diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e4c9a4f..2812800 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -70,7 +70,7 @@ jobs:
- name: Restore
if: ${{ needs.changes.outputs.dotnet == 'true' }}
- run: dotnet restore Vyral.sln
+ run: dotnet restore Vyral.sln --locked-mode
- name: Verify Azure Durable package coherence
if: ${{ needs.changes.outputs.dotnet == 'true' }}
@@ -126,6 +126,8 @@ jobs:
cache-dependency-path: |
clients/python/pyproject.toml
runtimes/python/pyproject.toml
+ runtimes/python/requirements-server.in
+ runtimes/python/requirements-server.lock
- name: Set up Go
if: ${{ needs.changes.outputs.go == 'true' }}
@@ -184,6 +186,7 @@ jobs:
python3 scripts/verify-markdown-links.py
python3 scripts/verify-publication-cohort.py
python3 scripts/verify-publication-policy.py
+ python3 scripts/verify-python-server-lock.py
python3 scripts/generate-sdk-types.py
python3 scripts/sync-python-runtime-contracts.py
git diff --exit-code
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b60c857..5eec42f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,7 +18,6 @@ permissions:
jobs:
scope:
name: Select CodeQL languages
- if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }}
runs-on: ubuntu-24.04
timeout-minutes: 5
outputs:
@@ -44,9 +43,6 @@ jobs:
analyze:
name: Analyze ${{ matrix.language }}
needs: scope
- # The repository variable is the emergency pause switch for hosted gates.
- # Manual dispatch remains available for controlled diagnostics.
- if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }}
runs-on: ubuntu-latest
timeout-minutes: 15
strategy:
diff --git a/.github/workflows/container-security.yml b/.github/workflows/container-security.yml
index ca455fe..6b245d4 100644
--- a/.github/workflows/container-security.yml
+++ b/.github/workflows/container-security.yml
@@ -29,8 +29,6 @@ permissions:
jobs:
scan:
name: Scan current container surfaces
- # Manual dispatch remains available when the hosted-automation pause switch is active.
- if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }}
runs-on: ubuntu-24.04
timeout-minutes: 20
env:
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index cbedf38..50d96eb 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -10,9 +10,6 @@ permissions:
jobs:
review:
name: Review dependency changes
- # The repository variable is the emergency pause switch for hosted gates.
- # Manual dispatch remains available for controlled diagnostics.
- if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }}
runs-on: ubuntu-latest
permissions:
contents: read
diff --git a/.github/workflows/execution-runtime-consumer.yml b/.github/workflows/execution-runtime-consumer.yml
index ac8248a..b8ce384 100644
--- a/.github/workflows/execution-runtime-consumer.yml
+++ b/.github/workflows/execution-runtime-consumer.yml
@@ -69,9 +69,6 @@ on:
jobs:
validate:
name: Validate consumer path
- # The repository variable is the emergency pause switch for hosted gates.
- # Manual dispatch remains available for controlled diagnostics.
- if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }}
runs-on: ubuntu-latest
env:
DOTNET_CLI_TELEMETRY_OPTOUT: "1"
@@ -92,7 +89,7 @@ jobs:
cache: false
- name: Restore
- run: dotnet restore Vyral.sln
+ run: dotnet restore Vyral.sln --locked-mode
- name: Validate local consumer contract
run: scripts/validate-execution-runtime-consumer.sh
diff --git a/.github/workflows/publish-first-cohort.yml b/.github/workflows/publish-first-cohort.yml
index 4025ead..f4db523 100644
--- a/.github/workflows/publish-first-cohort.yml
+++ b/.github/workflows/publish-first-cohort.yml
@@ -102,7 +102,7 @@ jobs:
set -euo pipefail
python -m pip install --disable-pip-version-check build==1.3.0
python3 scripts/verify-publication-cohort.py
- dotnet restore Vyral.sln
+ dotnet restore Vyral.sln --locked-mode
mkdir -p artifacts/publish/nuget artifacts/publish/npm artifacts/publish/pypi
for project in \
src/Vyral.Abstractions/Vyral.Abstractions.csproj \
diff --git a/.github/workflows/release-integrity.yml b/.github/workflows/release-integrity.yml
index de4fd2e..9f8e9df 100644
--- a/.github/workflows/release-integrity.yml
+++ b/.github/workflows/release-integrity.yml
@@ -16,9 +16,6 @@ permissions:
jobs:
verify:
name: Verify releasable artifacts
- # The repository variable is the emergency pause switch for hosted gates.
- # Manual dispatch remains available for controlled diagnostics.
- if: ${{ github.event_name == 'workflow_dispatch' || vars.VYRAL_ENABLE_AUTOMATED_WORKFLOWS == 'true' }}
# Ubuntu 24.04 restricts unprivileged user namespaces through AppArmor. The workspace-agent
# security gate must exercise Bubblewrap's real namespace boundary, never an unsandboxed
# fallback, so keep this job on the supported 22.04 runner until a reviewed AppArmor profile
diff --git a/Directory.Build.props b/Directory.Build.props
index 7415722..7e182e5 100644
--- a/Directory.Build.props
+++ b/Directory.Build.props
@@ -22,6 +22,10 @@
vyral;provider-neutral;contracts;retrieval;execution
README.md
true
+
+ true
+ true