feat(ci): nightly real-PI workflow and promote/release receipt gates

Add schedule/dispatch nightly entry that classifies infra vs product failures, and require a valid receipt (or waiver) before promote/release. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-16 14:02:24 +00:00
parent a84778f21b
commit fda159c995
5 changed files with 238 additions and 0 deletions
@@ -0,0 +1,76 @@
+# Nightly real PI regression (Wave 2B / PU5B).
+# PR CI (ci.yml) intentionally does NOT run real PI.
+name: Nightly Real PI
+
+on:
+  schedule:
+    # Daily 16:00 UTC ≈ 00:00 CST
+    - cron: "0 16 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: nightly-real-pi
+  cancel-in-progress: true
+
+jobs:
+  nightly-real-pi:
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    permissions:
+      contents: read
+    env:
+      # Optional overrides via repo vars; script defaults apply when empty.
+      PI_AGENT_RUNNER_URL: ${{ vars.PI_AGENT_RUNNER_URL }}
+      PI_AGENT_MODEL: ${{ vars.PI_AGENT_MODEL }}
+      PI_AGENT_PROTOCOL: typed-result-v1
+      # Prefer dedicated secret; empty → infra_fail via run-nightly-real-pi.sh (never PASS).
+      RUNNER_AUTH_TOKEN: ${{ secrets.RUNNER_AUTH_TOKEN }}
+      PI_AGENT_RUNNER_AUTH_TOKEN: ${{ secrets.RUNNER_AUTH_TOKEN }}
+      TEST_DATABASE_URL: ${{ secrets.NIGHTLY_TEST_DATABASE_URL }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: "1.27.1"
+          cache-dependency-path: go.sum
+
+      - name: Run nightly real-PI suite (classified receipt)
+        id: nightly
+        run: |
+          chmod +x scripts/run-nightly-real-pi.sh scripts/promotion-receipt-write.sh scripts/promotion-receipt-check.sh
+          set +e
+          ./scripts/run-nightly-real-pi.sh
+          rc=$?
+          set -e
+          echo "rc=${rc}" >> "$GITHUB_OUTPUT"
+          # Always upload receipts/evidence; never treat missing secret as PASS.
+          exit "${rc}"
+
+      - name: Upload promotion receipt artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: promotion-receipt-${{ github.sha }}
+          path: |
+            .doc/test-reports/assets/promotion-receipts/${{ github.sha }}.json
+            .doc/test-reports/assets/promotion-receipts/evidence-*
+          if-no-files-found: warn
+          retention-days: 14
+
+      - name: Summarize receipt verdict
+        if: always()
+        run: |
+          f=".doc/test-reports/assets/promotion-receipts/${GITHUB_SHA}.json"
+          if [[ -f "$f" ]]; then
+            echo "Receipt:"
+            cat "$f"
+            verdict="$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["verdict"])' "$f")"
+            echo "verdict=${verdict}"
+            if [[ "${verdict}" != "pass" ]]; then
+              echo "::error::nightly real-PI verdict=${verdict} (infrastructure failures must not be reported as PASS)"
+            fi
+          else
+            echo "::error::no promotion receipt written"
+            exit 1
+          fi