Add CASAN CI harness gate

2026-07-06 12:47:18 +09:00
parent c49ab251df
commit ace442da0e
5 changed files with 217 additions and 3 deletions
@@ -0,0 +1,37 @@
+name: CASAN Harness CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  harness:
+    runs-on: ci-runner
+    timeout-minutes: 45
+    env:
+      CASAN_CI_RUN_FRONTEND: "1"
+      CASAN_CI_RUN_INFRA_LAB: "0"
+      CASAN_GEN_MODE: "template"
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install system dependencies
+        run: |
+          set -euo pipefail
+          if ! command -v node >/dev/null 2>&1; then
+            curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
+            apt-get install -y nodejs
+          fi
+          node --version
+          npm --version
+
+      - name: Install npm dependencies
+        working-directory: AINative_OKR_CASAN5
+        run: npm ci
+
+      - name: Run CASAN harness gate
+        working-directory: AINative_OKR_CASAN5
+        run: bash .specify/scripts/bash/ci-harness-gate.sh
@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+set -uo pipefail
+
+# CASAN CI harness gate.
+# Runs the reproducible harness suites in a safe order. `run-casan4` must run
+# first because it rewrites `.specify/logs`.
+#
+# Env:
+#   CASAN_CI_RUN_FRONTEND=0|1    default 1
+#   CASAN_CI_RUN_INFRA_LAB=0|1   default 0 (Docker Compose lab is optional in CI)
+#   CASAN_CI_STEP_TIMEOUT_SEC    default 600
+#   CASAN_CI_SUITE_FILTER        optional regex; run matching suite names only
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+TESTS="$ROOT/.specify/tests"
+
+PASS=0
+FAIL=0
+SKIP=0
+
+run() {
+  local name="$1"
+  shift
+  if [[ -n "${CASAN_CI_SUITE_FILTER:-}" && ! "$name" =~ $CASAN_CI_SUITE_FILTER ]]; then
+    skip "$name (filtered)"
+    return 0
+  fi
+  echo "==> $name"
+  if run_with_timeout "$@"; then
+    echo "CI_GATE_PASS $name"
+    PASS=$((PASS + 1))
+  else
+    echo "CI_GATE_FAIL $name" >&2
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+skip() {
+  echo "CI_GATE_SKIP $1"
+  SKIP=$((SKIP + 1))
+}
+
+run_with_timeout() {
+  if ! command -v python3 >/dev/null 2>&1; then
+    "$@"
+    return $?
+  fi
+  CASAN_CI_STEP_TIMEOUT_SEC="${CASAN_CI_STEP_TIMEOUT_SEC:-600}" python3 - "$@" <<'PY'
+import os
+import subprocess
+import sys
+
+timeout = int(os.environ.get("CASAN_CI_STEP_TIMEOUT_SEC", "600"))
+cmd = sys.argv[1:]
+try:
+    raise SystemExit(subprocess.run(cmd, timeout=timeout).returncode)
+except subprocess.TimeoutExpired:
+    print(f"CI_GATE_TIMEOUT seconds={timeout} command={' '.join(cmd)}", file=sys.stderr)
+    raise SystemExit(124)
+PY
+}
+
+cd "$ROOT" || exit 1
+
+run "run-casan4-harness" bash "$TESTS/run-casan4-harness-tests.sh"
+run "adversarial-harness" bash "$TESTS/adversarial-harness-tests.sh"
+run "phase1-track-a" bash "$TESTS/phase1-track-a-tests.sh"
+run "phase2-track-c" bash "$TESTS/phase2-track-c-tests.sh"
+run "phase2-sourcegen" bash "$TESTS/phase2-sourcegen-tests.sh"
+run "phase3-evidence-pack" bash "$TESTS/phase3-evidence-pack-tests.sh"
+run "phase3-model-router" bash "$TESTS/phase3-model-router-tests.sh"
+run "phase-h5-approval" bash "$TESTS/phase-h5-approval-tests.sh"
+run "phase-h5-infra" bash "$TESTS/phase-h5-infra-tests.sh"
+run "phase-h6-agentops" bash "$TESTS/phase-h6-agentops-tests.sh"
+run "phase-c7-incident" bash "$TESTS/phase-c7-incident-tests.sh"
+run "phase-h4-multilingual" bash "$TESTS/phase-h4-multilingual-tests.sh"
+run "phase-c6-sandbox" bash "$TESTS/phase-c6-sandbox-tests.sh"
+run "phase-h4-split-inject" bash "$TESTS/phase-h4-split-inject-tests.sh"
+run "phase10-traceability" bash "$TESTS/phase10-traceability-tests.sh"
+
+if [[ "${CASAN_CI_RUN_FRONTEND:-1}" == "1" ]]; then
+  if command -v npm >/dev/null 2>&1; then
+    run "frontend-vitest" npm test -w frontend
+  else
+    skip "frontend-vitest (npm unavailable)"
+  fi
+else
+  skip "frontend-vitest (CASAN_CI_RUN_FRONTEND=0)"
+fi
+
+if [[ "${CASAN_CI_RUN_INFRA_LAB:-0}" == "1" ]]; then
+  if command -v docker >/dev/null 2>&1 && docker compose version >/dev/null 2>&1; then
+    run "local-prod-infra-lab" bash "$TESTS/phase-prod-infra-lab-tests.sh"
+  else
+    skip "local-prod-infra-lab (docker compose unavailable)"
+  fi
+else
+  skip "local-prod-infra-lab (CASAN_CI_RUN_INFRA_LAB=0)"
+fi
+
+echo "CI_GATE_SUMMARY PASS=$PASS FAIL=$FAIL SKIP=$SKIP"
+[[ "$FAIL" -eq 0 ]] || exit 1