10 Commits

Author	SHA1	Message	Date
Jon Chery	0d2cbdb423	feat(P1): remove gitea/gitlab from synced files + simplify docs (REQ-230,231,232) ... Genericize forge-detection code: gitea→forge/generic_forge, GITEA_ACTOR→FORGE_ACTOR. Drop .gitea byte-identity test assertions (keep GitHub-side + contract conformance). Add test_no_forge_mentions.py guard test (REQ-230). Delete completed migration docs (NOVA_MIGRATION.md, NOVA_AWS_MIGRATION.md). Move NO_HUMANS_THESIS.md to .ciagent/ (internal artifact). Strip ciagent-internal provenance from synced docs (REQ-/D-/P-/CAP- IDs, milestone headers, .ciagent/PROJECT.md citations). Trim README.md (reusable deploy section, local key rotation paragraph). Fix version-tag drift (@v1.13→@v1.19, acdl/→nova/). ---ci--- project: acdl phase: 1 milestone: v1.20 status: execute requirements: [REQ-230, REQ-231, REQ-232] ---/ci---	2026-08-07 18:20:29 +00:00
Jon Chery	d5bae868a4	feat(P2): Nova rebrand — code/env-vars/consumer-path (REQ-158/159/160) ... core/env.py dual-read helper (D-108); 21 ACDL_*→NOVA_* env vars migrated across core/scripts/adapters/tests/workflows + .env/.env.secrets (key rename, values stay). G-106 binding: run_platform.sh:288-289 + regression_verify.py:309-312 dual-read (NOVA first, ACDL fallback). G-108 binding: Gitea NOVA_* secrets created via API + workflow secrets: refs updated (deploy.yml + modules-lifecycle.yml, .gitea + .github). acdl_tagging.py→nova_tagging.py (D-109 warn mode, nova:* enforced). .acdl/→.nova/ consumer path (resolver + deploy workflow + schema + tests + docs). Test fixtures updated; pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 2 milestone: v1.15 status: execute ---/ci---	2026-07-30 01:25:24 +00:00
Jon Chery	41c3377b96	feat(P67b): lifecycle tests default to plan-only; ACDL_LIFECYCLE_MODE flag overrides to full (REQ-134) ... --- ci--- project: acdl phase: 67b milestone: v1.12 status: execute --- /ci--- The modules-lifecycle pipeline now defaults to plan-only (fast, no AWS mutation, no credentials, no cost) so it runs on every PR. A CI variable ACDL_LIFECYCLE_MODE (workflow_dispatch input 'lifecycle_mode', default 'plan') overrides to 'full' for the real apply->modify->destroy against live AWS. Scripts: run_lifecycle_test.sh / run_lifecycle_destroy.sh / run_l2_lifecycle_test.sh / run_l2_lifecycle_destroy.sh read the flag and dispatch to --plan-only (plan mode) or --apply/--destroy (full mode). Destroy is a no-op exit 0 in plan mode (nothing was applied). VPC-output injection is gated on full mode. Workflows: both .github + .gitea (byte-identical) expose lifecycle_mode as a workflow_dispatch input (choice: plan/full), pass it via env: ACDL_LIFECYCLE_MODE to every lifecycle step, skip ci-vpc-apply + ci-vpc-destroy + Read-CI-VPC-outputs in plan mode, and run the lifecycle + l2-lifecycle jobs with if: always() so they execute (plan-only) even when ci-vpc-apply is skipped. Contract + schema: pipelines/modules-lifecycle.yml gains default_mode: plan; the schema accepts default_mode (enum plan|full) and a richer workflow_dispatch inputs shape. Tests: 14 new tests in test_lifecycle_mode_flag.py (script dispatch) + 10 new tests in TestModulesLifecyclePipeline (workflow flag wiring, byte-identity, plan-mode skips). Updated test_platform_vpc_destroy to reflect the plan-mode skip. 516 tests pass; smoke-tested plan mode on the s3 module (--plan-only green, no AWS apply).	2026-07-29 13:16:03 +00:00
Jon Chery	06f4fc7705	fix(P60): free disk space in lifecycle jobs — no space left on device ... 4 of 5 L1 lifecycle failures in run 3013 (rds, uptime, vpc, waf) were caused by "no space left on device" during terraform init (downloading the ~600MB AWS provider). The runner disk fills up from prior jobs' terraform providers. Fix: added a "Free disk space" step at the beginning of each lifecycle job (L1 + L2) that removes unused SDKs (/usr/share/dotnet, /usr/local/ lib/android, /opt/ghc, /usr/local/share/boost) and runs apt-get clean. This frees ~10-15GB on the ubuntu-latest runner. The ALB failure (orphaned target group) was already fixed in commit 4dad967 (name_prefix instead of name). ---ci--- project: acdl phase: P60 milestone: v1.11 status: execute ---/ci---	2026-07-28 20:38:56 +00:00
Jon Chery	361fe600a9	feat(P61): L2 lifecycle pipeline — extend matrix + workflows + tests ... Extend the modules-lifecycle pipeline with L2 composition modules (static-assets, microservice) per REQ-128: - pipelines/modules-lifecycle.yml: added l2-lifecycle-apply/modify/destroy stages + l2_modules matrix entry - .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml: added l2-lifecycle job (byte-identical), matrix over [static-assets, microservice], needs ci-vpc-apply, has apply/modify/destroy steps. ci-vpc-destroy now needs both [lifecycle, l2-lifecycle]. - schemas/modules-lifecycle-pipeline.schema.json: added l2_modules to matrix - scripts/run_l2_lifecycle_test.sh + run_l2_lifecycle_destroy.sh: L2 wrappers that set ACDL_REMOTE_STATE_KEY=spike/ci-vpc/terraform.tfstate so the microservice composition's terraform_remote_state reads from the CI VPC - adapters/terraform/adapter.py: parameterized remote_state key via ACDL_REMOTE_STATE_KEY env var (default: platform/terraform.tfstate) - modules/l2/static-assets/examples/complex.yml: fixed bucket_name to match simple (my-static-site) so terraform modifies in-place (adds CDN + WAF) - modules/l2/microservice/examples/complex.yml: fixed bucket_name to match simple (my-microservice-demo), added desired_count:2 (modify variant) - tests/test_pipeline_contract.py: 7 new L2 tests (l2 job exists, matrix lists both modules, apply/modify/destroy steps, needs ci-vpc-apply, ci-vpc-destroy needs both, contract matrix lists l2_modules) - pipelines/README.md: updated stages for L2 Regression: 485 passed, 5 deselected. Gitea + GitHub workflows byte-identical. ---ci--- project: acdl phase: P61 milestone: v1.11 status: execute ---/ci---	2026-07-28 20:17:27 +00:00
