Merge pull request #856 from SEAME-pt/feat/820-python-ai-lane-detecti… #3321
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: TSF Validation (PR) | |
| on: | |
| pull_request: | |
| push: | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| jobs: | |
| run-tests: | |
| uses: ./.github/workflows/unit_tests.yml | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: none | |
| run-codeql: | |
| uses: ./.github/workflows/firmware_static.yml | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: write | |
| tsf-validation: | |
| needs: [run-tests, run-codeql] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| actions: read | |
| security-events: none | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Install dependencies | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y graphviz | |
| - name: Download Verification Artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: verification-artifacts | |
| path: artifacts/verification | |
| - name: Download Unit Test Summary | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: unit-test-summary | |
| path: artifacts/unit_tests | |
| - name: Download CodeQL Artifacts | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: codeql-sarif-filtered | |
| path: temp_codeql | |
| - name: Organize Evidence | |
| run: | | |
| mkdir -p artifacts/verification/static_analysis | |
| find temp_codeql -name "*.sarif" -exec cp {} artifacts/verification/static_analysis/codeql.sarif \; | |
| - name: Set up Python 3.11 | |
| uses: actions/setup-python@v7 | |
| with: | |
| python-version: '3.11' | |
| - name: Cache pip packages | |
| uses: actions/cache@v6 | |
| with: | |
| path: ~/.cache/pip | |
| key: ${{ runner.os }}-pip-trustable-${{ hashFiles('**/requirements.txt') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pip-trustable- | |
| - name: Install official TSF tools | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install pyyaml typing_extensions | |
| git clone https://gitlab.eclipse.org/eclipse/tsf/tsf.git /tmp/trustable | |
| cd /tmp/trustable | |
| pip install . | |
| cd - | |
| - name: Install local validators | |
| run: pip install -e dotstop | |
| - name: Create temporary symlink to .dotstop.dot | |
| run: ln -sf dotstop/.dotstop.dot .dotstop.dot | |
| - name: Run trudag lint | |
| id: lint | |
| continue-on-error: true | |
| run: | | |
| mkdir -p artifacts/tsf | |
| if trudag manage lint 2>&1 | tee artifacts/tsf/trudag-lint.txt; then | |
| echo "lint_ok=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "lint_ok=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Get lint summary | |
| id: summary | |
| run: | | |
| if [ -f artifacts/tsf/trudag-lint.txt ]; then | |
| echo "lint_summary<<EOF" >> $GITHUB_OUTPUT | |
| head -c 500 artifacts/tsf/trudag-lint.txt >> $GITHUB_OUTPUT | |
| echo "" >> $GITHUB_OUTPUT | |
| echo "EOF" >> $GITHUB_OUTPUT | |
| else | |
| echo "lint_summary=No lint output generated" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Calculate trust scores | |
| id: scores | |
| continue-on-error: true | |
| run: | | |
| if trudag score 2>&1 | tee artifacts/tsf/trudag-score.txt; then | |
| echo "score_ok=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "score_ok=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Generate traceability graph | |
| id: graph | |
| continue-on-error: true | |
| run: | | |
| mkdir -p artifacts/tsf | |
| dot -Tsvg .dotstop.dot -o artifacts/tsf/traceability_graph.svg | |
| echo "graph_generated=true" >> $GITHUB_OUTPUT | |
| - name: Generate Trustable report (publish) | |
| id: publish | |
| continue-on-error: true | |
| run: | | |
| mkdir -p artifacts/tsf/trustable-report | |
| if trudag publish --output-dir artifacts/tsf/trustable-report 2>&1; then | |
| echo "publish_ok=true" >> $GITHUB_OUTPUT | |
| elif trudag publish --no-validate --output-dir artifacts/tsf/trustable-report 2>&1; then | |
| echo "publish_ok=true" >> $GITHUB_OUTPUT | |
| else | |
| echo "publish_ok=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Create TSF comment body (markdown) | |
| if: always() | |
| run: | | |
| mkdir -p artifacts/tsf | |
| UNIT="artifacts/unit_tests/unit_test_summary.md" | |
| echo "## 🔍 TSF Validation Results" > artifacts/tsf/tsf_comment.md | |
| echo "" >> artifacts/tsf/tsf_comment.md | |
| echo "| Check | Status |" >> artifacts/tsf/tsf_comment.md | |
| echo "|-------|--------|" >> artifacts/tsf/tsf_comment.md | |
| echo "| **trudag lint** | ${{ steps.lint.outputs.lint_ok == 'true' && '✅ PASSED' || '❌ FAILED' }} |" >> artifacts/tsf/tsf_comment.md | |
| echo "| **trudag score** | ${{ steps.scores.outputs.score_ok == 'true' && '✅ PASSED' || '❌ FAILED' }} |" >> artifacts/tsf/tsf_comment.md | |
| echo "| **trudag publish** | ${{ steps.publish.outputs.publish_ok == 'true' && '✅ PASSED' || '❌ FAILED' }} |" >> artifacts/tsf/tsf_comment.md | |
| echo "" >> artifacts/tsf/tsf_comment.md | |
| echo "### 📋 Lint Output" >> artifacts/tsf/tsf_comment.md | |
| echo '```' >> artifacts/tsf/tsf_comment.md | |
| echo "${{ steps.summary.outputs.lint_summary }}" >> artifacts/tsf/tsf_comment.md | |
| echo '```' >> artifacts/tsf/tsf_comment.md | |
| echo "" >> artifacts/tsf/tsf_comment.md | |
| echo "### 📊 Traceability Graph" >> artifacts/tsf/tsf_comment.md | |
| echo "${{ steps.graph.outputs.graph_generated == 'true' && '✅ Graph generated successfully' || '❌ Graph generation failed' }}" >> artifacts/tsf/tsf_comment.md | |
| echo "" >> artifacts/tsf/tsf_comment.md | |
| echo "**Download artifacts to view**: [TSF Validation Results](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})" >> artifacts/tsf/tsf_comment.md | |
| echo "- Traceability graph: \`tsf-validation-artifacts/traceability_graph.svg\`" >> artifacts/tsf/tsf_comment.md | |
| echo "- Full TSF reports in artifact archive" >> artifacts/tsf/tsf_comment.md | |
| if [ -f "$UNIT" ]; then | |
| echo "" >> artifacts/tsf/tsf_comment.md | |
| echo "---" >> artifacts/tsf/tsf_comment.md | |
| cat "$UNIT" >> artifacts/tsf/tsf_comment.md | |
| fi | |
| - name: Upload TSF artifacts | |
| uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: tsf-validation-artifacts | |
| path: | | |
| artifacts/tsf | |
| .dotstop.dot | |
| retention-days: 30 | |
| - name: Upload TSF comment artifact | |
| uses: actions/upload-artifact@v7 | |
| if: always() | |
| with: | |
| name: tsf-comment | |
| path: artifacts/tsf/tsf_comment.md | |
| retention-days: 30 |