60e2bb7039
Pin actions/checkout, setup-python, cache, and upload-artifact to full-length commit SHAs across the bench, lint, precision-gate, and tsan workflows (supply-chain hardening; mutable tags can be re-pointed).
100 lines
3.3 KiB
YAML
100 lines
3.3 KiB
YAML
name: precision-gate
|
|
|
|
# Enforces the per-detector precision/recall drift gate that previously only
|
|
# ran locally (bench/score_fp.py --gate). Runs on PRs that touch detection or
|
|
# scoring code so a precision regression cannot land silently.
|
|
#
|
|
# Hermetic by design: gates on the committed `security-bugs` corpus against a
|
|
# committed security-bugs-scoped baseline (bench/fp-baseline-security-bugs.json).
|
|
# Juliet is intentionally NOT used here — it is fetched from NIST and is too
|
|
# fragile for a required PR check. The weekly bench.yml job covers Juliet.
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
pull_request:
|
|
paths:
|
|
- "src/detect/**"
|
|
- "src/symbolic/**"
|
|
- "include/fold/detect/**"
|
|
- "include/fold/symbolic/**"
|
|
- "include/fold/report/**"
|
|
- "bench/score_fp.py"
|
|
- "bench/fp-baseline-security-bugs.json"
|
|
- "bench/corpora/security-bugs/**"
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: precision-gate-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
gate:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
|
|
|
|
- name: Install system deps
|
|
run: |
|
|
sudo apt-get update
|
|
sudo apt-get install -y \
|
|
clang-19 clang-tidy-19 \
|
|
llvm-19-dev libclang-19-dev libclang-cpp19-dev \
|
|
libz3-dev libsqlite3-dev \
|
|
meson ninja-build pkg-config \
|
|
nlohmann-json3-dev \
|
|
libcli11-dev libspdlog-dev libfmt-dev
|
|
|
|
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
|
|
with:
|
|
python-version: "3.12"
|
|
|
|
- name: Install Conan
|
|
run: |
|
|
python -m pip install --upgrade pip
|
|
python -m pip install "conan>=2,<3"
|
|
conan profile detect --force
|
|
|
|
- name: Cache Conan
|
|
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
|
|
with:
|
|
path: ~/.conan2
|
|
key: conan-precision-gate-${{ hashFiles('conanfile.py') }}
|
|
|
|
- name: Configure + build fold (release)
|
|
env:
|
|
CC: clang-19
|
|
CXX: clang++-19
|
|
run: |
|
|
conan install . --output-folder=build/release --build=missing \
|
|
-s build_type=Release -o build_tests=False
|
|
ln -sf /usr/lib/x86_64-linux-gnu/pkgconfig/z3.pc build/release/z3.pc
|
|
meson setup build/release \
|
|
--native-file build/release/conan_meson_native.ini \
|
|
-Dcpp_std=c++23 \
|
|
-Dllvm-config-path="$(command -v llvm-config-19)"
|
|
meson compile -C build/release
|
|
|
|
- name: Precision/recall drift gate (security-bugs)
|
|
run: |
|
|
python3 bench/score_fp.py \
|
|
--run --security-bugs \
|
|
--fold-bin build/release/src/cli/fold \
|
|
--processes 1 \
|
|
--gate \
|
|
--baseline bench/fp-baseline-security-bugs.json \
|
|
--tolerance 0.02 \
|
|
--out /tmp/fp-current-security-bugs.json \
|
|
--summary
|
|
|
|
- name: Upload drift report
|
|
if: always()
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
|
|
with:
|
|
name: precision-gate-report
|
|
path: |
|
|
/tmp/fp-current-security-bugs.json
|
|
/tmp/fp-current-security-bugs.md
|
|
if-no-files-found: ignore
|