docs: FS↔M anchors+mapping, release workflow, Rust WASM policy demo, tip link #87
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| name: Release Artifacts | ||
|
|
||
| on: | ||
| push: | ||
| tags: | ||
| - 'v[0-9]+.[0-9]+.[0-9]+' | ||
|
|
||
| permissions: | ||
| contents: write | ||
|
|
||
| jobs: | ||
| release: | ||
| if: github.ref_type == 'tag' && startsWith(github.ref, 'refs/tags/v') | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Prepare assets | ||
| run: | | ||
| set -euo pipefail | ||
| for dir in schemas tests/vectors scripts/vectors; do | ||
| if [ ! -d "$dir" ]; then | ||
| echo "ERROR: Required directory '$dir' not found" >&2 | ||
| exit 1 | ||
| fi | ||
| done | ||
| mkdir -p dist | ||
| zip -r dist/schemas.zip schemas | ||
| zip -r dist/vectors.zip tests/vectors scripts/vectors | ||
| - name: Create GitHub Release | ||
| uses: softprops/action-gh-release@v2 | ||
| with: | ||
| files: | | ||
| dist/schemas.zip | ||
| dist/vectors.zip | ||
| env: | ||
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| name: CBOR Vectors (Python/Go) | ||
|
|
||
| on: | ||
| push: | ||
| branches: [ main ] | ||
| pull_request: | ||
|
|
||
|
Comment on lines
+3
to
+7
There was a problem hiding this comment. 🧹 Nitpick | 🔵 Trivial Fix YAML formatting for consistency. Static analysis flags several style issues: bracket/brace spacing, truthy values, extra blank lines. Apply these formatting fixes: on:
push:
- branches: [ main ]
+ branches: [main]
pull_request:And at line 24: - with: { go-version: '1.21.x' }
+ with: {go-version: '1.21.x'}And remove the trailing blank line at the end of the file. Based on static analysis. 🧰 Tools🪛 YAMLlint (1.37.1)[warning] 3-3: truthy value should be one of [false, true] (truthy) [error] 5-5: too many spaces inside brackets (brackets) [error] 5-5: too many spaces inside brackets (brackets) 🤖 Prompt for AI Agents |
||
| jobs: | ||
| cbor-vectors: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| - name: Python cbor id | ||
| id: py | ||
| run: | | ||
| python -m pip install --upgrade pip cbor2 blake3 | ||
| python scripts/vectors/python/cbor_canon.py tests/vectors/core/entry_canonical.json > py_cbor_id.txt | ||
| echo "id=$(cat py_cbor_id.txt)" >> $GITHUB_OUTPUT | ||
| - name: Go cbor id | ||
| id: go | ||
| uses: actions/setup-go@v5 | ||
| with: { go-version: '1.21.x' } | ||
| - run: | | ||
| cd scripts/vectors/go-cbor && go build -o ../../bin_lk_cbor_go . | ||
| scripts/bin_lk_cbor_go tests/vectors/core/entry_canonical.json > go_cbor_id.txt | ||
| echo "id=$(cat go_cbor_id.txt)" >> $GITHUB_OUTPUT | ||
| - name: Compare CBOR IDs | ||
| run: | | ||
| echo "Python CBOR: ${{ steps.py.outputs.id }}" | ||
| echo "Go CBOR: ${{ steps.go.outputs.id }}" | ||
| test "${{ steps.py.outputs.id }}" = "${{ steps.go.outputs.id }}" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,68 @@ | ||||||||||||||||||
| name: Canonicalization Vectors (Python/Rust/Go) | ||||||||||||||||||
|
|
||||||||||||||||||
| on: | ||||||||||||||||||
| push: | ||||||||||||||||||
| branches: [ main ] | ||||||||||||||||||
| pull_request: | ||||||||||||||||||
|
Comment on lines
+3
to
+6
There was a problem hiding this comment. 🧹 Nitpick | 🔵 Trivial Fix YAML formatting for consistency. Static analysis flags style issues with brackets and truthy values (same as vectors-cbor.yml). Apply these formatting fixes: on:
push:
- branches: [ main ]
+ branches: [main]
pull_request:And at lines 17, 40 for braces spacing. Based on static analysis. 📝 Committable suggestion
