Skip to content

gauntlet-nightly

gauntlet-nightly #27

Workflow file for this run

name: gauntlet-nightly
on:
schedule:
- cron: "17 4 * * *" # ~04:17 UTC
workflow_dispatch:
jobs:
nightly:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
with:
go-version: "1.23.x"
- name: Build
run: go build -o bin/curbpack ./cmd/curbpack
- name: Claim safety
run: ./scripts/claim-safety.sh
- name: Redteam pilot scoreboard
run: ./scripts/redteam-pilot.sh
- name: Full baseline ratchet
run: ./scripts/gauntlet-ratchet.sh
- name: UX killers — demo sandbox + init non-destructive + hooks idempotent
run: |
set -euo pipefail
BIN="$GITHUB_WORKSPACE/bin/curbpack"
# demo must not touch caller cwd product files
MARK=$(mktemp)
echo keep > "$MARK"
BEFORE=$(pwd)
DEMO=$(mktemp -d)
"$BIN" demo --out "$DEMO" --keep
test -f "$MARK"
test "$(pwd)" = "$BEFORE"
# init twice is idempotent (does not clobber .curbpack.json)
FIX=$(mktemp -d)
cd "$FIX"
git init -q
git config user.email "ci@curbpack.local"
git config user.name "CI"
git commit --allow-empty -m init -q
"$BIN" init --packs house-policy --hooks
"$BIN" init --packs house-policy --hooks
grep -q house-policy .curbpack.json
test -x .git/hooks/pre-commit
- name: Optional pinned OSS clone (crash/hang only)
continue-on-error: true
run: |
set -euo pipefail
BIN="$GITHUB_WORKSPACE/bin/curbpack"
# Small public Go module — red gates OK; kill only crash/hang.
CLONE=$(mktemp -d)
timeout 60 git clone --depth 1 https://github.com/google/uuid.git "$CLONE" || exit 0
cd "$CLONE"
set +e
timeout 60 "$BIN" init --packs house-policy
timeout 60 "$BIN" check
code=$?
set -e
# 124 = hang (timeout) → fail; other non-zero = red gates OK
if [[ "$code" -eq 124 ]]; then
echo "OSS clone hung" >&2
exit 1
fi
echo "OSS clone finished exit=$code (red OK)"