jakman85andClaude Opus 5
e6f6e4febb
Every check in this repo reads the repository, the rendered manifests, or the cluster.
NONE could see Gitea's own database, and that is where branch protection and runner
registration live. Three failures came out of that blind spot on 2026-09-29, all the same
shape -- a setting that READ as enforced while not being, with nothing able to notice:
* main had NO branch protection for ~a month while DECISIONS-LOG recorded it as a
required status check;
* ZERO Actions runners were registered, so PR #1 -- the first PR this repo ever had --
sat pending for 30.6 minutes with nothing to execute it;
* after enable_status_check and required_approvals were turned on they STILL did not
bite, because block_admin_merge_override was false: PRs #5-#9 merged with zero
approvals recorded against required_approvals: 1.
infra/gitea/*.sh ASSERT the desired state. Nothing DETECTED drift from it. This is the
detector.
ci/gitea-settings.sh runs as a merge-gate stage: it diffs the live rule at
/branch_protections/main against infra/gitea/expected-branch-protection.json and asserts at
least one runner is online. It reads the RULE object, not /branches/main -- the branch view
does not expose block_admin_merge_override and showed all-green while the rule was
overridable by the only account that merges.
Verified by test, not assumed:
no token -> exit 3, skips loudly, does NOT block
live == declaration -> exit 0
injected drift -> exit 1, blocks, naming both the drifted key and the runner count
The skip is DELIBERATELY not in gate.sh's strict-skips loop. Making an absent credential
block every PR is precisely the lock-yourself-out failure this repo keeps walking into, so
a skip denies a PASS (exit 3) and says loudly what is unverified. REQUIRE_GITEA_SETTINGS=true
upgrades it to a block once the token is wired.
gate.yml's `|| [ "$?" -eq 3 ]` tolerance now covers a second stage. That widening is
declared in the file rather than left to be discovered, and it narrows back the moment
REQUIRE_GITEA_SETTINGS is set.
infra/gitea/set-ci-token.sh mints the token and stores it as the repo Actions secret without
ever printing the value.
UNTIL THAT TOKEN EXISTS THIS STAGE SKIPS, AND A SKIPPED DETECTOR DETECTS NOTHING.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
64 lines
2.5 KiB
Makefile
64 lines
2.5 KiB
Makefile
# ci/Makefile — portable, single-command local equivalent of the Gitea Actions
|
|
# merge gate (R-TEST-02: the gates are runnable TODAY, without Gitea).
|
|
#
|
|
# The LIVE Gitea Actions workflow (.gitea/workflows/gate.yml) invokes `make -C ci gate`
|
|
# directly, so `make -C ci gate` locally IS the CI merge gate — byte-for-byte. Run from
|
|
# anywhere:
|
|
# make -C ci gate
|
|
#
|
|
# Every stage is a thin wrapper over a ci/*.sh script; see ci/README.md.
|
|
SHELL := /usr/bin/env bash
|
|
CI_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
|
|
|
|
.DEFAULT_GOAL := help
|
|
|
|
.PHONY: help spec-immutability lint schema l0 render-golden l1 conformance gate all touched versions tools test
|
|
|
|
help: ## Show this help
|
|
@awk 'BEGIN{FS=":.*##"} /^[a-zA-Z0-9_-]+:.*##/{printf " \033[36m%-14s\033[0m %s\n",$$1,$$2}' $(MAKEFILE_LIST)
|
|
|
|
spec-immutability: ## R-TEST-06: fail if the spec repo is modified or drifted from ci/SPEC_PIN
|
|
@"$(CI_DIR)spec-immutability.sh"
|
|
|
|
lint: ## yaml/lint (no cluster; live now)
|
|
@"$(CI_DIR)lint.sh"
|
|
|
|
schema l0: ## ServiceDefinition schema validation + Kyverno L0 policy gate (no cluster; live now)
|
|
@"$(CI_DIR)l0.sh"
|
|
|
|
render-golden: ## render==golden: canonical render reproduces committed apps/ (no cluster; live now)
|
|
@"$(CI_DIR)render-golden.sh"
|
|
|
|
l1: ## L1 rendering checks (no cluster; live now)
|
|
@"$(CI_DIR)l1.sh"
|
|
|
|
gitea-settings: ## Gitea branch protection + runners match infra/gitea/expected-branch-protection.json (SKIPS w/o GITEA_SETTINGS_TOKEN)
|
|
@./gitea-settings.sh
|
|
|
|
conformance: ## L2/L3 in-cluster Chainsaw Job (SKIPS w/o CLUSTER_AVAILABLE=true)
|
|
@"$(CI_DIR)conformance.sh"
|
|
|
|
gate: ## Full merge gate: all stages + R-TEST-03 decision (the single command)
|
|
@"$(CI_DIR)gate.sh"
|
|
|
|
all: gate ## Alias for `gate`
|
|
|
|
touched: ## Print the touched-requirement subset for the current branch vs main
|
|
@"$(CI_DIR)touched-requirements.sh"
|
|
|
|
test: ## Run ci/ script unit tests (no cluster; e.g. touched-requirements content scan)
|
|
@rc=0; for t in "$(CI_DIR)"tests/*.test.sh; do \
|
|
echo "== $$t"; bash "$$t" || rc=1; \
|
|
done; \
|
|
if [ $$rc -ne 0 ]; then echo "ci/tests: FAILED" >&2; else echo "ci/tests: all suites passed"; fi; \
|
|
exit $$rc
|
|
|
|
versions: ## Print pinned tool versions (R-TEST-02)
|
|
@cat "$(CI_DIR)versions.env"
|
|
|
|
tools: ## Report which required tools are installed locally
|
|
@source "$(CI_DIR)versions.env"; \
|
|
for t in yamllint kyverno chainsaw kubectl yq git; do \
|
|
if command -v $$t >/dev/null 2>&1; then printf " \033[32mok\033[0m %s\n" "$$t"; \
|
|
else printf " \033[33mmiss\033[0m %s\n" "$$t"; fi; done
|