Publish immutable conformance bundles

.github/workflows/conformance.yml

@@ -0,0 +1,48 @@
+name: Eve conformance
+
+on:
+  push:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  locked-conformance:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Materialize public evidence workspace
+        shell: powershell
+        run: .\scripts\materialize-workspace.ps1
+
+      - name: Run locked conformance
+        shell: powershell
+        run: .\scripts\run-conformance.ps1 -WorkspaceRoot .\artifacts\workspace
+
+      - name: Pack immutable evidence bundle
+        id: pack
+        shell: powershell
+        run: |
+          $archive = .\scripts\pack-conformance.ps1 -Version $env:GITHUB_SHA
+          "archive=$archive" >> $env:GITHUB_OUTPUT
+
+      - name: Upload conformance bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: eve-conformance-${{ github.sha }}
+          path: ${{ steps.pack.outputs.archive }}
+          if-no-files-found: error
+
+      - name: Attach tagged release bundle
+        if: startsWith(github.ref, 'refs/tags/v')
+        shell: powershell
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release view $env:GITHUB_REF_NAME 2>$null
+          if ($LASTEXITCODE -ne 0) {
+            gh release create $env:GITHUB_REF_NAME --verify-tag --generate-notes
+          }
+          gh release upload $env:GITHUB_REF_NAME "${{ steps.pack.outputs.archive }}" --clobber

README.md

@@ -26,3 +26,8 @@ powershell -ExecutionPolicy Bypass -File .\scripts\run-conformance.ps1 -Workspac
 For development, `-WorkspaceRoot E:\Projects` verifies sibling checkouts only
 when every checkout already matches the lock. Local branch state is never
 accepted as released conformance evidence.
+
+GitHub Actions runs the same locked workspace on every push and uploads a bundle
+named for the EveConformance commit. A `v*` tag creates a GitHub release carrying
+that exact lock, parity report, schema catalog, capability matrix, packs, and
+typed witnesses.

package.json

@@ -4,6 +4,7 @@
   "type": "module",
   "scripts": {
     "materialize": "powershell -ExecutionPolicy Bypass -File ./scripts/materialize-workspace.ps1",
+    "pack": "powershell -ExecutionPolicy Bypass -File ./scripts/pack-conformance.ps1",
     "test": "powershell -ExecutionPolicy Bypass -File ./scripts/run-conformance.ps1"
   }
 }

scripts/pack-conformance.ps1

@@ -0,0 +1,21 @@
+param(
+  [string] $OutputDirectory = "artifacts\release",
+  [string] $Version = ""
+)
+
+$ErrorActionPreference = "Stop"
+$repoRoot = Split-Path -Parent $PSScriptRoot
+$versionName = if ($Version) { $Version } else { (git -C $repoRoot rev-parse --short=12 HEAD) }
+$outputRoot = if ([IO.Path]::IsPathRooted($OutputDirectory)) { $OutputDirectory } else { Join-Path $repoRoot $OutputDirectory }
+$stage = Join-Path $outputRoot "eve-conformance-$versionName"
+$archive = "$stage.zip"
+
+if (Test-Path $stage) { Remove-Item -LiteralPath $stage -Recurse -Force }
+if (Test-Path $archive) { Remove-Item -LiteralPath $archive -Force }
+New-Item -ItemType Directory -Force -Path $stage | Out-Null
+Copy-Item -LiteralPath (Join-Path $repoRoot "conformance-workspace.lock.json") -Destination $stage
+Copy-Item -LiteralPath (Join-Path $repoRoot "artifacts\parity\latest.json") -Destination (Join-Path $stage "parity-report.json")
+Copy-Item -LiteralPath (Join-Path $repoRoot "artifacts\parity\latest.md") -Destination (Join-Path $stage "parity-report.md")
+Copy-Item -LiteralPath (Join-Path $repoRoot "artifacts\conformance\latest") -Destination (Join-Path $stage "conformance") -Recurse
+Compress-Archive -LiteralPath $stage -DestinationPath $archive
+Write-Output $archive