jakman85andClaude Opus 5
0c6949ed98
Implements the operator intent: "CI/CD pipeline is the end-all-be-all for approval. If the CI pipeline is not good enough to be trusted for this, then it is not good enough to do its intended job and needs to be improved. Manual approvers should only be for architecturally or security relevant changes." Adds ci/approval-policy.sh as a gate stage. A green gate becomes sufficient for an ordinary change; the one exception is structural rather than a matter of taste: A CHANGE TO THE GATE CANNOT BE GATED BY THE GATE. A PR that weakens a check would be approved by the weakened check. The same holds for the admission policies, the Flux wiring that decides what reconciles, the SOPS recipients and the RBAC. Those paths -- and only those -- still require an APPROVED review from someone other than the author. The list is data with a reason per entry (infra/gitea/approval-policy.json) and is itself a sensitive path, so the policy cannot be widened or narrowed without a human. FAIL-CLOSED, and deliberately the opposite of gitea-settings. There, a missing credential must not block every PR -- that is a lock-out. Here, a missing credential would let an unreviewed change to the gate merge, so "cannot evaluate" is a BLOCK. Verified against real PRs rather than fixtures: PR #16 (sensitive paths, approved by jakman85, author gitea-admin) -> PASS PR #6 (.gitea/workflows/gate.yml, ZERO reviews) -> BLOCK, naming the file push event (not a PR) -> N/A, exit 0 bogus token -> BLOCK, not skip Also caught before shipping: the first draft passed the PR file list with a second stdin redirect after a heredoc, which silently wins and leaves the script body unread. Running it found that; reading it would not have. required_approvals is NOT changed here. Flipping it live must happen together with the declaration in expected-branch-protection.json, or gitea-settings correctly fails on the drift -- that is a separate, deliberate change. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
67 lines
2.6 KiB
Makefile
67 lines
2.6 KiB
Makefile
# ci/Makefile — portable, single-command local equivalent of the Gitea Actions
|
|
# merge gate (R-TEST-02: the gates are runnable TODAY, without Gitea).
|
|
#
|
|
# The LIVE Gitea Actions workflow (.gitea/workflows/gate.yml) invokes `make -C ci gate`
|
|
# directly, so `make -C ci gate` locally IS the CI merge gate — byte-for-byte. Run from
|
|
# anywhere:
|
|
# make -C ci gate
|
|
#
|
|
# Every stage is a thin wrapper over a ci/*.sh script; see ci/README.md.
|
|
SHELL := /usr/bin/env bash
|
|
CI_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
|
|
|
|
.DEFAULT_GOAL := help
|
|
|
|
.PHONY: help spec-immutability lint schema l0 render-golden l1 conformance gate all touched versions tools test
|
|
|
|
help: ## Show this help
|
|
@awk 'BEGIN{FS=":.*##"} /^[a-zA-Z0-9_-]+:.*##/{printf " \033[36m%-14s\033[0m %s\n",$$1,$$2}' $(MAKEFILE_LIST)
|
|
|
|
spec-immutability: ## R-TEST-06: fail if the spec repo is modified or drifted from ci/SPEC_PIN
|
|
@"$(CI_DIR)spec-immutability.sh"
|
|
|
|
lint: ## yaml/lint (no cluster; live now)
|
|
@"$(CI_DIR)lint.sh"
|
|
|
|
schema l0: ## ServiceDefinition schema validation + Kyverno L0 policy gate (no cluster; live now)
|
|
@"$(CI_DIR)l0.sh"
|
|
|
|
render-golden: ## render==golden: canonical render reproduces committed apps/ (no cluster; live now)
|
|
@"$(CI_DIR)render-golden.sh"
|
|
|
|
l1: ## L1 rendering checks (no cluster; live now)
|
|
@"$(CI_DIR)l1.sh"
|
|
|
|
approval-policy: ## CI is the approver; sensitive paths still need a human (needs PR_NUMBER + token)
|
|
@./approval-policy.sh
|
|
|
|
gitea-settings: ## Gitea branch protection + runners match infra/gitea/expected-branch-protection.json (SKIPS w/o GITEA_SETTINGS_TOKEN)
|
|
@./gitea-settings.sh
|
|
|
|
conformance: ## L2/L3 in-cluster Chainsaw Job (SKIPS w/o CLUSTER_AVAILABLE=true)
|
|
@"$(CI_DIR)conformance.sh"
|
|
|
|
gate: ## Full merge gate: all stages + R-TEST-03 decision (the single command)
|
|
@"$(CI_DIR)gate.sh"
|
|
|
|
all: gate ## Alias for `gate`
|
|
|
|
touched: ## Print the touched-requirement subset for the current branch vs main
|
|
@"$(CI_DIR)touched-requirements.sh"
|
|
|
|
test: ## Run ci/ script unit tests (no cluster; e.g. touched-requirements content scan)
|
|
@rc=0; for t in "$(CI_DIR)"tests/*.test.sh; do \
|
|
echo "== $$t"; bash "$$t" || rc=1; \
|
|
done; \
|
|
if [ $$rc -ne 0 ]; then echo "ci/tests: FAILED" >&2; else echo "ci/tests: all suites passed"; fi; \
|
|
exit $$rc
|
|
|
|
versions: ## Print pinned tool versions (R-TEST-02)
|
|
@cat "$(CI_DIR)versions.env"
|
|
|
|
tools: ## Report which required tools are installed locally
|
|
@source "$(CI_DIR)versions.env"; \
|
|
for t in yamllint kyverno chainsaw kubectl yq git; do \
|
|
if command -v $$t >/dev/null 2>&1; then printf " \033[32mok\033[0m %s\n" "$$t"; \
|
|
else printf " \033[33mmiss\033[0m %s\n" "$$t"; fi; done
|