diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index e4c9a4f..2812800 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -70,7 +70,7 @@ jobs: - name: Restore if: ${{ needs.changes.outputs.dotnet == 'true' }} - run: dotnet restore Vyral.sln + run: dotnet restore Vyral.sln --locked-mode - name: Verify Azure Durable package coherence if: ${{ needs.changes.outputs.dotnet == 'true' }} @@ -126,6 +126,8 @@ jobs: cache-dependency-path: | clients/python/pyproject.toml runtimes/python/pyproject.toml + runtimes/python/requirements-server.in + runtimes/python/requirements-server.lock - name: Set up Go if: ${{ needs.changes.outputs.go == 'true' }} @@ -184,6 +186,7 @@ jobs: python3 scripts/verify-markdown-links.py python3 scripts/verify-publication-cohort.py python3 scripts/verify-publication-policy.py + python3 scripts/verify-python-server-lock.py python3 scripts/generate-sdk-types.py python3 scripts/sync-python-runtime-contracts.py git diff --exit-code diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index b60c857..5eec42f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -18,7 +18,6 @@ permissions: jobs: scope: name: Select CodeQL languages - if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }} runs-on: ubuntu-24.04 timeout-minutes: 5 outputs: @@ -44,9 +43,6 @@ jobs: analyze: name: Analyze ${{ matrix.language }} needs: scope - # The repository variable is the emergency pause switch for hosted gates. - # Manual dispatch remains available for controlled diagnostics. - if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }} runs-on: ubuntu-latest timeout-minutes: 15 strategy: diff --git a/.github/workflows/container-security.yml b/.github/workflows/container-security.yml index ca455fe..6b245d4 100644 --- a/.github/workflows/container-security.yml +++ b/.github/workflows/container-security.yml @@ -29,8 +29,6 @@ permissions: jobs: scan: name: Scan current container surfaces - # Manual dispatch remains available when the hosted-automation pause switch is active. - if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }} runs-on: ubuntu-24.04 timeout-minutes: 20 env: diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index cbedf38..50d96eb 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -10,9 +10,6 @@ permissions: jobs: review: name: Review dependency changes - # The repository variable is the emergency pause switch for hosted gates. - # Manual dispatch remains available for controlled diagnostics. - if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }} runs-on: ubuntu-latest permissions: contents: read diff --git a/.github/workflows/execution-runtime-consumer.yml b/.github/workflows/execution-runtime-consumer.yml index ac8248a..b8ce384 100644 --- a/.github/workflows/execution-runtime-consumer.yml +++ b/.github/workflows/execution-runtime-consumer.yml @@ -69,9 +69,6 @@ on: jobs: validate: name: Validate consumer path - # The repository variable is the emergency pause switch for hosted gates. - # Manual dispatch remains available for controlled diagnostics. - if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }} runs-on: ubuntu-latest env: DOTNET_CLI_TELEMETRY_OPTOUT: "1" @@ -92,7 +89,7 @@ jobs: cache: false - name: Restore - run: dotnet restore Vyral.sln + run: dotnet restore Vyral.sln --locked-mode - name: Validate local consumer contract run: scripts/validate-execution-runtime-consumer.sh diff --git a/.github/workflows/publish-first-cohort.yml b/.github/workflows/publish-first-cohort.yml index 4025ead..f4db523 100644 --- a/.github/workflows/publish-first-cohort.yml +++ b/.github/workflows/publish-first-cohort.yml @@ -102,7 +102,7 @@ jobs: set -euo pipefail python -m pip install --disable-pip-version-check build==1.3.0 python3 scripts/verify-publication-cohort.py - dotnet restore Vyral.sln + dotnet restore Vyral.sln --locked-mode mkdir -p artifacts/publish/nuget artifacts/publish/npm artifacts/publish/pypi for project in \ src/Vyral.Abstractions/Vyral.Abstractions.csproj \ diff --git a/.github/workflows/release-integrity.yml b/.github/workflows/release-integrity.yml index de4fd2e..9f8e9df 100644 --- a/.github/workflows/release-integrity.yml +++ b/.github/workflows/release-integrity.yml @@ -16,9 +16,6 @@ permissions: jobs: verify: name: Verify releasable artifacts - # The repository variable is the emergency pause switch for hosted gates. - # Manual dispatch remains available for controlled diagnostics. - if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }} # Ubuntu 24.04 restricts unprivileged user namespaces through AppArmor. The workspace-agent # security gate must exercise Bubblewrap's real namespace boundary, never an unsandboxed # fallback, so keep this job on the supported 22.04 runner until a reviewed AppArmor profile diff --git a/Directory.Build.props b/Directory.Build.props index 7415722..7e182e5 100644 --- a/Directory.Build.props +++ b/Directory.Build.props @@ -22,6 +22,10 @@ vyral;provider-neutral;contracts;retrieval;execution README.md true + + true + true