Workbook CI and SARIF

wolfxl-ci turns the existing WolfXL Guard comparison into a CI-native contract. It evaluates one baseline/candidate pair, writes the canonical Guard JSON report, projects findings into SARIF 2.1.0, and exits non-zero for either a regression or an unassessed policy dimension.

wolfxl-ci \
  --before tests/fixtures/baseline.xlsx \
  --after build/candidate.xlsx \
  --policy .wolfxl/guard-policy.json \
  --json-report build/wolfxl-guard.json \
  --sarif-report build/wolfxl-guard.sarif

Omit --policy to use Guard's strict default policy. Report writes are atomic, JSON keys and SARIF results are sorted, and absolute host paths are not emitted. The candidate workbook location in SARIF is repository-relative when possible and falls back to its filename otherwise.

GitHub Actions

Install the exact WolfXL version first, then call the bundled composite action. The action deliberately does not install WolfXL or receive registry credentials.

permissions:
  contents: read
  security-events: write

steps:
  - uses: actions/checkout@v4

  - name: Install the pinned WolfXL build
    run: python -m pip install --require-hashes -r requirements-wolfxl.txt

  - name: Build candidate workbook
    run: python scripts/build_report.py

  - name: Verify workbook fidelity
    id: workbook-ci
    uses: SynthGL/wolfxl/.github/actions/workbook-ci@<pinned-commit>
    with:
      before: tests/fixtures/baseline.xlsx
      after: build/candidate.xlsx
      policy: .wolfxl/guard-policy.json

  - name: Upload SARIF
    if: always() && steps.workbook-ci.outputs.reports-produced == 'true'
    uses: github/codeql-action/upload-sarif@v3
    with:
      sarif_file: wolfxl-guard.sarif

  - name: Retain canonical evidence
    if: always() && steps.workbook-ci.outputs.reports-produced == 'true'
    uses: actions/upload-artifact@v4
    with:
      name: wolfxl-evidence
      path: |
        wolfxl-guard.json
        wolfxl-guard.sarif

Uploading SARIF to GitHub code scanning depends on the repository's GitHub security-plan configuration. Retaining the two report artifacts works without code scanning. The reports-produced output is set only when the current invocation created both reports, so a failed preflight cannot upload stale evidence from an earlier run.

Exit codes

Code	Meaning
0	Every assessed policy dimension passed.
1	At least one dimension failed or remained unassessed.
2	Inputs, policy, or output paths were invalid.
3	An unexpected internal error prevented evaluation.

Workbook CI does not assert calculation correctness, rendered appearance, or macro execution unless a separate workflow supplies those proofs. SARIF is a projection of Guard; it is not a second verification engine.