jakman85andClaude Opus 5
6e77150ae1
Unblocks the enforced Gitea gate, which correctly BLOCKED this branch on ['R-SEC-01','R-SEC-02','R-TEST-06'] being touched but uncovered. Tests were authored; the coverage rule was NOT narrowed. === THE FALSE GREEN (root cause) === `make -C ci gate` locally reported PASS having checked NOTHING. resolve_base() validated nothing, and EVERY way of failing to find a base degraded silently to an empty touched set + exit 0: an `HEAD~1` last resort, a two-dot diff fallback masking a failing three-dot diff, and no check that HEAD is even AHEAD of the base. Run while sitting on `main` (main == origin/main), `origin/main...HEAD` is empty -> "no changed files vs base" -> the empty set means run.sh is invoked with NO --requirements -> coverage.py's --require gate never runs at all. Green by vacuum. Now: candidates are BASE_REF > GITHUB_BASE_REF > origin/main > main, each verified to resolve. HEAD~1 and the two-dot fallback are gone. Unresolvable base / no merge base / failed diff / HEAD-not-ahead -> loud banner, EMPTY stdout, exit 3, and a machine-readable reason (on-base | no-base | diff-failed). gate.sh turns exit 3 into an UNDECIDED decision: `on-base` -> "NOT APPLICABLE — no branch under gate" (exit 0 so push-to-main runs don't break, but it never reads as PASS); `no-base`/`diff-failed` -> BLOCKED. It also now prints the diff base it used. A stale local main warns (widens, never falsely greens). Also fixed `make -C ci test`, which was SWALLOWING failing suites. Regression: ci/tests/touched-requirements-base.test.sh — 31 assertions over 8 throwaway-repo scenarios including the exact false-green case, an already-merged branch, no base ref, a single-commit repo, bogus BASE_REF, a shallow GITHUB_BASE_REF, and origin/main-preferred-over-stale-main. === NEW L0 STATIC LAYER (conformance/tests/l0-static/) === Where docs/14 actually puts these invariants. Each check.sh really executes offline via `run.sh --layer l0` and is wired into ci/l0.sh, so it runs on every PR. No scaffolds. R-SEC-01 no-plaintext-secrets (165 assertions / 445 tracked files): .sops.yaml holds only PUBLIC age recipients; every committed Secret is SOPS-wrapped with a mac and ENC[...] values; ansible vault.yml files are $ANSIBLE_VAULT; no secret-valued ansible key carries a literal outside a vault; no PEM key / age secret key / kubeconfig client-key-data is tracked; Flux declares sops decryption; the disallow-plaintext-secrets policy Enforces and has a proving `result: fail` row. Exemptions are SELF-POLICING, not path allowlists — a .example must be referenced by no kustomization and hold only placeholders, and the Kyverno fixture is exempt ONLY while a test asserts the policy rejects it. Proven against 7 injected violations, including deleting the negative row and weakening Enforce->Audit. R-SEC-02 least-privilege-rbac (41 assertions): no wildcard apiGroup/resource/verb and no escalate|bind|impersonate in any in-repo Role/ClusterRole; no ServiceAccount bound to cluster-admin or a wildcard role; the conformance runner's own test identity is scoped and holds no rights over RBAC objects; the default-deny/host-namespace/egress-class policies Enforce and each carry a negative row. Proven against 6 injected violations. R-TEST-06 spec-immutability-enforced (16 assertions): drives the REAL ci/spec-immutability.sh against HERMETIC throwaway spec repos and asserts its exit code in every state — clean-at-pin 0, edits under docs/ or decisions/ 1, untracked addition 1, unadopted drift 1, explicit pin bump 0, ABSENT spec repo 3 (honest skip, never green), unpinned SPEC_PIN 1 — plus that gate.sh sets BLOCK=1 on its failure, so the mechanism is load-bearing. The real spec repo is never written to. Each check documents what it does NOT cover (runtime decryption, git history, runtime least-privilege, branch protection) rather than overclaiming. status.py now reads check.sh too, so a placeholder L0 body still outranks an `executable: true` annotation. Coverage 37/51 -> 40/51 (11 gaps); executable tests 32 -> 35; scaffold-only stays 5 — no sixth scaffold was added. Serves: R-SEC-01, R-SEC-02, R-TEST-01..06. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
