jakman85andClaude Opus 4.8
8c1368977e
Adopt the spec's Phase-0 clarifications (spec now at pin a7fc19f) into the impl: - schema v1.1: enforce exposure:public => auth.mode!=none (positive+negative tested). - Kyverno: add longhorn=>size and longhorn=>NOT-reacquirable invariants (R-STATE-02/03). - Ratify the homelab.keithjackson.dev/* label-key convention (now in spec docs/03). - R-TEST-06 spec-immutability gate: ci/SPEC_PIN + ci/spec-immutability.sh + gate.sh stage + Makefile target + a Gitea job (checks spec repo clean & at pin). - touched-requirements.sh: conformance tags are the authoritative source. Reconcile 3 CI seams the CI worker flagged (gate was RED, now GREEN): - create schemas/validate.sh (SCHEMA_VALIDATE_CMD entrypoint) — L0 schema gate runs. - fix l1.sh/conformance.sh to run.sh's real interface (fixed _artifacts/ paths; no --junit/--coverage) and collect artifacts. - exec bits on new scripts. make -C ci gate => PASS (l0 skips locally w/o kyverno binary; green in CI). Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
60 lines
2.5 KiB
Bash
Executable File
60 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ci/conformance.sh — Stage 5: L2 behavioral + L3 fault-injection.
|
|
#
|
|
# Per docs/14 + ADR-0011, L2/L3 run as an IN-CLUSTER Chainsaw Job on the dev/test
|
|
# cluster; CI only *triggers* the Job and *collects* its JUnit + coverage. CI holds
|
|
# no broad kubeconfig — the Job's own scoped ServiceAccount holds cluster access.
|
|
#
|
|
# PHASE 0: no cluster exists. This stage therefore SKIPS (exit 3) — clearly
|
|
# reported, never faked green (HARD RULE 4). It goes live in Phase 1+ once a
|
|
# cluster is declared via CLUSTER_AVAILABLE=true.
|
|
set -euo pipefail
|
|
CI_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck disable=SC1091
|
|
source "${CI_DIR}/lib.sh"
|
|
|
|
log "Stage: L2/L3 conformance (in-cluster Chainsaw Job)"
|
|
mkartifacts
|
|
|
|
if ! cluster_available; then
|
|
skip "no cluster configured (CLUSTER_AVAILABLE!=true) — L2/L3 NOT RUN. Phase 0: expected."
|
|
skip "these requirements remain UNVERIFIED until a dev/test cluster exists (Phase 1)."
|
|
summary "- conformance-l2-l3: **SKIPPED — cluster required** (Phase 0; not a pass)"
|
|
exit 3
|
|
fi
|
|
|
|
if ! entrypoint_ready "$CONFORMANCE_CMD"; then
|
|
die "CLUSTER_AVAILABLE=true but conformance runner '${CONFORMANCE_CMD}' is missing (T-0.4)"
|
|
fi
|
|
|
|
# Touched-requirement subset (R-TEST-03) — the merge gate runs only the tagged
|
|
# subset the change touches, not the whole suite.
|
|
mapfile -t reqs < <("${CI_DIR}/touched-requirements.sh" || true)
|
|
req_args=()
|
|
if [ "${#reqs[@]}" -gt 0 ]; then
|
|
log "touched requirements: ${reqs[*]}"
|
|
req_args=(--requirements "$(IFS=,; echo "${reqs[*]}")")
|
|
else
|
|
log "no touched requirements detected — running full L2/L3 subset as a safety net"
|
|
fi
|
|
|
|
# RECONCILED (PM 2026-08-16): run.sh writes artifacts to conformance/_artifacts/ and does
|
|
# NOT accept --junit/--coverage. This stage is CLUSTER-GATED (only runs when
|
|
# CLUSTER_AVAILABLE=true, Phase 1+), so its trigger path is confirmed against a real
|
|
# cluster in Phase 1 — TODO(Phase 1): drive the in-cluster Chainsaw Job
|
|
# (conformance/incluster/chainsaw-job.yaml) under the narrow CONFORMANCE_TRIGGER_KUBECONFIG,
|
|
# and confirm multi-layer (l2 + l3) selection syntax against run.sh. Artifacts are then
|
|
# COLLECTED from the fixed location below.
|
|
"$CONFORMANCE_CMD" --layer l2,l3 "${req_args[@]}"
|
|
|
|
CONF_ART="$(dirname "$CONFORMANCE_CMD")/_artifacts"
|
|
if [ -f "${CONF_ART}/report.junit.xml" ]; then
|
|
cp "${CONF_ART}/report.junit.xml" "${JUNIT_DIR}/l2l3.junit.xml"
|
|
fi
|
|
if [ -d "${CONF_ART}/coverage" ]; then
|
|
cp -r "${CONF_ART}/coverage/." "${COVERAGE_DIR}/"
|
|
fi
|
|
|
|
ok "L2/L3 conformance passed for touched subset"
|
|
summary "- conformance-l2-l3: **passed**"
|