Phase-6: enable Gitea Actions, in-cluster act_runner, static CI gate

STEP 1 — enable Gitea Actions: pin GITEA__actions__ENABLED=true and DEFAULT_ACTIONS_URL=github in the gitea bootstrap patch (was implicit upstream default; make it a declared property). STEP 2 — deploy + register an act_runner in a dedicated non-app namespace (gitea-actions) so the privileged DinD executor sidecar is admitted without a Kyverno policy exception (restrict-host-namespaces scopes to app namespaces only). Docker executor + DinD sidecar over a shared TLS-cert emptyDir; runner state on a Longhorn PVC (registers once). Registration token delivered as a SOPS-encrypted Secret decrypted by Flux. Runner mounts no ServiceAccount token (R-SEC-02). STEP 3 — author .gitea/workflows/gate.yml: the live enforced merge gate running the STATIC layers (spec-immutability best-effort, lint, Kyverno L0, L1 render) via `make -C ci lint l0 l1` with the pinned toolchain installed at job start. L2/L3 conformance is an if:false placeholder (needs a toolchain image + scoped cluster creds — a design decision, not wired). merge-gate.yaml reduced to workflow_dispatch (dormant full-pipeline blueprint). install-tools.sh gains check-jsonschema so the schema stage validates in CI instead of skipping. Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-08-25 23:51:52 -05:00
1 parent 81ef78295a
commit bc4519bc4c
@@ -0,0 +1,89 @@
+# .gitea/workflows/gate.yml — the ENFORCED PR merge gate (Phase 6, WS-GITOSS).
+#
+# This is the LIVE gate wired to the in-cluster Gitea Actions runner (ns gitea-actions,
+# Docker executor + DinD). It runs the STATIC layers of the conformance gate — the ones
+# docs/14 says run "without a cluster": spec-immutability (best-effort), lint, Kyverno L0,
+# and L1 offline render checks. It is the single required status check on `main`
+# (see branch protection). `make -C ci lint l0 l1` here is byte-identical to a laptop run
+# (R-TEST-02) — the runner just installs the pinned tools from ci/versions.env first.
+#
+# The L2/L3 CONFORMANCE layer (behavioural + fault-injection, needs a live cluster) is
+# NOT wired yet — it is a deliberate design decision (a CI toolchain image + a scoped
+# in-cluster kubeconfig/RBAC for the runner). It is present below as an `if: false`
+# placeholder so the shape is visible and the wiring is a one-line flip once decided.
+# The full pipeline blueprint (spec-checkout, per-layer jobs, decision job) is retained
+# dormant in merge-gate.yaml.
+---
+name: gate
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches:
+      - main
+      - 'feature/**'
+      - 'fix/**'
+      - 'docs/**'
+      - 'chore/**'
+
+concurrency:
+  group: gate-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # Single required status check: the static merge gate.
+  gate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0        # full history so ci/touched-requirements.sh can diff vs main
+
+      - name: Install pinned CI toolchain (ci/versions.env)
+        run: |
+          ./.gitea/workflows/scripts/install-tools.sh l0
+          ./.gitea/workflows/scripts/install-tools.sh l1
+
+      # R-TEST-06: the spec is read-only to agents. The spec repo is NOT checked out into
+      # CI here (it is a separate repo; SPEC_REPO_SLUG is not wired into this runner), so
+      # the guard honestly SKIPS (exit 3) rather than faking green. A real drift/edit of a
+      # co-located spec would exit 1 and fail. Tolerated: exit 3 only.
+      - name: Spec immutability (R-TEST-06, skips if spec repo absent)
+        run: make -C ci spec-immutability || [ "$?" -eq 3 ]
+
+      - name: Static gate — lint + Kyverno L0 + L1 render
+        run: make -C ci lint l0 l1
+
+      - name: Upload gate artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: gate-junit-coverage
+          path: |
+            results/junit/*.xml
+            reports/coverage/**
+          if-no-files-found: ignore
+
+  # ───────────────────────────────────────────────────────────────────────────
+  # PLACEHOLDER — NOT WIRED (STOP-and-report item, WS-GITOSS Phase 6).
+  # L2/L3 conformance (Chainsaw behavioural + fault-injection) needs a LIVE cluster.
+  # Turning this on is a design decision with two open sub-decisions:
+  #   1. Toolchain: build+push a pinned CI image to the Gitea container registry and
+  #      reference it as the job image, vs. install-in-job from ci/versions.env (slower).
+  #   2. Cluster creds: how the runner reaches the cluster — the intended model is an
+  #      in-cluster Chainsaw Job driven by its OWN scoped ServiceAccount (CI holds only a
+  #      narrow trigger credential; the runner mounts NO SA token today). That SA + RBAC
+  #      + the trigger secret do not exist yet.
+  # Kept `if: false` so it never runs (shows skipped, never fakes green — HARD RULE 4).
+  # ───────────────────────────────────────────────────────────────────────────
+  conformance:
+    runs-on: ubuntu-latest
+    needs: [gate]
+    if: false
+    steps:
+      - name: Placeholder
+        run: |
+          echo "L2/L3 conformance not wired — see gate.yml header + WS-GITOSS report." >&2
+          exit 1
@@ -20,18 +20,23 @@
 # CI holds NO broad kubeconfig. L2/L3 run as an in-cluster Chainsaw Job whose own
 # scoped ServiceAccount holds cluster access (docs/14, R-SEC-02); CI uses only a
 # narrow trigger credential referenced BY SECRET NAME below.
+#
+# ─────────────────────────────────────────────────────────────────────────────
+# DORMANT (Phase 6, WS-GITOSS): the LIVE enforced gate is now gate.yml. This file is
+# retained as the full-pipeline BLUEPRINT (spec-checkout via SPEC_REPO_SLUG + the L2/L3
+# conformance job + the R-TEST-03 decision job) for when those seams are wired:
+#   - SPEC_REPO_SLUG must be set as a Gitea repo/org variable AND the spec repo hosted on
+#     this Gitea, or spec-immutability's second checkout fails the whole run.
+#   - vars.CLUSTER_AVAILABLE + a scoped conformance trigger credential must exist.
+# Until then it must NOT auto-run (its spec checkout would fail with SPEC_REPO_SLUG unset),
+# so its triggers are reduced to manual `workflow_dispatch`. Re-enable by restoring the
+# pull_request/push triggers once the seams above are wired.
+# ─────────────────────────────────────────────────────────────────────────────
 ---
 name: merge-gate

