caller cwd product files | |
| MARK=$(mktemp) | |
| echo keep > "$MARK" | |
| BEFORE=$(pwd) | |
| DEMO=$(mktemp -d) | |
| "$BIN" demo --out "$DEMO" --keep | |
| test -f "$MARK" | |
| test "$(pwd)" = "$BEFORE" | |
| # init twice is idempotent (does not clobber .curbpack.json) | |
| FIX=$(mktemp -d) | |
| cd "$FIX" | |
| git init -q | |
| git config user.email "ci@curbpack.local" | |
| git config user.name "CI" | |
| git commit --allow-empty -m init -q | |
| "$BIN" init --packs house-policy --hooks | |
| "$BIN" init --packs house-policy --hooks | |
| grep -q house-policy .curbpack.json | |
| test -x .git/hooks/pre-commit | |
| - name: Optional pinned OSS clone (crash/hang only) | |
| continue-on-error: true | |
| run: | | |
| set -euo pipefail | |
| BIN="$GITHUB_WORKSPACE/bin/curbpack" | |
| # Small public Go module — red gates OK; kill only crash/hang. | |
| CLONE=$(mktemp -d) | |
| timeout 60 git clone --depth 1 https://github.com/google/uuid.git "$CLONE" || exit 0 | |
| cd "$CLONE" | |
| set +e | |
| timeout 60 "$BIN" init --packs house-policy | |
| timeout 60 "$BIN" check | |
| code=$? | |
| set -e | |
| # 124 = hang (timeout) → fail; other non-zero = red gates OK | |
| if [[ "$code" -eq 124 ]]; then | |
| echo "OSS clone hung" >&2 | |
| exit 1 | |
| fi | |
| echo "OSS clone finished exit=$code (red OK)" |