Jon Chery
d7995717c2
EXECUTE stage. Authors the modules-lifecycle pipeline that matrix-tests
every L1 module's examples/{simple,complex}.yml contracts through
apply→modify→destroy against live AWS. No per-module Python.
New files:
- pipelines/modules-lifecycle.yml: declarative contract (5 stages:
platform-vpc-apply, lifecycle-apply, lifecycle-modify, lifecycle-destroy,
platform-vpc-destroy). Matrix over 12 L1 modules.
- .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml:
byte-identical workflows. 3 jobs: platform-vpc-apply (prerequisite),
lifecycle (matrix of 12 modules × apply/modify/destroy), platform-vpc-destroy
(always runs, cleanup). Triggers: pull_request to main + workflow_dispatch.
- schemas/modules-lifecycle-pipeline.schema.json: schema for the new pipeline
shape (extends pipeline.schema.json with workflow_dispatch + matrix).
Tests (tests/test_pipeline_contract.py):
- TestModulesLifecyclePipeline: 12 tests (schema valid, contract validates,
byte-identical, workflow name, 3 jobs, triggers, matrix lists all 12 L1
modules, apply/modify/destroy steps present, platform-vpc-destroy always runs).
pipelines/README.md: added modules-lifecycle to the pipeline table.
Regression: 479 passed, 0 skipped, 5 deselected (slow).
---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---
110 lines
4.6 KiB
YAML
110 lines
4.6 KiB
YAML
# ACDL Modules Lifecycle Pipeline — Gitea Actions (dev environment)
|
|
#
|
|
# Matrix-runs each L1 module's examples/{simple,complex}.yml contracts through
|
|
# apply→modify→destroy against live AWS. No per-module Python. The "test" =
|
|
# the pipeline cell going green.
|
|
#
|
|
# This workflow implements pipelines/modules-lifecycle.yml (byte-identical
|
|
# in .gitea/workflows/ and .github/workflows/).
|
|
#
|
|
# VPC-dependent L1s (alb, ecs-service, rds, uptime) reference the platform VPC
|
|
# applied by a prerequisite job. Non-VPC L1s run independent.
|
|
name: acdl-modules-lifecycle
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main]
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
id-token: write
|
|
contents: read
|
|
|
|
jobs:
|
|
# Prerequisite: apply the shared platform VPC (needed by VPC-dependent L1s)
|
|
platform-vpc-apply:
|
|
name: Platform VPC apply
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Install Terraform 1.9.*
|
|
run: |
|
|
wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
|
|
echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
|
|
sudo apt-get update && sudo apt-get install -y terraform=1.9.*
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@v4
|
|
with:
|
|
aws-region: us-east-1
|
|
access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
|
|
secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
|
|
- name: Apply platform VPC
|
|
working-directory: terraform/platform
|
|
run: |
|
|
terraform init -input=false -lock=false
|
|
terraform apply -auto-approve -lock=false
|
|
|
|
# L1 lifecycle matrix: apply simple → apply complex (modify) → destroy
|
|
lifecycle:
|
|
name: L1 lifecycle (${{ matrix.module }})
|
|
needs: platform-vpc-apply
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
module: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc, alb, ecs-service, rds, uptime]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Install dependencies
|
|
run: pip install jsonschema pyyaml boto3
|
|
- name: Install Terraform 1.9.*
|
|
run: |
|
|
wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
|
|
echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
|
|
sudo apt-get update && sudo apt-get install -y terraform=1.9.*
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@v4
|
|
with:
|
|
aws-region: us-east-1
|
|
access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
|
|
secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
|
|
- name: Apply (simple)
|
|
run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/simple.yml"
|
|
- name: Modify (complex)
|
|
run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/complex.yml"
|
|
- name: Destroy
|
|
run: bash scripts/run_platform.sh --destroy "modules/l1/${{ matrix.module }}/examples/complex.yml"
|
|
|
|
# Cleanup: destroy the platform VPC (always runs, even if lifecycle fails)
|
|
platform-vpc-destroy:
|
|
name: Platform VPC destroy
|
|
needs: lifecycle
|
|
runs-on: ubuntu-latest
|
|
if: always()
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-python@v5
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Install Terraform 1.9.*
|
|
run: |
|
|
wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
|
|
echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
|
|
sudo apt-get update && sudo apt-get install -y terraform=1.9.*
|
|
- name: Configure AWS credentials
|
|
uses: aws-actions/configure-aws-credentials@v4
|
|
with:
|
|
aws-region: us-east-1
|
|
access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
|
|
secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
|
|
- name: Destroy platform VPC
|
|
working-directory: terraform/platform
|
|
run: |
|
|
terraform init -input=false -lock=false
|
|
terraform destroy -auto-approve -lock=false |