 on:
-  pull_request:
-    branches: [main]           # PRs are the enforced merge gate into main (CONTRIBUTING.md)
-  push:
-    branches:
-      - 'feature/**'           # feature-branch -> main workflow (no work on main)
-      - 'fix/**'
-      - 'docs/**'
-      - 'chore/**'
+  workflow_dispatch: {}        # DORMANT blueprint — manual-only; gate.yml is the live gate

 concurrency:
  group: merge-gate-${{ github.ref }}
@@ -19,6 +19,8 @@ log() { printf '[install] %s\n' "$*" >&2; }

 install_yamllint() { have yamllint || { log "yamllint ${YAMLLINT_VERSION}"; pip install --quiet "yamllint==${YAMLLINT_VERSION}"; }; }

+install_check_jsonschema() { have check-jsonschema || { log "check-jsonschema ${CHECK_JSONSCHEMA_VERSION}"; pip install --quiet "check-jsonschema==${CHECK_JSONSCHEMA_VERSION}"; }; }
+
 install_kyverno() {
  have kyverno && return 0
  log "kyverno CLI ${KYVERNO_VERSION}"
@@ -44,10 +46,10 @@ have() { command -v "$1" >/dev/null 2>&1; }

 case "$stage" in
  lint)        install_yamllint ;;
-  l0)          install_yamllint; install_kyverno ;;
+  l0)          install_yamllint; install_check_jsonschema; install_kyverno ;;  # schema (check-jsonschema) + Kyverno L0
  l1)          install_chainsaw ;;              # L1 render via conformance runner (Chainsaw)
  conformance) install_chainsaw; install_kubectl ;;   # trigger the in-cluster Job
-  all)         install_yamllint; install_kyverno; install_chainsaw; install_kubectl ;;
+  all)         install_yamllint; install_check_jsonschema; install_kyverno; install_chainsaw; install_kubectl ;;
  *) echo "unknown stage: $stage" >&2; exit 2 ;;
 esac
 log "stage '${stage}' tools ready"