Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

ci: bake pinned test toolchain into devcontainer + fix conformance layer/spec-immutability seams

Browse Source 
Bake the conformance harness toolchain into infra/devcontainer so `make -C ci gate`
runs identically here and in CI:
- Containerfile: install kyverno CLI (1.13.4), kyverno-json, chainsaw (0.2.12),
  yamllint (1.35.1), check-jsonschema (0.29.4), yq (4.44.6) via new pinned RUN block;
  add diffutils + python3-pip; drop stale LIBVIRT_DEFAULT_URI; refresh header for the
  Proxmox(bpg)+conformance toolbox; extend /etc/dev-toolchain-versions provenance.
- versions.env: add KYVERNO/KYVERNO_JSON/CHAINSAW/YAMLLINT/YQ/CHECK_JSONSCHEMA;
  align KUBECTL 1.32.0 -> 1.31.4. dev.sh build(): pass the new --build-args.
- ci/versions.env: pin CHECK_JSONSCHEMA_VERSION=0.29.4 (single source of truth).

Fix harness seams so the gate can run:
- dev.sh run(): mount the sibling spec repo (home-network-k3s) read-only at
  /home-network-k3s for ci/spec-immutability.sh (R-TEST-06); conditional so the
  container still runs without it.
- conformance/lib/common.sh conf_dirs_for_layer(): accept a comma/space list of
  layers and union the dirs, so ci/conformance.sh `run.sh --layer l2,l3` selects
  both layers in one pass (backward compatible for single layers).

NOTE: ci/versions.env pins KYVERNO_JSON_VERSION=0.0.5, which has no upstream release
(max tag is v0.0.3; platform/kyverno/scripts/run-l0.sh already defaults to v0.0.3).
Baked v0.0.3 and flagged for PM to correct ci/versions.env. kyverno-json is not used
by any static gate stage.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-25 15:43:19 -05:00
1 parent 0d7495486e
commit bb48f675ee
6 files changed
+102 -25
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

conformance/lib/common.sh
+19 -13
View File
@@ -47,20 +47,26 @@ conf_dirs_for_requirements() {
done < <(conf_all_test_files) | sort -u
}
# Directories for a given layer subtree: l1 | l2 | l3 | meta | all
# Directories for a given layer (subtree): l1 | l2 | l3 | meta | all.
# Accepts a comma/space separated LIST of layers (e.g. "l2,l3") and returns the UNION of
# their test dirs, deduplicated. A single layer keeps its prior behavior (backward compatible);
# this is what lets `run.sh --layer l2,l3` (the ci/conformance.sh L2/L3 stage) select both
# layers in one pass instead of erroring on an unknown "l2,l3" layer.
conf_dirs_for_layer() {
local layer="$1" sub
case "$layer" in
all) find "${CONF_ROOT}/tests" -type f -name 'chainsaw-test.yaml' -exec dirname {} \; | sort -u ;;
l1) sub="l1-rendering" ;;
l2) sub="l2-behavioral" ;;
l3) sub="l3-fault-injection" ;;
meta) sub="meta" ;;
*) echo "unknown layer: $layer" >&2; return 2 ;;
esac
if [ "$layer" != all ]; then
find "${CONF_ROOT}/tests/${sub}" -type f -name 'chainsaw-test.yaml' -exec dirname {} \; 2>/dev/null | sort -u
fi
local layers="$1" layer
local -a roots=()
for layer in ${layers//,/ }; do
case "$layer" in
all) roots=("${CONF_ROOT}/tests"); break ;;
l1) roots+=("${CONF_ROOT}/tests/l1-rendering") ;;
l2) roots+=("${CONF_ROOT}/tests/l2-behavioral") ;;
l3) roots+=("${CONF_ROOT}/tests/l3-fault-injection") ;;
meta) roots+=("${CONF_ROOT}/tests/meta") ;;
*) echo "unknown layer: $layer" >&2; return 2 ;;
esac
done
[ "${#roots[@]}" -gt 0 ] || return 0
find "${roots[@]}" -type f -name 'chainsaw-test.yaml' -exec dirname {} \; 2>/dev/null | sort -u
}
# Normalize a comma/space separated requirement list to space-separated, uppercased.