docs: mark system.md and its loaders as legacy, not the live runtime … #438

Workflow file for this run

	name: CI

	on:
	push:
	branches: [master, main, 'feature/**']
	pull_request:
	branches: [master, main]
	workflow_dispatch:
	inputs:
	run_cutover_check:
	description: 'Run explicit Python+TS default-runtime cutover gate'
	required: true
	default: false
	type: boolean

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	lint-type:
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	python-version: ['3.11', '3.12']
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: ${{ matrix.python-version }}
	cache: pip
	- name: Install
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"
	- name: Lint (ruff)
	run: ruff check src/linuxagent/ tests/
	- name: Type check (mypy)
	run: mypy src/linuxagent/
	unit-tests:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: '3.12'
	cache: pip
	- name: Install
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"
	- name: Unit tests
	run: pytest tests/unit/ --cov=linuxagent --cov-report=term-missing --cov-report=xml --cov-report=html --cov-fail-under=80
	- name: Upload coverage report
	uses: actions/upload-artifact@v4
	with:
	name: coverage-report
	path: \|
	coverage.xml
	htmlcov/
	if-no-files-found: error

	integration-tests:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: '3.12'
	cache: pip
	- name: Install
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"
	- name: Integration tests
	run: make integration

	sandbox-tests:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: '3.12'
	cache: pip
	- name: Install
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"
	- name: Sandbox boundary tests
	run: make sandbox

	security-redlines:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: '3.12'
	- name: R-QUAL-02/03 code structure
	run: python scripts/check_code_rules.py
	- name: Architecture boundaries
	run: python scripts/check_arch_boundaries.py
	- name: Architecture stability budget
	run: python scripts/check_architecture_budget.py
	- name: R-SEC-01 ban shell=True
	run: '! grep -rn "shell=True" src/linuxagent/'
	- name: R-SEC-03 ban AutoAddPolicy
	run: '! grep -rn "AutoAddPolicy" src/linuxagent/'
	- name: R-QUAL-01 ban bare except
	run: '! grep -rnE "^[[:space:]]except:[[:space:]]$" src/linuxagent/'
	- name: R-HITL-05 no input() in graph
	run: \|
	if [ -d src/linuxagent/graph ]; then
	! grep -rn "input(" src/linuxagent/graph/
	fi
	- name: Sandbox bypass red-lines
	run: python scripts/check_sandbox_rules.py
	- name: bandit
	run: \|
	pip install "bandit>=1.7,<2.0"
	bandit -q -r src/linuxagent/ -ll

	red-team:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: '3.12'
	cache: pip
	- name: Install
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"
	- name: Red team policy tests
	run: make red-team

	harness:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: '3.12'
	cache: pip
	- name: Install
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"
	- name: Harness
	run: make harness

	ts-experimental:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-node@v4
	with:
	node-version: '22.20.0'
	cache: npm
	cache-dependency-path: ts/package-lock.json
	- name: Install TypeScript workspace
	run: make ts-install
	- name: TypeScript experimental checks
	run: make ts-check
	- name: TypeScript parity checks
	run: \|
	set -o pipefail
	make ts-parity \| tee ts-parity-summary.txt
	- name: Upload TypeScript parity summary
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: ts-parity-summary
	path: ts-parity-summary.txt
	if-no-files-found: warn

	build:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: '3.12'
	cache: pip
	- name: Install
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"
	- name: Release version checks
	run: make release-check
	- name: Verify build
	run: make verify-build

	cutover-readiness:
	if: ${{ github.event_name == 'workflow_dispatch' && inputs.run_cutover_check }}
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: '3.12'
	cache: pip
	- uses: actions/setup-node@v4
	with:
	node-version: '22.20.0'
	cache: npm
	cache-dependency-path: ts/package-lock.json
	- name: Install Python workspace
	run: \|
	python -m pip install --upgrade pip
	pip install -e ".[dev]"
	- name: Install TypeScript workspace
	run: make ts-install
	- name: Default runtime cutover gate
	run: \|
	set -o pipefail
	make cutover-check \| tee cutover-check-summary.txt
	- name: Upload cutover gate summary
	if: always()
	uses: actions/upload-artifact@v4
	with:
	name: cutover-check-summary
	path: cutover-check-summary.txt
	if-no-files-found: warn

Navigation Menu

docs: mark system.md and its loaders as legacy, not the live runtime … #438

Workflow file

docs: mark system.md and its loaders as legacy, not the live runtime … #438

Uh oh!

Workflow file for this run