jakman85andClaude Opus 4.8
fe0ee698c4
The committed apps/ goldens were a MIX of two render flag sets: 8 services were rendered with `--no-image-automation` (no image CRs) while gitea and nextcloud carried stale ImageRepository/ImagePolicy CRs from a render WITHOUT the flag. Neither single command reproduced all goldens, and the gate did not catch it. Part A — canonical render: python3 catalog/render.py --all catalog -o apps --wave-layout --no-image-automation `--no-image-automation` is canonical: image automation is authored-but-DISABLED (DECISIONS-LOG; image-reflector/-automation controllers not installed), and every app was onboarded via this flag. Re-render drops the ImageRepository + ImagePolicy objects from gitea + nextcloud only (52 line deletions, purely the trailing image-automation blocks). No functional content changed — the nextcloud postStart hardening and gitea OIDC hook are untouched. Part B — enforcement: ci/render-golden.sh renders every onboarded catalog service with the canonical command into a temp dir and FAILS on ANY diff vs committed apps/ (missing golden or content drift), across all 10 services (not just the 3 L1 spot-checks). Not-onboarded catalog entries (keycloak, vm-demo) are excluded per DESIGN-waves. Wired as a required no-cluster stage in ci/gate.sh, ci/Makefile, and both the live (.gitea/workflows/gate.yml) and dormant (merge-gate.yaml) pipelines. Proof: tampering a golden makes the stage exit 1 (blocks merge); reverting restores exit 0. `make -C ci gate` green in the devcontainer. Co-Authored-By: Claude Opus 4.8 <[email protected]>
53 lines
2.0 KiB
Makefile
53 lines
2.0 KiB
Makefile
# ci/Makefile — portable, single-command local equivalent of the Gitea Actions
|
|
# merge gate (R-TEST-02: the gates are runnable TODAY, without Gitea).
|
|
#
|
|
# The Gitea Actions workflow (.gitea/workflows/merge-gate.yaml) calls these exact
|
|
# scripts, so `make -C ci gate` locally == the CI merge gate. Run from anywhere:
|
|
# make -C ci gate
|
|
#
|
|
# Every stage is a thin wrapper over a ci/*.sh script; see ci/README.md.
|
|
SHELL := /usr/bin/env bash
|
|
CI_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
|
|
|
|
.DEFAULT_GOAL := help
|
|
|
|
.PHONY: help spec-immutability lint schema l0 render-golden l1 conformance gate all touched versions tools
|
|
|
|
help: ## Show this help
|
|
@awk 'BEGIN{FS=":.*##"} /^[a-zA-Z0-9_-]+:.*##/{printf " \033[36m%-14s\033[0m %s\n",$$1,$$2}' $(MAKEFILE_LIST)
|
|
|
|
spec-immutability: ## R-TEST-06: fail if the spec repo is modified or drifted from ci/SPEC_PIN
|
|
@"$(CI_DIR)spec-immutability.sh"
|
|
|
|
lint: ## yaml/lint (no cluster; live now)
|
|
@"$(CI_DIR)lint.sh"
|
|
|
|
schema l0: ## ServiceDefinition schema validation + Kyverno L0 policy gate (no cluster; live now)
|
|
@"$(CI_DIR)l0.sh"
|
|
|
|
render-golden: ## render==golden: canonical render reproduces committed apps/ (no cluster; live now)
|
|
@"$(CI_DIR)render-golden.sh"
|
|
|
|
l1: ## L1 rendering checks (no cluster; live now)
|
|
@"$(CI_DIR)l1.sh"
|
|
|
|
conformance: ## L2/L3 in-cluster Chainsaw Job (SKIPS w/o CLUSTER_AVAILABLE=true)
|
|
@"$(CI_DIR)conformance.sh"
|
|
|
|
gate: ## Full merge gate: all stages + R-TEST-03 decision (the single command)
|
|
@"$(CI_DIR)gate.sh"
|
|
|
|
all: gate ## Alias for `gate`
|
|
|
|
touched: ## Print the touched-requirement subset for the current branch vs main
|
|
@"$(CI_DIR)touched-requirements.sh"
|
|
|
|
versions: ## Print pinned tool versions (R-TEST-02)
|
|
@cat "$(CI_DIR)versions.env"
|
|
|
|
tools: ## Report which required tools are installed locally
|
|
@source "$(CI_DIR)versions.env"; \
|
|
for t in yamllint kyverno chainsaw kubectl yq git; do \
|
|
if command -v $$t >/dev/null 2>&1; then printf " \033[32mok\033[0m %s\n" "$$t"; \
|
|
else printf " \033[33mmiss\033[0m %s\n" "$$t"; fi; done
|