continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

feat(P67b): lifecycle tests default to plan-only; ACDL_LIFECYCLE_MODE flag overrides to full (REQ-134)

Browse Source 
---
ci---
project: acdl
phase: 67b
milestone: v1.12
status: execute
---
/ci---

The modules-lifecycle pipeline now defaults to plan-only (fast, no AWS
mutation, no credentials, no cost) so it runs on every PR. A CI variable
ACDL_LIFECYCLE_MODE (workflow_dispatch input 'lifecycle_mode', default
'plan') overrides to 'full' for the real apply->modify->destroy against
live AWS.

Scripts: run_lifecycle_test.sh / run_lifecycle_destroy.sh /
run_l2_lifecycle_test.sh / run_l2_lifecycle_destroy.sh read the flag and
dispatch to --plan-only (plan mode) or --apply/--destroy (full mode).
Destroy is a no-op exit 0 in plan mode (nothing was applied). VPC-output
injection is gated on full mode.

Workflows: both .github + .gitea (byte-identical) expose lifecycle_mode
as a workflow_dispatch input (choice: plan/full), pass it via env:
ACDL_LIFECYCLE_MODE to every lifecycle step, skip ci-vpc-apply +
ci-vpc-destroy + Read-CI-VPC-outputs in plan mode, and run the lifecycle
+ l2-lifecycle jobs with if: always() so they execute (plan-only) even
when ci-vpc-apply is skipped.

Contract + schema: pipelines/modules-lifecycle.yml gains default_mode:
plan; the schema accepts default_mode (enum plan|full) and a richer
workflow_dispatch inputs shape.

Tests: 14 new tests in test_lifecycle_mode_flag.py (script dispatch) +
10 new tests in TestModulesLifecyclePipeline (workflow flag wiring,
byte-identity, plan-mode skips). Updated test_platform_vpc_destroy to
reflect the plan-mode skip. 516 tests pass; smoke-tested plan mode on
the s3 module (--plan-only green, no AWS apply).
This commit is contained in:
Jon Chery
2026-07-29 13:16:03 +00:00
parent 76364c33c2
commit 41c3377b96
11 changed files with 347 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/run_lifecycle_test.sh
+18 -3
View File
@@ -9,6 +9,13 @@
#
# The CI VPC is short-lived (created/destroyed by the pipeline), separate
# from the long-lived platform VPC.
#
# Lifecycle mode (REQ-134): the ACDL_LIFECYCLE_MODE env var selects the
# tier. Default "plan" runs `run_platform.sh --plan-only` (fast, no AWS
# mutation, validates the contract->resolver->adapter->plan chain for
# every module). Set to "full" to run the real `--apply` (terraform apply
# against live AWS). The CI variable is passed via the workflow input
# `lifecycle_mode`.
set -euo pipefail
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT"
@@ -17,13 +24,17 @@ MODULE="$1"
EXAMPLE="$2" # simple or complex
CI_VPC_OUTPUTS="${3:-}"
# Lifecycle mode: "plan" (default, fast) or "full" (real apply against AWS).
LIFECYCLE_MODE="${ACDL_LIFECYCLE_MODE:-plan}"
CONTRACT="modules/l1/${MODULE}/examples/${EXAMPLE}.yml"
# VPC-dependent modules that need CI VPC outputs injected
VPC_DEPENDENT="alb ecs-service rds uptime"
# If the module is VPC-dependent and we have CI VPC outputs, inject them
if echo "$VPC_DEPENDENT" | grep -qw "$MODULE" && [ -n "$CI_VPC_OUTPUTS" ] && [ -f "$CI_VPC_OUTPUTS" ]; then
# (only meaningful in full mode; plan mode ignores VPC outputs)
if [ "$LIFECYCLE_MODE" = "full" ] && echo "$VPC_DEPENDENT" | grep -qw "$MODULE" && [ -n "$CI_VPC_OUTPUTS" ] && [ -f "$CI_VPC_OUTPUTS" ]; then
# Generate a temporary contract with CI VPC outputs injected
TMP_CONTRACT="/tmp/acdl-lifecycle-${MODULE}-${EXAMPLE}.yml"
python3 -c "
@@ -70,5 +81,9 @@ print('$TMP_CONTRACT')
CONTRACT="$TMP_CONTRACT"
fi
# Run the platform lifecycle command
bash scripts/run_platform.sh --apply "$CONTRACT"
# Run the platform lifecycle command (plan-only by default; full = apply).
if [ "$LIFECYCLE_MODE" = "full" ]; then
bash scripts/run_platform.sh --apply "$CONTRACT"
else
bash scripts/run_platform.sh --plan-only "$CONTRACT"
fi