Unblocks the enforced Gitea gate, which correctly BLOCKED this branch on ['R-SEC-01','R-SEC-02','R-TEST-06'] being touched but uncovered. Tests were authored; the coverage rule was NOT narrowed. === THE FALSE GREEN (root cause) === `make -C ci gate` locally reported PASS having checked NOTHING. resolve_base() validated nothing, and EVERY way of failing to find a base degraded silently to an empty touched set + exit 0: an `HEAD~1` last resort, a two-dot diff fallback masking a failing three-dot diff, and no check that HEAD is even AHEAD of the base. Run while sitting on `main` (main == origin/main), `origin/main...HEAD` is empty -> "no changed files vs base" -> the empty set means run.sh is invoked with NO --requirements -> coverage.py's --require gate never runs at all. Green by vacuum. Now: candidates are BASE_REF > GITHUB_BASE_REF > origin/main > main, each verified to resolve. HEAD~1 and the two-dot fallback are gone. Unresolvable base / no merge base / failed diff / HEAD-not-ahead -> loud banner, EMPTY stdout, exit 3, and a machine-readable reason (on-base | no-base | diff-failed). gate.sh turns exit 3 into an UNDECIDED decision: `on-base` -> "NOT APPLICABLE — no branch under gate" (exit 0 so push-to-main runs don't break, but it never reads as PASS); `no-base`/`diff-failed` -> BLOCKED. It also now prints the diff base it used. A stale local main warns (widens, never falsely greens). Also fixed `make -C ci test`, which was SWALLOWING failing suites. Regression: ci/tests/touched-requirements-base.test.sh — 31 assertions over 8 throwaway-repo scenarios including the exact false-green case, an already-merged branch, no base ref, a single-commit repo, bogus BASE_REF, a shallow GITHUB_BASE_REF, and origin/main-preferred-over-stale-main. === NEW L0 STATIC LAYER (conformance/tests/l0-static/) === Where docs/14 actually puts these invariants. Each check.sh really executes offline via `run.sh --layer l0` and is wired into ci/l0.sh, so it runs on every PR. No scaffolds. R-SEC-01 no-plaintext-secrets (165 assertions / 445 tracked files): .sops.yaml holds only PUBLIC age recipients; every committed Secret is SOPS-wrapped with a mac and ENC[...] values; ansible vault.yml files are $ANSIBLE_VAULT; no secret-valued ansible key carries a literal outside a vault; no PEM key / age secret key / kubeconfig client-key-data is tracked; Flux declares sops decryption; the disallow-plaintext-secrets policy Enforces and has a proving `result: fail` row. Exemptions are SELF-POLICING, not path allowlists — a .example must be referenced by no kustomization and hold only placeholders, and the Kyverno fixture is exempt ONLY while a test asserts the policy rejects it. Proven against 7 injected violations, including deleting the negative row and weakening Enforce->Audit. R-SEC-02 least-privilege-rbac (41 assertions): no wildcard apiGroup/resource/verb and no escalate|bind|impersonate in any in-repo Role/ClusterRole; no ServiceAccount bound to cluster-admin or a wildcard role; the conformance runner's own test identity is scoped and holds no rights over RBAC objects; the default-deny/host-namespace/egress-class policies Enforce and each carry a negative row. Proven against 6 injected violations. R-TEST-06 spec-immutability-enforced (16 assertions): drives the REAL ci/spec-immutability.sh against HERMETIC throwaway spec repos and asserts its exit code in every state — clean-at-pin 0, edits under docs/ or decisions/ 1, untracked addition 1, unadopted drift 1, explicit pin bump 0, ABSENT spec repo 3 (honest skip, never green), unpinned SPEC_PIN 1 — plus that gate.sh sets BLOCK=1 on its failure, so the mechanism is load-bearing. The real spec repo is never written to. Each check documents what it does NOT cover (runtime decryption, git history, runtime least-privilege, branch protection) rather than overclaiming. status.py now reads check.sh too, so a placeholder L0 body still outranks an `executable: true` annotation. Coverage 37/51 -> 40/51 (11 gaps); executable tests 32 -> 35; scaffold-only stays 5 — no sixth scaffold was added. Serves: R-SEC-01, R-SEC-02, R-TEST-01..06. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
136 lines
5.1 KiB
Python
136 lines
5.1 KiB
Python
#!/usr/bin/env python3
|
|
"""Run the CLUSTER-INDEPENDENT conformance checks OFFLINE and emit JUnit.
|
|
|
|
docs/14 puts two layers in CI with no cluster:
|
|
* L0 static/policy -- "manifests/ServiceDefinitions obey invariants" (tests/l0-static/,
|
|
each dir carrying a `check.sh`).
|
|
* L1 rendering -- ServiceDefinition -> rendered resources vs golden expectations
|
|
(tests/l1-rendering/, each dir carrying a `render-check.sh`).
|
|
Both are executed here so they report a REAL pass/fail instead of being skipped with the
|
|
cluster-gated layers. run.sh invokes this for `--layer l0`, `--layer l1`, and as the
|
|
offline leg of a full run.
|
|
|
|
Pure standard library (matches the harness's no-pip-dependency posture); the checks
|
|
themselves shell out (render checks to catalog/render.py, whose PyYAML dependency lives
|
|
there; L0 checks to git + PyYAML).
|
|
|
|
Usage: run_l1_offline.py --junit <out.xml> [--label-prefix P] <test-dir> [<test-dir> ...]
|
|
Exit 0 iff every selected offline check passes.
|
|
|
|
The per-dir check script is whichever of `render-check.sh` / `check.sh` the directory
|
|
carries; a dir with neither is reported SKIPPED (never a pass).
