T-0.2 CI merge-gate pipeline + portable local runners (R-TEST-02/03, R-GITOPS-01)

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
2026-08-16 00:08:33 -05:00
1 parent de56c55dcc
commit 0d86630271
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# .gitea/workflows/scripts/install-tools.sh — install the PINNED tools a given
+# gate stage needs on a Gitea Actions runner. Versions come from ci/versions.env
+# (single source of truth, R-TEST-02). Usage: install-tools.sh <lint|l0|l1|conformance>
+set -euo pipefail
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "${HERE}/../../.." && pwd)"
+# shellcheck disable=SC1091
+source "${REPO_ROOT}/ci/versions.env"
+
+stage="${1:-all}"
+os="$(uname -s | tr '[:upper:]' '[:lower:]')"
+arch="$(uname -m)"; case "$arch" in x86_64) arch=amd64 ;; aarch64|arm64) arch=arm64 ;; esac
+bindir="${HOME}/.local/bin"; mkdir -p "$bindir"
+echo "${bindir}" >> "${GITHUB_PATH:-/dev/null}" 2>/dev/null || true
+export PATH="${bindir}:${PATH}"
+
+log() { printf '[install] %s\n' "$*" >&2; }
+
+install_yamllint() { have yamllint || { log "yamllint ${YAMLLINT_VERSION}"; pip install --quiet "yamllint==${YAMLLINT_VERSION}"; }; }
+
+install_kyverno() {
+  have kyverno && return 0
+  log "kyverno CLI ${KYVERNO_VERSION}"
+  local url="https://github.com/kyverno/kyverno/releases/download/v${KYVERNO_VERSION}/kyverno-cli_v${KYVERNO_VERSION}_${os}_${arch}.tar.gz"
+  curl -fsSL "$url" | tar -xz -C "$bindir" kyverno
+}
+
+install_chainsaw() {
+  have chainsaw && return 0
+  log "chainsaw ${CHAINSAW_VERSION}"
+  local url="https://github.com/kyverno/chainsaw/releases/download/v${CHAINSAW_VERSION}/chainsaw_${os}_${arch}.tar.gz"
+  curl -fsSL "$url" | tar -xz -C "$bindir" chainsaw
+}
+
+install_kubectl() {
+  have kubectl && return 0
+  log "kubectl ${KUBECTL_VERSION}"
+  curl -fsSL -o "${bindir}/kubectl" "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/${os}/${arch}/kubectl"
+  chmod +x "${bindir}/kubectl"
+}
+
+have() { command -v "$1" >/dev/null 2>&1; }
+
+case "$stage" in
+  lint)        install_yamllint ;;
+  l0)          install_yamllint; install_kyverno ;;
+  l1)          install_chainsaw ;;              # L1 render via conformance runner (Chainsaw)
+  conformance) install_chainsaw; install_kubectl ;;   # trigger the in-cluster Job
+  all)         install_yamllint; install_kyverno; install_chainsaw; install_kubectl ;;
+  *) echo "unknown stage: $stage" >&2; exit 2 ;;
+esac
+log "stage '${stage}' tools ready"