Skip to content

Add conformance CI workflow (fault + prod lanes) [DEV-1159] - #7

Merged
pavel-y-ivanov merged 2 commits into
mainfrom
pavel/dev-1159-conformance-ci
Jul 13, 2026
Merged

Add conformance CI workflow (fault + prod lanes) [DEV-1159]#7
pavel-y-ivanov merged 2 commits into
mainfrom
pavel/dev-1159-conformance-ci

Conversation

@pavel-y-ivanov

Copy link
Copy Markdown
Contributor

Summary

Adds .github/workflows/conformance.yml (DEV-1159): per-PR conformance CI running the raindrop-sdk-harness against this repo's Go conformance driver (conformance/, DEV-1144). Mirrors the hardened workflow already landed in python-sdk, raindrop-js, and java-sdk.

Two lanes

  • fault-lane — every PR. Builds the driver (go build -o conformance/driver ./conformance), starts the harness's local capture/fault server, and runs the full scenario corpus against it. No production calls; the only secret involved is the HARNESS_READ_TOKEN org secret used to check out the private harness repo, with a loud fork-safe skip when it's unavailable.
  • prod-lane — non-fork PRs with credentials configured. Drives the SDK against the real Raindrop ingest API and asserts records via the public Query API using the RAINDROP_WRITE_KEY / RAINDROP_QUERY_API_KEY org secrets (dedicated test org). Endpoints and credentials are scoped to the single step that needs them; skips loudly when secrets are missing.

Hardening (same pattern as the sibling SDKs)

  • Harness pinned to invisible-tools/raindrop-sdk-harness@b162d84a4c25b7203173f99e595de7ba88a57960 (main @ 2026-07-13, 27 scenarios); the bump procedure is documented in the workflow header.
  • All actions pinned to full commit SHAs; persist-credentials: false on every checkout; permissions: contents: read; concurrency group with cancel-in-progress; 15-minute job timeouts.
  • continue-on-error: true on the runner steps while the suite beds in (non-blocking); each lane uploads a report JSON artifact and writes a full job summary. Ratchet baseline is the existing conformance/failures.txt.
  • actions/setup-go uses cache: false — the module is stdlib-only with no go.sum, which the cache otherwise hard-fails on.

Notes

  • The new workflow will not run on this PR itself (it only exists on the head ref); existing CI covers this diff. First real run happens on the next PR after merge.
  • Requires human approval — repo ruleset blocks self-approval; conformance CI-only diff (single new workflow file, no source changes).

🤖 Generated with Claude Code

pavel-y-ivanov and others added 2 commits July 13, 2026 11:32
Runs the raindrop-sdk-harness against the Go conformance driver
(conformance/, DEV-1144) on every pull request, mirroring the hardened
pattern from python-sdk/raindrop-js/java-sdk:

- fault-lane: local capture/fault server only, no credentials beyond the
  HARNESS_READ_TOKEN org secret; loud fork-safe skip.
- prod-lane: real Raindrop ingest + Query API via org secrets
  (RAINDROP_WRITE_KEY / RAINDROP_QUERY_API_KEY), step-scoped env,
  loud skip when secrets are unavailable.
- Harness pinned to invisible-tools/raindrop-sdk-harness@b162d84a
  (main @ 2026-07-13); bump procedure documented in the header.
- Actions SHA-pinned, persist-credentials: false, concurrency
  cancel-in-progress, 15min timeouts, continue-on-error while the suite
  beds in, report JSON artifact + job summary per lane.

DEV-1159

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
New scenarios since the previous pin (wrap-capture-attachments, the three
expect.traces span scenarios) are all status: experimental — they report
but never gate, so no ratchet changes are needed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@pavel-y-ivanov
pavel-y-ivanov merged commit 36542a9 into main Jul 13, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants