Release v0.2.1: supply chain signing + provenance hardening #77

	name: CI

	on:
	push:
	pull_request:

	jobs:
	build-test:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- uses: actions/setup-python@v5
	with:
	python-version: "3.11"
	- name: Install Python test deps
	run: \|
	python -m pip install --upgrade pip
	pip install pytest jsonschema
	- name: Configure
	run: cmake -B build -S . -DCRISPR_GPU_ENABLE_CUDA=OFF -DCRISPR_GPU_BUILD_PYTHON=ON -DCMAKE_BUILD_TYPE=Release
	- name: Build
	run: cmake --build build --config Release
	- name: Tests
	run: ctest --output-on-failure --test-dir build
	- name: Synthetic benchmark (CPU only)
	run: \|
	SKIP_GPU=1 CRISPR_GPU_WARMUP=0 BENCH_SCALE=small ./benchmarks/run_synthetic.sh
	- name: Docker CPU smoke (entrypoint + /out/report.json)
	run: \|
	docker build -f docker/Dockerfile.cpu -t crispr-gpu:cpu .
	rm -rf docker_out
	mkdir -p docker_out
	docker run --rm -v "$PWD/docker_out:/out" crispr-gpu:cpu --out-dir /out --quick --skip-gpu --redact
	python3 - <<'PY'
	import json
	from pathlib import Path

	p = Path("docker_out/report.json")
	assert p.exists(), f"missing {p}"
	r = json.loads(p.read_text(encoding="utf-8"))
	assert r.get("schema") == "crispr-gpu/report/v1"
	assert int(r.get("schema_version", 0)) == 1
	print("docker report ok")
	PY

Provide feedback