Suggested change
🧰 Tools🪛 YAMLlint (1.37.1)[warning] 3-3: truthy value should be one of [false, true] (truthy) [error] 5-5: too many spaces inside brackets (brackets) [error] 5-5: too many spaces inside brackets (brackets) 🤖 Prompt for AI Agents |
||||||||||||||||||
|
|
||||||||||||||||||
| jobs: | ||||||||||||||||||
| vectors: | ||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||
| steps: | ||||||||||||||||||
| - name: Checkout | ||||||||||||||||||
| uses: actions/checkout@v4 | ||||||||||||||||||
|
|
||||||||||||||||||
| - name: Set up Python | ||||||||||||||||||
| uses: actions/setup-python@v5 | ||||||||||||||||||
| with: { python-version: '3.x' } | ||||||||||||||||||
| - name: Install python deps | ||||||||||||||||||
| run: python -m pip install --upgrade pip blake3 | ||||||||||||||||||
| - name: Python compute id | ||||||||||||||||||
| id: py | ||||||||||||||||||
| run: | | ||||||||||||||||||
|
There was a problem hiding this comment. Unquoted variable expansions: Quote Lines 22, 34, 46 expand - echo "id=$(cat py_id.txt)" >> $GITHUB_OUTPUT
+ echo "id=$(cat py_id.txt)" >> "$GITHUB_OUTPUT"Apply the same fix on lines 34 and 46. Also applies to: 34-34, 46-46 🧰 Tools🪛 actionlint (1.7.8)22-22: shellcheck reported issue in this script: SC2086:info:2:31: Double quote to prevent globbing and word splitting (shellcheck) 🤖 Prompt for AI Agents |
||||||||||||||||||
| python scripts/vectors/python/canon.py tests/vectors/core/entry_canonical.json > py_id.txt | ||||||||||||||||||
| echo "id=$(cat py_id.txt)" >> $GITHUB_OUTPUT | ||||||||||||||||||
| - name: Set up Rust | ||||||||||||||||||
| uses: dtolnay/rust-toolchain@stable | ||||||||||||||||||
| - name: Build Rust tool | ||||||||||||||||||
| run: | | ||||||||||||||||||
| cd scripts/vectors/rust | ||||||||||||||||||
| cargo build --release | ||||||||||||||||||
| - name: Rust compute id | ||||||||||||||||||
| id: rs | ||||||||||||||||||
| run: | | ||||||||||||||||||
| scripts/vectors/rust/target/release/lk_canon_rust tests/vectors/core/entry_canonical.json > rs_id.txt | ||||||||||||||||||
| echo "id=$(cat rs_id.txt)" >> $GITHUB_OUTPUT | ||||||||||||||||||
| - name: Set up Go | ||||||||||||||||||
| uses: actions/setup-go@v5 | ||||||||||||||||||
| with: { go-version: '1.21.x' } | ||||||||||||||||||
| - name: Build Go tool | ||||||||||||||||||
| run: | | ||||||||||||||||||
| cd scripts/vectors/go && go build -o ../../bin_lk_canon_go . | ||||||||||||||||||
| - name: Go compute id | ||||||||||||||||||
| id: go | ||||||||||||||||||
| run: | | ||||||||||||||||||
| scripts/bin_lk_canon_go tests/vectors/core/entry_canonical.json > go_id.txt | ||||||||||||||||||
| echo "id=$(cat go_id.txt)" >> $GITHUB_OUTPUT | ||||||||||||||||||
| - name: Compare IDs | ||||||||||||||||||
| run: | | ||||||||||||||||||
| echo "Python: ${{ steps.py.outputs.id }}" | ||||||||||||||||||
| echo "Rust: ${{ steps.rs.outputs.id }}" | ||||||||||||||||||
| echo "Go: ${{ steps.go.outputs.id }}" | ||||||||||||||||||
| test "${{ steps.py.outputs.id }}" = "${{ steps.rs.outputs.id }}" | ||||||||||||||||||
| test "${{ steps.rs.outputs.id }}" = "${{ steps.go.outputs.id }}" | ||||||||||||||||||
| - name: C (blake3) check over canonical bytes | ||||||||||||||||||
| run: | | ||||||||||||||||||
| sudo apt-get update && sudo apt-get install -y libblake3-dev | ||||||||||||||||||
| echo -n "${{ steps.py.outputs.id }}" > py_id_hex | ||||||||||||||||||
| # Compute canonical bytes via Python tool | ||||||||||||||||||