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import re
|
|
import subprocess
|
|
import sys
|
|
import xml.etree.ElementTree as ET
|
|
from pathlib import Path
|
|
from xml.dom import minidom
|
|
|
|
LABEL_LINE_RE_TMPL = r"^\s*{prefix}/(R-[A-Z0-9]+-[0-9]+)\s*:\s*[\"']?true"
|
|
|
|
# The offline check script a test dir may carry, in preference order.
|
|
CHECK_SCRIPTS = ("render-check.sh", "check.sh")
|
|
|
|
|
|
def layer_of(d: Path) -> str:
|
|
"""Layer for the JUnit properties, from the subtree the test lives in."""
|
|
rel = str(d)
|
|
if "l0-static" in rel:
|
|
return "L0"
|
|
if "l1-rendering" in rel:
|
|
return "L1"
|
|
return "OFFLINE"
|
|
|
|
|
|
def collect_meta(test_yaml: Path, prefix: str):
|
|
text = test_yaml.read_text() if test_yaml.exists() else ""
|
|
name_m = re.search(r"^\s*name:\s*(\S+)", text, re.M)
|
|
name = name_m.group(1) if name_m else test_yaml.parent.name
|
|
rx = re.compile(LABEL_LINE_RE_TMPL.format(prefix=re.escape(prefix)), re.I)
|
|
reqs = sorted({m.group(1).upper() for m in (rx.match(l) for l in text.splitlines()) if m})
|
|
return name, reqs
|
|
|
|
|
|
def main() -> int:
|
|
ap = argparse.ArgumentParser(description=__doc__)
|
|
ap.add_argument("--junit", type=Path, required=True)
|
|
ap.add_argument("--label-prefix", default="conformance.home.k3s")
|
|
ap.add_argument("dirs", nargs="+", type=Path)
|
|
args = ap.parse_args()
|
|
|
|
cases = [] # (name, reqs, dir, rc, output)
|
|
for d in args.dirs:
|
|
check = next((d / s for s in CHECK_SCRIPTS if (d / s).exists()), None)
|
|
name, reqs = collect_meta(d / "chainsaw-test.yaml", args.label_prefix)
|
|
if check is None:
|
|
cases.append((name, reqs, d, 3,
|
|
f"no offline check script ({' or '.join(CHECK_SCRIPTS)}) in {d}"))
|
|
continue
|
|
proc = subprocess.run(
|
|
["bash", str(check)], capture_output=True, text=True
|
|
)
|
|
out = (proc.stdout + proc.stderr).strip()
|
|
cases.append((name, reqs, d, proc.returncode, out))
|
|
|
|
failures = sum(1 for c in cases if c[3] not in (0, 3))
|
|
skipped = sum(1 for c in cases if c[3] == 3)
|
|
|
|
suite = ET.Element(
|
|
"testsuite",
|
|
{
|
|
"name": "home-k3s-conformance L0/L1 (offline)",
|
|
"tests": str(len(cases)),
|
|
"failures": str(failures),
|
|
"errors": "0",
|
|
"skipped": str(skipped),
|
|
},
|
|
)
|
|
for name, reqs, d, rc, out in cases:
|
|
tc = ET.SubElement(
|
|
suite,
|
|
"testcase",
|
|
{"classname": f"{layer_of(d)}:{','.join(reqs) if reqs else 'UNTAGGED'}",
|
|
"name": name},
|
|
)
|
|
props = ET.SubElement(tc, "properties")
|
|
ET.SubElement(props, "property", {"name": "requirements", "value": ",".join(reqs)})
|
|
ET.SubElement(props, "property", {"name": "layer", "value": layer_of(d)})
|
|
ET.SubElement(props, "property", {"name": "path", "value": str(d)})
|
|
if rc == 3:
|
|
ET.SubElement(tc, "skipped", {"message": out or "no offline check script"})
|
|
elif rc != 0:
|
|
fail = ET.SubElement(tc, "failure", {"message": f"offline check exit {rc}"})
|
|
fail.text = out
|
|
status = "PASS" if rc == 0 else ("SKIP" if rc == 3 else "FAIL")
|
|
print(f"[offline] {layer_of(d):3s} {status:4s} {name} "
|
|
f"({','.join(reqs) or 'untagged'})",
|
|
file=sys.stderr)
|
|
if rc not in (0, 3):
|
|
print(out, file=sys.stderr)
|
|
|
|
root = ET.Element(
|
|
"testsuites",
|
|
{
|
|
"name": "home-k3s-conformance",
|
|
"tests": str(len(cases)),
|
|
"failures": str(failures),
|
|
"errors": "0",
|
|
"skipped": str(skipped),
|
|
},
|
|
)
|
|
root.append(suite)
|
|
args.junit.parent.mkdir(parents=True, exist_ok=True)
|
|
xml = minidom.parseString(ET.tostring(root, "utf-8")).toprettyxml(indent=" ")
|
|
args.junit.write_text(xml)
|
|
print(f"[offline] wrote JUnit ({len(cases)} case(s), {failures} failure(s)) -> "
|
|
f"{args.junit}", file=sys.stderr)
|
|
return 1 if failures else 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|