---ci---
project: acdl
phase: 19
milestone: v1.4
status: execute
---
Add declarative pipeline contract (schemas/pipeline.schema.json +
pipelines/ci.yaml) as single source of truth for both Gitea Actions (dev)
and GitHub Actions (production) workflows. Both workflow files are
byte-identical and validated against the contract by 32 new tests.
Add scripts/run_ci.sh for shell reproducibility — mirrors the CI pipeline
locally (lint → test → check-only), exits 0 with 'CI PIPELINE OK'.
Update scripts/run_platform.sh to stream output by default: terraform
init/validate/plan via tee, Checkov compliance results with per-record
severity/rule/pass-fail, and emitted Terraform in --check-only. New
--quiet flag for log-only mode.
Requirements: REQ-43 (central pipeline contract), REQ-44 (shell
reproducibility), REQ-45 (output streaming). 122 tests pass (90 + 32).
---ci---
phase: 1
milestone: v1.0
status: clarify
decisions:
- id: D-011
decision: Single-project mode explicitly enforced via config.json mode=single
rationale: run.md Step 0 reads projects[] length as multi-project trigger; explicit flag disambiguates from D-010
confidence: 0.95
alternatives: [move acdl into .ciagent/acdl/ subdirectory and adopt multi-project paths]
- id: D-012
decision: Gitea has no native Pages; serve acdl-evidence via raw file URLs + CORS note
rationale: Research confirms Gitea has no [pages] section; raw URLs work without server config
confidence: 0.85
alternatives: [sidecar static server, external Pages host]
- id: D-013
decision: QA/Prod gates modeled as workflow_dispatch approval inputs (D-004 fallback) instead of Gitea environments
rationale: Research confirms Gitea ignores environment: blocks and exposes no environments API
confidence: 0.90
alternatives: [external approval bot, drop approval gates entirely]
- id: D-014
decision: Cross-repo triggering uses workflow_dispatch API from inside a step (no repository_dispatch)
rationale: Gitea Actions does not support repository_dispatch
confidence: 0.85
alternatives: [push-based trigger with a sentinel file, polling]
- id: D-015
decision: New repos acdl-contracts and acdl-evidence use default_branch=main with auto_init=true
rationale: Matches Gitea DEFAULT_BRANCH=main; required for the default branch to exist before any push
confidence: 0.95
alternatives: [use milestone/v1.0-initial as default_branch]
- id: D-016
decision: Pages placeholder for Phase 01 is a minimal HTML stub; full timeline UI deferred to Phase 05
rationale: Phase 01 success criterion is the URL returns 200 with placeholder; full UI is Phase 05
confidence: 0.90
alternatives: [build a minimal timeline now]
---/ci---
Clarifications accepted at full autonomy per clarify.md Step 4. Three requirements
re-stated: REQ-09 (new repos default_branch=main), REQ-10 Pages (raw-URL 200
substitute), REQ-10 environments (workflow_dispatch inputs + qa/prod branches).
See .ciagent/REQUIREMENTS.md Clarifications table.
---ci---
phase: 0
milestone: v1.0
status: specify
security:
- id: SEC-001
type: info_disclosure
disposition: mitigated
summary: Literal API token was committed in config.json gitea.api_token_env field
fix: Replaced literal with env var name 'ACDL_GITEA_TOKEN'; token supplied via shell env at runtime
severity: high
stride: Information Disclosure
---/ci---
The 40-char value previously stored in .ciagent/config.json was a live Gitea
API token. Per the spec constraint 'no secrets in repo', the field now holds
an env var name. The token itself is exported in the shell session at runtime
and is never written to disk. Treat the prior value as already-leaked and
rotate it via the Gitea UI before any external disclosure.
Jon Chery