61 lines
2.3 KiB
Makefile
61 lines
2.3 KiB
Makefile
# ci/Makefile — portable, single-command local equivalent of the Gitea Actions
|
|
# merge gate (R-TEST-02: the gates are runnable TODAY, without Gitea).
|
|
#
|
|
# The LIVE Gitea Actions workflow (.gitea/workflows/gate.yml) invokes `make -C ci gate`
|
|
# directly, so `make -C ci gate` locally IS the CI merge gate — byte-for-byte. Run from
|
|
# anywhere:
|
|
# make -C ci gate
|
|
#
|
|
# Every stage is a thin wrapper over a ci/*.sh script; see ci/README.md.
|
|
SHELL := /usr/bin/env bash
|
|
CI_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
|
|
|
|
.DEFAULT_GOAL := help
|
|
|
|
.PHONY: help spec-immutability lint schema l0 render-golden l1 conformance gate all touched versions tools test
|
|
|
|
help: ## Show this help
|
|
@awk 'BEGIN{FS=":.*##"} /^[a-zA-Z0-9_-]+:.*##/{printf " \033[36m%-14s\033[0m %s\n",$$1,$$2}' $(MAKEFILE_LIST)
|
|
|
|
spec-immutability: ## R-TEST-06: fail if the spec repo is modified or drifted from ci/SPEC_PIN
|
|
@"$(CI_DIR)spec-immutability.sh"
|
|
|
|
lint: ## yaml/lint (no cluster; live now)
|
|
@"$(CI_DIR)lint.sh"
|
|
|
|
schema l0: ## ServiceDefinition schema validation + Kyverno L0 policy gate (no cluster; live now)
|
|
@"$(CI_DIR)l0.sh"
|
|
|
|
render-golden: ## render==golden: canonical render reproduces committed apps/ (no cluster; live now)
|
|
@"$(CI_DIR)render-golden.sh"
|
|
|
|
l1: ## L1 rendering checks (no cluster; live now)
|
|
@"$(CI_DIR)l1.sh"
|
|
|
|
conformance: ## L2/L3 in-cluster Chainsaw Job (SKIPS w/o CLUSTER_AVAILABLE=true)
|
|
@"$(CI_DIR)conformance.sh"
|
|
|
|
gate: ## Full merge gate: all stages + R-TEST-03 decision (the single command)
|
|
@"$(CI_DIR)gate.sh"
|
|
|
|
all: gate ## Alias for `gate`
|
|
|
|
touched: ## Print the touched-requirement subset for the current branch vs main
|
|
@"$(CI_DIR)touched-requirements.sh"
|
|
|
|
test: ## Run ci/ script unit tests (no cluster; e.g. touched-requirements content scan)
|
|
@rc=0; for t in "$(CI_DIR)"tests/*.test.sh; do \
|
|
echo "== $$t"; bash "$$t" || rc=1; \
|
|
done; \
|
|
if [ $$rc -ne 0 ]; then echo "ci/tests: FAILED" >&2; else echo "ci/tests: all suites passed"; fi; \
|
|
exit $$rc
|
|
|
|
versions: ## Print pinned tool versions (R-TEST-02)
|
|
@cat "$(CI_DIR)versions.env"
|
|
|
|
tools: ## Report which required tools are installed locally
|
|
@source "$(CI_DIR)versions.env"; \
|
|
for t in yamllint kyverno chainsaw kubectl yq git; do \
|
|
if command -v $$t >/dev/null 2>&1; then printf " \033[32mok\033[0m %s\n" "$$t"; \
|
|
else printf " \033[33mmiss\033[0m %s\n" "$$t"; fi; done
|