From 1caa30473b7ad5626dafef3e22a32e386c198b3e Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Fri, 10 Jul 2026 16:21:32 +0100
Subject: [PATCH] Publish immutable conformance bundles

---
 .github/workflows/conformance.yml | 48 +++++++++++++++++++++++++++++++
 README.md                         |  5 ++++
 package.json                      |  1 +
 scripts/pack-conformance.ps1      | 21 ++++++++++++++
 4 files changed, 75 insertions(+)
 create mode 100644 .github/workflows/conformance.yml
 create mode 100644 scripts/pack-conformance.ps1

diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
new file mode 100644
index 0000000..73b054c
--- /dev/null
+++ b/.github/workflows/conformance.yml
@@ -0,0 +1,48 @@
+name: Eve conformance
+
+on:
+  push:
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+jobs:
+  locked-conformance:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Materialize public evidence workspace
+        shell: powershell
+        run: .\scripts\materialize-workspace.ps1
+
+      - name: Run locked conformance
+        shell: powershell
+        run: .\scripts\run-conformance.ps1 -WorkspaceRoot .\artifacts\workspace
+
+      - name: Pack immutable evidence bundle
+        id: pack
+        shell: powershell
+        run: |
+          $archive = .\scripts\pack-conformance.ps1 -Version $env:GITHUB_SHA
+          "archive=$archive" >> $env:GITHUB_OUTPUT
+
+      - name: Upload conformance bundle
+        uses: actions/upload-artifact@v4
+        with:
+          name: eve-conformance-${{ github.sha }}
+          path: ${{ steps.pack.outputs.archive }}
+          if-no-files-found: error
+
+      - name: Attach tagged release bundle
+        if: startsWith(github.ref, 'refs/tags/v')
+        shell: powershell
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          gh release view $env:GITHUB_REF_NAME 2>$null
+          if ($LASTEXITCODE -ne 0) {
+            gh release create $env:GITHUB_REF_NAME --verify-tag --generate-notes
+          }
+          gh release upload $env:GITHUB_REF_NAME "${{ steps.pack.outputs.archive }}" --clobber
diff --git a/README.md b/README.md
index 33572e6..ad943e8 100644
--- a/README.md
+++ b/README.md
@@ -26,3 +26,8 @@ powershell -ExecutionPolicy Bypass -File .\scripts\run-conformance.ps1 -Workspac
 For development, `-WorkspaceRoot E:\Projects` verifies sibling checkouts only
 when every checkout already matches the lock. Local branch state is never
 accepted as released conformance evidence.
+
+GitHub Actions runs the same locked workspace on every push and uploads a bundle
+named for the EveConformance commit. A `v*` tag creates a GitHub release carrying
+that exact lock, parity report, schema catalog, capability matrix, packs, and
+typed witnesses.
diff --git a/package.json b/package.json
index e9db33c..f7113f3 100644
--- a/package.json
+++ b/package.json
@@ -4,6 +4,7 @@
   "type": "module",
   "scripts": {
     "materialize": "powershell -ExecutionPolicy Bypass -File ./scripts/materialize-workspace.ps1",
+    "pack": "powershell -ExecutionPolicy Bypass -File ./scripts/pack-conformance.ps1",
     "test": "powershell -ExecutionPolicy Bypass -File ./scripts/run-conformance.ps1"
   }
 }
diff --git a/scripts/pack-conformance.ps1 b/scripts/pack-conformance.ps1
new file mode 100644
index 0000000..0f76986
--- /dev/null
+++ b/scripts/pack-conformance.ps1
@@ -0,0 +1,21 @@
+param(
+  [string] $OutputDirectory = "artifacts\release",
+  [string] $Version = ""
+)
+
+$ErrorActionPreference = "Stop"
+$repoRoot = Split-Path -Parent $PSScriptRoot
+$versionName = if ($Version) { $Version } else { (git -C $repoRoot rev-parse --short=12 HEAD) }
+$outputRoot = if ([IO.Path]::IsPathRooted($OutputDirectory)) { $OutputDirectory } else { Join-Path $repoRoot $OutputDirectory }
+$stage = Join-Path $outputRoot "eve-conformance-$versionName"
+$archive = "$stage.zip"
+
+if (Test-Path $stage) { Remove-Item -LiteralPath $stage -Recurse -Force }
+if (Test-Path $archive) { Remove-Item -LiteralPath $archive -Force }
+New-Item -ItemType Directory -Force -Path $stage | Out-Null
+Copy-Item -LiteralPath (Join-Path $repoRoot "conformance-workspace.lock.json") -Destination $stage
+Copy-Item -LiteralPath (Join-Path $repoRoot "artifacts\parity\latest.json") -Destination (Join-Path $stage "parity-report.json")
+Copy-Item -LiteralPath (Join-Path $repoRoot "artifacts\parity\latest.md") -Destination (Join-Path $stage "parity-report.md")
+Copy-Item -LiteralPath (Join-Path $repoRoot "artifacts\conformance\latest") -Destination (Join-Path $stage "conformance") -Recurse
+Compress-Archive -LiteralPath $stage -DestinationPath $archive
+Write-Output $archive