| python scripts/vectors/python/canon.py tests/vectors/core/entry_canonical.json > can.txt | ||||||||||||||||||
| # Compile the C tool and pipe canonical bytes into it | ||||||||||||||||||
| gcc -O2 -lblake3 -o c_b3sum scripts/vectors/c/blake3_id.c | ||||||||||||||||||
| ./c_b3sum < can.txt > c_id.txt | ||||||||||||||||||
| echo "C: $(cat c_id.txt)" | ||||||||||||||||||
| test "$(cat c_id.txt)" = "${{ steps.py.outputs.id }}" | ||||||||||||||||||
|
Comment on lines
+58
to
+68
There was a problem hiding this comment. Dead variable: Remove unused Line 61 writes the Python ID hexadecimal output to a file but never references echo -n "${{ steps.py.outputs.id }}" > py_id_hexThe file is created and immediately discarded. Remove this line or justify its use if it serves a debugging purpose. 🤖 Prompt for AI Agents |
||||||||||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,13 @@ | ||
| # Changelog | ||
|
|
||
| ## v0.1.0 (proposed) | ||
|
|
||
| - Spec spine: Model (M‑1..M‑9), Formal Spec (FS‑1..FS‑14) | ||
| - Wire Format: JSON canonical profile (+ optional CBOR profile), BLAKE3‑256 id, domain‑separated signing input | ||
| - Compliance: levels (Core/Policy/WASM), checks C‑1..C‑5, report schema | ||
| - Schemas: entry, attestation, policy_result, compliance_report (+ aliases) | ||
| - Vectors: Python/Rust/Go canonicalization tools; JSON golden vector; CI matrix that fails on divergence | ||
| - Orchestrator: minimal TOML‑driven runner that emits compliance.json and validates against schema | ||
| - WASM Policy ABI: deterministic host interface and constraints | ||
| - Implementers Guide and CLI harness docs | ||
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🧩 Analysis chain
Verify GitHub Actions glob pattern for semantic version tags.
Line 6's pattern
- 'v[0-9]+.[0-9]+.[0-9]+'uses glob syntax (not regex). In GitHub Actions glob patterns,[0-9]is a character class (matches single digit), but+is literal (not a quantifier as in regex). This means the pattern matchesv0.0.+literally, notv1.2.3.For semantic versioning (v1.2.3), the correct glob pattern should be:
- 'v[0-9]*.[0-9]*.[0-9]*'(wildcard for any digit sequence), or- 'v[0-9][0-9]*.[0-9][0-9]*.[0-9][0-9]*'(if stricter), orVerify the tag pattern behavior:
Or test locally by creating a tag matching your pattern and verifying the workflow triggers.
🌐 Web query:
💡 Result:
Short answer: GitHub Actions uses glob patterns (not regular expressions) to match tag names in on.push.tags / tags-ignore, so you cannot strictly express full semver with regex quantifiers (like +). Use globs to approximate semver and, if you need exact semver validation, combine a permissive tag-glob with an in-workflow regex check.
Key points and examples
Recommended pattern (practical)
push:
tags: [ 'v*' ]
References
Fix the tag glob pattern—it will not trigger on semantic version releases.
GitHub Actions uses shell-style globbing (not regex) for tags, so quantifiers like
+are treated as literal characters, not as "one or more" operators. The pattern'v[0-9]+.[0-9]+.[0-9]+'is fundamentally broken: it won't matchv1.2.3at all; it will only match tags containing literal+characters.Use a permissive glob like
v*and validate the exact semver format with a regex check inside the workflow. Alternatively, if a stricter glob is preferred:'v[0-9]*.[0-9]*.[0-9]*'(though this still lacks strict digit-only enforcement).Current line 6:
- 'v[0-9]+.[0-9]+.[0-9]+'Change to:
- 'v*'Then add a validation step early in your job to enforce exact semver matching.
🤖 Prompt for AI Agents