# ci/versions.env — pinned tool versions (R-TEST-02: reproducible, version-pinned)
#
# Single source of truth for every tool the gate invokes. The Gitea Actions
# workflow and the local scripts both source this file so CI and a laptop run
# the exact same versions. Bump deliberately; a version change is a code change
# that must go through the normal feature-branch -> main gate.
#
# Owner: WS-GITOSS (CI). The Kyverno/Chainsaw versions MUST stay in lockstep with
# whatever platform/kyverno and conformance/ pin — see integration notes in README.

# L0 policy gate (Kyverno CLI) + ServiceDefinition validation (kyverno-json)
KYVERNO_VERSION="1.19.0"
KYVERNO_JSON_VERSION="0.0.3"

# L1/L2/L3 declarative runner (Chainsaw) — invoked via conformance/ entrypoint,
# pinned here so a local run matches CI even before the in-cluster Job exists.
CHAINSAW_VERSION="0.2.12"

# Lint / manifest tooling
YAMLLINT_VERSION="1.35.1"
KUBECTL_VERSION="1.36.4"
YQ_VERSION="4.44.6"

# Alert-rule unit tests (promtool test rules) — the L0 check
# conformance/tests/l0-static/alert-rules-unit-tested runs every
# platform/**/*.promtool-test.yaml through it. MUST stay in lockstep with
# infra/devcontainer/versions.env (which bakes it into the image) AND with the Prometheus
# version running on prod, because promtool IS the rule engine: verified 2026-09-12 as
# v3.14.0-distroless via `kubectl get prometheus -n monitoring -o jsonpath='{.items[*].spec.version}'`.
# Shipped inside the prometheus release tarball, not as a separate release.
PROMTOOL_VERSION="3.14.0"

# ServiceDefinition JSON-Schema validation (schemas/validate.sh). Pip-installed;
# pinned here so CI and a laptop validate against the exact same validator.
CHECK_JSONSCHEMA_VERSION="0.29.4"