Jon Chery	a55752e2f8	fix(ci): read CI VPC outputs from S3 state instead of artifacts ... upload-artifact@v4 is not supported on Gitea (GHES). Each lifecycle job now runs terraform init + terraform output against the CI VPC stack (state in S3) to read the VPC outputs locally — no artifact passing. Also removed setup-python from ci-vpc-apply (not needed — just terraform). ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 17:59:47 +00:00
Jon Chery	ad3cc5f129	fix(ci): separate short-lived CI VPC + fix 8 module lifecycle failures ... Two architectural changes: 1. Created terraform/ci-vpc/ — a short-lived VPC for L1 module lifecycle testing, separate from the long-lived platform VPC. Created before VPC-dependent modules (alb, ecs-service, rds, uptime) are tested, destroyed after. Outputs (vpc_id, subnet_ids, sg_id, cluster_arn) are passed to those modules via scripts/run_lifecycle_test.sh + run_lifecycle_destroy.sh wrappers that inject the CI VPC outputs into the example contracts. 2. Updated the workflow to use ci-vpc-apply → lifecycle (with artifact passing) → ci-vpc-destroy (always runs). 8 module-specific fixes: - s3: unique bucket names (acdl-ci-s3a-simple/complex) instead of globally-taken 'my-simple-bucket' - kms-key: alias name with no spaces (locals.tf → alias/acdl-ci-kms) - iam-role: example contract uses role_name (not name, which the interface doesn't declare) - ecs-service: example contract uses family (not name); VPC inputs (cluster_arn, subnets, security_group) injected by CI VPC wrapper - uptime: added subnets, security_group, cluster_arn to interface + module; network_configuration is dynamic (only when subnets provided) - rds: added subnet_ids input + db_subnet_group resource (conditional on subnet_ids being non-empty) - alb: removed hardcoded placeholder sg/subnet values from examples; vpc_id + subnets + security_group injected by CI VPC wrapper - cloudfront: removed invalid placeholder WAF ARN from complex example Regression: 479 passed, 0 skipped, 5 deselected. All 24 example contracts pass --check-only. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 17:52:58 +00:00
Jon Chery	8071d6afd1	fix(ci): target only VPC resources in platform-vpc-apply/destroy ... The platform stack includes Lambda, DynamoDB, Secrets Manager, and KMS resources that have pre-existing state issues (a secret scheduled for deletion blocks creation). The lifecycle pipeline only needs the VPC. Use terraform -target to apply/destroy only the VPC-related resources: aws_vpc.acdl_shared, aws_subnet.acdl_shared, aws_internet_gateway, aws_route_table, aws_route_table_association, aws_security_group.ecs. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 17:07:23 +00:00
Jon Chery	315a86d396	fix(ci): replace configure-aws-credentials with direct env vars ... The aws-actions/configure-aws-credentials@v4 action failed on the Gitea runner with 'Credentials could not be loaded' — the action couldn't load the secrets in the Gitea Actions context. Replaced with direct env var exports (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION) on each step that needs AWS access. This is simpler and works reliably with Gitea Actions. Also removed the id-token: write permission (not needed without the configure-aws-credentials action's OIDC flow). ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:31:09 +00:00
Jon Chery	7ba72bf656	feat(P59): L1 module lifecycle pipeline — author workflows + schema + tests ... EXECUTE stage. Authors the modules-lifecycle pipeline that matrix-tests every L1 module's examples/{simple,complex}.yml contracts through apply→modify→destroy against live AWS. No per-module Python. New files: - pipelines/modules-lifecycle.yml: declarative contract (5 stages: platform-vpc-apply, lifecycle-apply, lifecycle-modify, lifecycle-destroy, platform-vpc-destroy). Matrix over 12 L1 modules. - .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml: byte-identical workflows. 3 jobs: platform-vpc-apply (prerequisite), lifecycle (matrix of 12 modules × apply/modify/destroy), platform-vpc-destroy (always runs, cleanup). Triggers: pull_request to main + workflow_dispatch. - schemas/modules-lifecycle-pipeline.schema.json: schema for the new pipeline shape (extends pipeline.schema.json with workflow_dispatch + matrix). Tests (tests/test_pipeline_contract.py): - TestModulesLifecyclePipeline: 12 tests (schema valid, contract validates, byte-identical, workflow name, 3 jobs, triggers, matrix lists all 12 L1 modules, apply/modify/destroy steps present, platform-vpc-destroy always runs). pipelines/README.md: added modules-lifecycle to the pipeline table. Regression: 479 passed, 0 skipped, 5 deselected (slow). ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00