Repository navigation
🐛 fix(gateway): 302-redirect Exact /login to / on portal.lab clou… #242
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # kaddy design/implementation gate — replaces the removed PocketIDP ci.yaml. | |
| # Runs the Taskfile gate matrix that needs no cluster: gitleaks secret scan | |
| # (SEC-1), verify (scrub + lint + openspec structure + spec coverage), L0 tofu | |
| # test, L1 conftest policy, E1e offline meta gates (TEST-2), and E8 L4 | |
| # offline scorecard (fixture mode). L2 chainsaw and L1 promtool live in | |
| # chainsaw.yaml / monitoring.yaml. | |
| name: verify | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| verify: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # fetch-depth: 0 + fetch-tags: true are LOAD-BEARING for | |
| # tests/meta/release-provenance.yaml (run via `task verify` → | |
| # `test:meta:ci`): it DAG-checks ROADMAP "epic landed after/in v<X.Y.Z>" | |
| # claims with `git merge-base --is-ancestor`. A shallow clone (default | |
| # fetch-depth: 1) or a tagless checkout makes that guard skip — inert | |
| # exactly where it must have teeth. Enforced by | |
| # tests/meta/verify-fetch-depth.yaml so it cannot silently regress. | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| # SEC-1: secret scan in CI (not just bypassable pre-commit). Pinned to the | |
| # same gitleaks version as .pre-commit-config.yaml, using the repo config. | |
| - name: Install gitleaks | |
| run: | | |
| GITLEAKS_VERSION="8.30.1" | |
| curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \ | |
| | sudo tar -xz -C /usr/local/bin gitleaks | |
| - name: gitleaks (secret scan) | |
| run: gitleaks dir . --config .github/gitleaks.toml --no-banner --redact | |
| - name: Install Task | |
| uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2.0.0 | |
| with: | |
| version: 3.x | |
| repo-token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install OpenTofu | |
| uses: opentofu/setup-opentofu@9d84900f3238fab8cd84ce47d658d25dd008be2f # v1.0.8 | |
| - name: Install conftest | |
| run: | | |
| CONFTEST_VERSION="0.56.0" | |
| curl -sSL "https://github.com/open-policy-agent/conftest/releases/download/v${CONFTEST_VERSION}/conftest_${CONFTEST_VERSION}_Linux_x86_64.tar.gz" \ | |
| | sudo tar -xz -C /usr/local/bin conftest | |
| # terramate powers the E1g codegen-drift check in tests/smoke/e1g-offline.sh. | |
| # Without it that sub-check skips, so a stale-but-valid `_terramate_generated_*.tf` | |
| # (e.g. a globals label edit not regenerated) would pass CI. Pin it (SEC-4: | |
| # Renovate-trackable version) so drift is enforced, not silently no-op'd. | |
| - name: Install terramate | |
| run: | | |
| TERRAMATE_VERSION="0.17.1" | |
| curl -sSL "https://github.com/terramate-io/terramate/releases/download/v${TERRAMATE_VERSION}/terramate_${TERRAMATE_VERSION}_linux_x86_64.tar.gz" \ | |
| | sudo tar -xz -C /usr/local/bin terramate | |
| # ripgrep (rg) is required by the E1e offline meta gates (tests/meta/*.sh), | |
| # including the SEC security gate. The runner has no rg by default, so pin | |
| # it here (SEC-4: Renovate-trackable version, not apt's floating package). | |
| - name: Install ripgrep | |
| run: | | |
| RIPGREP_VERSION="14.1.1" | |
| curl -sSL "https://github.com/BurntSushi/ripgrep/releases/download/${RIPGREP_VERSION}/ripgrep-${RIPGREP_VERSION}-x86_64-unknown-linux-musl.tar.gz" \ | |
| | sudo tar -xz -C /usr/local/bin --strip-components=1 --wildcards '*/rg' | |
| - name: task verify (scrub + lint + openspec + spec coverage) | |
| run: task verify | |
| # DOC-13: enforce markdownlint in CI over the SHIPPABLE doc surface only. | |
| # `task verify`/`task lint` graceful-skip when the tool is absent (local | |
| # ergonomics), so this dedicated step is the REAL gate. ubuntu-latest ships | |
| # Node, so `npx` needs no setup-node step. Version PINNED (SEC-4: Renovate- | |
| # trackable, like gitleaks/conftest/terramate/kyverno) — mirror the pin in | |
| # Taskfile.yml MARKDOWNLINT_VERSION. Globs are positional and MUST stay | |
| # byte-identical to Taskfile.yml MARKDOWNLINT_GLOBS (config-file globs are | |
| # ignored when the config is passed via --config). Excluded by omission: | |
| # .claude/, references/, agent-context/, slides/ (machine/scratch/vendored). | |
| - name: markdownlint (DOC-13 — shippable docs gate) | |
| run: >- | |
| npx -y markdownlint-cli2@0.23.1 --config hack/tooling/.markdownlint-cli2.yaml | |
| "docs/**/*.md" "openspec/**/*.md" "modules/**/*.md" "evidence/**/*.md" | |
| "operator/**/*.md" "deploy/**/*.md" "tests/**/*.md" "skills/**/*.md" "*.md" | |
| - name: task test:unit (L0 tofu test — modules/labels) | |
| run: task test:unit | |
| - name: task test:policy (L1 conftest — ADR-0301 labels) | |
| run: task test:policy | |
| # E1c offline subset: kyverno CLI tests prove the ClusterPolicies pass/deny | |
| # before any cluster enforces them. Pinned to the same version the cluster | |
| # lane will install (SEC-4). | |
| - name: Install kyverno CLI | |
| run: | | |
| KYVERNO_VERSION="v1.18.2" | |
| curl -sSL "https://github.com/kyverno/kyverno/releases/download/${KYVERNO_VERSION}/kyverno-cli_${KYVERNO_VERSION}_linux_x86_64.tar.gz" \ | |
| | sudo tar -xz -C /usr/local/bin kyverno | |
| - name: task test:kyverno (L1 kyverno CLI — e1c ClusterPolicies) | |
| run: task test:kyverno | |
| # TEST-2: E1e offline meta gates (kind config + secure install) run in a | |
| # workflow so an E1e regression goes red in CI. No cluster required. | |
| - name: task test:meta:e1e (E1e offline meta gates) | |
| run: task test:meta:e1e | |
| # REQ-E1c-S03-01: first-party deploy image digest/:latest gate. Also under | |
| # `task verify` locally; explicit CI step so the matrix cannot skip it. | |
| - name: task test:image-digests (E1c first-party :latest gate) | |
| run: task test:image-digests | |
| # E8 L4: offline scorecard (fixture mode default) — capture + validate | |
| # without a live cluster. Meta smoke: tests/meta/e8-scorecard-ci-wired.yaml | |
| - name: task test:scorecard (E8 L4 offline scorecard) | |
| run: task test:scorecard | |
| # TEST-1 (ADVISORY, NOT blocking — operator: "having a gate is difficult at | |
| # this point"): STRICT_TEST_FILES=1 additionally requires every spec `Test:` | |
| # artifact path to exist on disk. continue-on-error keeps this job | |
| # informational — it reports red in the checks list but never blocks a merge. | |
| # Do NOT make this a required check until the Test: artifacts stabilize; | |
| # epic EXITs still run it blocking locally (task test:spec). | |
| # Meta guard: tests/meta/ws3-test1-strict-advisory.yaml | |
| spec-coverage-strict: | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| - name: STRICT_TEST_FILES=1 spec coverage (advisory, non-blocking) | |
| run: STRICT_TEST_FILES=1 bash hack/verify-spec-coverage.sh |