jakman85andClaude Opus 4.8
bb48f675ee
Bake the conformance harness toolchain into infra/devcontainer so `make -C ci gate` runs identically here and in CI: - Containerfile: install kyverno CLI (1.13.4), kyverno-json, chainsaw (0.2.12), yamllint (1.35.1), check-jsonschema (0.29.4), yq (4.44.6) via new pinned RUN block; add diffutils + python3-pip; drop stale LIBVIRT_DEFAULT_URI; refresh header for the Proxmox(bpg)+conformance toolbox; extend /etc/dev-toolchain-versions provenance. - versions.env: add KYVERNO/KYVERNO_JSON/CHAINSAW/YAMLLINT/YQ/CHECK_JSONSCHEMA; align KUBECTL 1.32.0 -> 1.31.4. dev.sh build(): pass the new --build-args. - ci/versions.env: pin CHECK_JSONSCHEMA_VERSION=0.29.4 (single source of truth). Fix harness seams so the gate can run: - dev.sh run(): mount the sibling spec repo (home-network-k3s) read-only at /home-network-k3s for ci/spec-immutability.sh (R-TEST-06); conditional so the container still runs without it. - conformance/lib/common.sh conf_dirs_for_layer(): accept a comma/space list of layers and union the dirs, so ci/conformance.sh `run.sh --layer l2,l3` selects both layers in one pass (backward compatible for single layers). NOTE: ci/versions.env pins KYVERNO_JSON_VERSION=0.0.5, which has no upstream release (max tag is v0.0.3; platform/kyverno/scripts/run-l0.sh already defaults to v0.0.3). Baked v0.0.3 and flagged for PM to correct ci/versions.env. kyverno-json is not used by any static gate stage. Co-Authored-By: Claude Opus 4.8 <[email protected]>
27 lines
1.1 KiB
Bash
27 lines
1.1 KiB
Bash
# ci/versions.env — pinned tool versions (R-TEST-02: reproducible, version-pinned)
|
|
#
|
|
# Single source of truth for every tool the gate invokes. The Gitea Actions
|
|
# workflow and the local scripts both source this file so CI and a laptop run
|
|
# the exact same versions. Bump deliberately; a version change is a code change
|
|
# that must go through the normal feature-branch -> main gate.
|
|
#
|
|
# Owner: WS-GITOSS (CI). The Kyverno/Chainsaw versions MUST stay in lockstep with
|
|
# whatever platform/kyverno and conformance/ pin — see integration notes in README.
|
|
|
|
# L0 policy gate (Kyverno CLI) + ServiceDefinition validation (kyverno-json)
|
|
KYVERNO_VERSION="1.13.4"
|
|
KYVERNO_JSON_VERSION="0.0.5"
|
|
|
|
# L1/L2/L3 declarative runner (Chainsaw) — invoked via conformance/ entrypoint,
|
|
# pinned here so a local run matches CI even before the in-cluster Job exists.
|
|
CHAINSAW_VERSION="0.2.12"
|
|
|
|
# Lint / manifest tooling
|
|
YAMLLINT_VERSION="1.35.1"
|
|
KUBECTL_VERSION="1.31.4"
|
|
YQ_VERSION="4.44.6"
|
|
|
|
# ServiceDefinition JSON-Schema validation (schemas/validate.sh). Pip-installed;
|
|
# pinned here so CI and a laptop validate against the exact same validator.
|
|
CHECK_JSONSCHEMA_VERSION="0.29.4"
|