jakman85andClaude Opus 4.8
bc4519bc4c
STEP 1 — enable Gitea Actions: pin GITEA__actions__ENABLED=true and DEFAULT_ACTIONS_URL=github in the gitea bootstrap patch (was implicit upstream default; make it a declared property). STEP 2 — deploy + register an act_runner in a dedicated non-app namespace (gitea-actions) so the privileged DinD executor sidecar is admitted without a Kyverno policy exception (restrict-host-namespaces scopes to app namespaces only). Docker executor + DinD sidecar over a shared TLS-cert emptyDir; runner state on a Longhorn PVC (registers once). Registration token delivered as a SOPS-encrypted Secret decrypted by Flux. Runner mounts no ServiceAccount token (R-SEC-02). STEP 3 — author .gitea/workflows/gate.yml: the live enforced merge gate running the STATIC layers (spec-immutability best-effort, lint, Kyverno L0, L1 render) via `make -C ci lint l0 l1` with the pinned toolchain installed at job start. L2/L3 conformance is an if:false placeholder (needs a toolchain image + scoped cluster creds — a design decision, not wired). merge-gate.yaml reduced to workflow_dispatch (dormant full-pipeline blueprint). install-tools.sh gains check-jsonschema so the schema stage validates in CI instead of skipping. Co-Authored-By: Claude Opus 4.8 <[email protected]>
56 lines
2.4 KiB
Bash
Executable File
56 lines
2.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# .gitea/workflows/scripts/install-tools.sh — install the PINNED tools a given
|
|
# gate stage needs on a Gitea Actions runner. Versions come from ci/versions.env
|
|
# (single source of truth, R-TEST-02). Usage: install-tools.sh <lint|l0|l1|conformance>
|
|
set -euo pipefail
|
|
HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "${HERE}/../../.." && pwd)"
|
|
# shellcheck disable=SC1091
|
|
source "${REPO_ROOT}/ci/versions.env"
|
|
|
|
stage="${1:-all}"
|
|
os="$(uname -s | tr '[:upper:]' '[:lower:]')"
|
|
arch="$(uname -m)"; case "$arch" in x86_64) arch=amd64 ;; aarch64|arm64) arch=arm64 ;; esac
|
|
bindir="${HOME}/.local/bin"; mkdir -p "$bindir"
|
|
echo "${bindir}" >> "${GITHUB_PATH:-/dev/null}" 2>/dev/null || true
|
|
export PATH="${bindir}:${PATH}"
|
|
|
|
log() { printf '[install] %s\n' "$*" >&2; }
|
|
|
|
install_yamllint() { have yamllint || { log "yamllint ${YAMLLINT_VERSION}"; pip install --quiet "yamllint==${YAMLLINT_VERSION}"; }; }
|
|
|
|
install_check_jsonschema() { have check-jsonschema || { log "check-jsonschema ${CHECK_JSONSCHEMA_VERSION}"; pip install --quiet "check-jsonschema==${CHECK_JSONSCHEMA_VERSION}"; }; }
|
|
|
|
install_kyverno() {
|
|
have kyverno && return 0
|
|
log "kyverno CLI ${KYVERNO_VERSION}"
|
|
local url="https://github.com/kyverno/kyverno/releases/download/v${KYVERNO_VERSION}/kyverno-cli_v${KYVERNO_VERSION}_${os}_${arch}.tar.gz"
|
|
curl -fsSL "$url" | tar -xz -C "$bindir" kyverno
|
|
}
|
|
|
|
install_chainsaw() {
|
|
have chainsaw && return 0
|
|
log "chainsaw ${CHAINSAW_VERSION}"
|
|
local url="https://github.com/kyverno/chainsaw/releases/download/v${CHAINSAW_VERSION}/chainsaw_${os}_${arch}.tar.gz"
|
|
curl -fsSL "$url" | tar -xz -C "$bindir" chainsaw
|
|
}
|
|
|
|
install_kubectl() {
|
|
have kubectl && return 0
|
|
log "kubectl ${KUBECTL_VERSION}"
|
|
curl -fsSL -o "${bindir}/kubectl" "https://dl.k8s.io/release/v${KUBECTL_VERSION}/bin/${os}/${arch}/kubectl"
|
|
chmod +x "${bindir}/kubectl"
|
|
}
|
|
|
|
have() { command -v "$1" >/dev/null 2>&1; }
|
|
|
|
case "$stage" in
|
|
lint) install_yamllint ;;
|
|
l0) install_yamllint; install_check_jsonschema; install_kyverno ;; # schema (check-jsonschema) + Kyverno L0
|
|
l1) install_chainsaw ;; # L1 render via conformance runner (Chainsaw)
|
|
conformance) install_chainsaw; install_kubectl ;; # trigger the in-cluster Job
|
|
all) install_yamllint; install_check_jsonschema; install_kyverno; install_chainsaw; install_kubectl ;;
|
|
*) echo "unknown stage: $stage" >&2; exit 2 ;;
|
|
esac
|
|
log "stage '${stage}' tools ready"
|