# =============================================================================
# In-cluster Chainsaw conformance Job — SKELETON (ADR-0011; docs/14)
#
# CI (Gitea Actions, T-6.1b) TRIGGERS this Job and waits for it; CI holds NO
# cluster credentials. The Job runs L1/L2/L3 under the scoped `conformance-runner`
# ServiceAccount (rbac.yaml), writes JUnit + coverage to a results location that
# CI collects, and enforces the merge / phase-exit gate on the outcome.
#
# Two invocation shapes (CI sets args):
#   * MERGE GATE:  ./run.sh --requirements <touched R-IDs>   (subset)
#   * PHASE EXIT:  ./run.sh --layer all                      (full suite)
#
# Results artifact mechanism (delegated to WS-TEST by docs/14 open items):
#   Chosen = a shared results emptyDir + a terminating log stream, with an
#   OPTIONAL results PVC for durability across CI collection. For Phase 0 there is
#   no cluster; this manifest is reconciled by Flux from Phase 1+ and exercised
#   once L2/L3 can run. CI collects `report.junit.xml` + `coverage/` from the
#   results volume (or scrapes the pod log, which echoes their paths).
#
# NOT applied in Phase 0 (no cluster). Image tag pinned to versions.env CHAINSAW_IMAGE.
# =============================================================================
apiVersion: batch/v1
kind: Job
metadata:
  generateName: conformance-run-
  namespace: conformance
  labels:
    app.kubernetes.io/part-of: conformance
spec:
  backoffLimit: 0            # deterministic: a failed conformance run is a failure, no retry
  ttlSecondsAfterFinished: 3600
  template:
    metadata:
      labels:
        app.kubernetes.io/part-of: conformance
    spec:
      serviceAccountName: conformance-runner    # scoped test identity (rbac.yaml)
      restartPolicy: Never
      securityContext:
        runAsNonRoot: true
        seccompProfile: { type: RuntimeDefault }
      containers:
        - name: chainsaw
          # PIN to versions.env CHAINSAW_IMAGE (ghcr.io/kyverno/chainsaw:v0.2.12).
          image: ghcr.io/kyverno/chainsaw:v0.2.12
          workingDir: /workspace/conformance
          # The suite repo is delivered into /workspace (git clone init-container or
          # a Flux-populated volume). run.sh is the single entrypoint (identical to local).
          command: ["./run.sh"]
          # CI overrides args per invocation shape:
          #   ["--requirements", "R-NET-01,R-NET-06"]   (merge gate) OR
          #   ["--layer", "all", "--strict-coverage"]   (phase exit)
          args: ["--layer", "all", "--strict-coverage"]
          env:
            - name: CONF_ROOT
              value: /workspace/conformance
          volumeMounts:
            - { name: workspace, mountPath: /workspace }
            - { name: results, mountPath: /workspace/conformance/_artifacts }
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities: { drop: ["ALL"] }
            runAsNonRoot: true
      volumes:
        # Suite source: populated by an init-container git clone of the impl repo at
        # the commit under test, OR a Flux-synced source volume. (Init container
        # omitted from this skeleton; wire in T-6.1b.)
        - name: workspace
          emptyDir: {}
        # Results: CI collects report.junit.xml + coverage/ from here. Swap emptyDir
        # for a results PVC if durability beyond pod lifetime is required.
        - name: results
          emptyDir: {}