jakman85andClaude Opus 4.8
67bc3175f5
The static gate passes (lint + Kyverno L0 + L1 render) but the trailing actions/upload-artifact@v4 step fails with "not supported on GHES" — Gitea Actions does not implement the artifact-v2 backend — and its always() failure sank the whole job. Remove the step; JUnit/coverage remain in the job workspace. Re-add via the @v3 action or Gitea's artifact backend later if retention is needed. Co-Authored-By: Claude Opus 4.8 <[email protected]>
90 lines
4.5 KiB
YAML
90 lines
4.5 KiB
YAML
# .gitea/workflows/gate.yml — the ENFORCED PR merge gate (Phase 6, WS-GITOSS).
|
|
#
|
|
# This is the LIVE gate wired to the in-cluster Gitea Actions runner (ns gitea-actions,
|
|
# Docker executor + DinD). It runs the STATIC layers of the conformance gate — the ones
|
|
# docs/14 says run "without a cluster": spec-immutability (best-effort), lint, Kyverno L0,
|
|
# and L1 offline render checks. It is the single required status check on `main`
|
|
# (see branch protection). `make -C ci lint l0 l1` here is byte-identical to a laptop run
|
|
# (R-TEST-02) — the runner just installs the pinned tools from ci/versions.env first.
|
|
#
|
|
# The L2/L3 CONFORMANCE layer (behavioural + fault-injection, needs a live cluster) is
|
|
# NOT wired yet — it is a deliberate design decision (a CI toolchain image + a scoped
|
|
# in-cluster kubeconfig/RBAC for the runner). It is present below as an `if: false`
|
|
# placeholder so the shape is visible and the wiring is a one-line flip once decided.
|
|
# The full pipeline blueprint (spec-checkout, per-layer jobs, decision job) is retained
|
|
# dormant in merge-gate.yaml.
|
|
---
|
|
name: gate
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
push:
|
|
branches:
|
|
- main
|
|
- 'feature/**'
|
|
- 'fix/**'
|
|
- 'docs/**'
|
|
- 'chore/**'
|
|
|
|
concurrency:
|
|
group: gate-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
# Single required status check: the static merge gate.
|
|
gate:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # full history so ci/touched-requirements.sh can diff vs main
|
|
|
|
- name: Install pinned CI toolchain (ci/versions.env)
|
|
run: |
|
|
./.gitea/workflows/scripts/install-tools.sh l0
|
|
./.gitea/workflows/scripts/install-tools.sh l1
|
|
|
|
# R-TEST-06: the spec is read-only to agents. The spec repo is NOT checked out into
|
|
# CI here (it is a separate repo; SPEC_REPO_SLUG is not wired into this runner), so
|
|
# the guard honestly SKIPS (exit 3) rather than faking green. A real drift/edit of a
|
|
# co-located spec would exit 1 and fail. Tolerated: exit 3 only.
|
|
# Call the script DIRECTLY, not via `make`: GNU make masks a recipe's exit code as
|
|
# its own 2 on failure, so `make spec-immutability || [ $? -eq 3 ]` would see 2 and
|
|
# fail. The script itself exits 3 on an honest skip (spec repo not checked out here),
|
|
# which we tolerate; a real drift/edit exits 1 and fails the gate.
|
|
- name: Spec immutability (R-TEST-06, skips if spec repo absent)
|
|
run: ./ci/spec-immutability.sh || [ "$?" -eq 3 ]
|
|
|
|
- name: Static gate — lint + Kyverno L0 + L1 render
|
|
run: make -C ci lint l0 l1
|
|
|
|
# NOTE: no actions/upload-artifact step. Gitea Actions rejects upload-artifact@v4
|
|
# ("not supported on GHES" — Gitea does not implement the artifact-v2 backend), which
|
|
# would fail the job even on a green gate. JUnit + coverage are written under
|
|
# conformance/_artifacts/ in the job workspace; wire artifact upload later via the
|
|
# Gitea-compatible @v3 action or Gitea's own artifact backend if retention is wanted.
|
|
|
|
# ───────────────────────────────────────────────────────────────────────────
|
|
# PLACEHOLDER — NOT WIRED (STOP-and-report item, WS-GITOSS Phase 6).
|
|
# L2/L3 conformance (Chainsaw behavioural + fault-injection) needs a LIVE cluster.
|
|
# Turning this on is a design decision with two open sub-decisions:
|
|
# 1. Toolchain: build+push a pinned CI image to the Gitea container registry and
|
|
# reference it as the job image, vs. install-in-job from ci/versions.env (slower).
|
|
# 2. Cluster creds: how the runner reaches the cluster — the intended model is an
|
|
# in-cluster Chainsaw Job driven by its OWN scoped ServiceAccount (CI holds only a
|
|
# narrow trigger credential; the runner mounts NO SA token today). That SA + RBAC
|
|
# + the trigger secret do not exist yet.
|
|
# Kept `if: false` so it never runs (shows skipped, never fakes green — HARD RULE 4).
|
|
# ───────────────────────────────────────────────────────────────────────────
|
|
conformance:
|
|
runs-on: ubuntu-latest
|
|
needs: [gate]
|
|
if: false
|
|
steps:
|
|
- name: Placeholder
|
|
run: |
|
|
echo "L2/L3 conformance not wired — see gate.yml header + WS-GITOSS report." >&2
|
|
exit 1
|