.github/workflows/operational.yml

name: Operational Validation

# Runtime gate for the non-doc operational surfaces: receipt chaining and
# UDS payload manifest/attestation generation.

on:
  push:
    branches: [main]
    paths:
      - 'artifacts/a11oy-uds/**'
      - 'deploy/**'
      - 'packages/receipt-substrate/**'
      - 'packages/perception-loop/**'
      - 'packages/sequence-pipeline/**'
      - 'packages/sparse-attention-kit/**'
      - 'huggingface/**'
      - 'docs/huggingface.md'
      - 'docs/INVESTOR_DEMO.md'
      - 'docs/WARHACKER_UDS_PROOF_POINT.md'
      - 'docs/ecosystem-readiness-report.json'
      - 'scripts/*.py'
      - 'scripts/validate-operational.sh'
      - 'scripts/release/lib/**'
      - '.github/workflows/operational.yml'
  pull_request:
    branches: [main]
    paths:
      - 'artifacts/a11oy-uds/**'
      - 'deploy/**'
      - 'packages/receipt-substrate/**'
      - 'packages/perception-loop/**'
      - 'packages/sequence-pipeline/**'
      - 'packages/sparse-attention-kit/**'
      - 'huggingface/**'
      - 'docs/huggingface.md'
      - 'docs/INVESTOR_DEMO.md'
      - 'docs/WARHACKER_UDS_PROOF_POINT.md'
      - 'docs/ecosystem-readiness-report.json'
      - 'scripts/*.py'
      - 'scripts/validate-operational.sh'
      - 'scripts/release/lib/**'
      - '.github/workflows/operational.yml'

permissions:
  contents: read

concurrency:
  group: operational-${{ github.ref }}
  cancel-in-progress: true

jobs:
  operational:
    name: Receipt + UDS validation
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit
      - name: Checkout repository
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v4
        with:
          persist-credentials: false
      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4
        with:
          version: 10.33.3
      - name: Setup Node.js
        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
        with:
          node-version: '22'
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Validate operational surfaces
        run: |
          bash scripts/validate-operational.sh
          python3 -m py_compile scripts/prepare_huggingface_payload.py scripts/publish_huggingface_payload.py scripts/build_operational_payload.py
          npm run payload:verify
          npm run payload:huggingface
          # Build the operational payload bundle in CI before verifying it. The
          # tarball is a deterministic build artifact (it embeds dist/, the
          # lockfile, and generated manifests) and is intentionally not
          # committed to the repo, so the verify step has nothing to check
          # unless we generate it here first.
          npm run payload:bundle
          npm run payload:bundle:verify