Jon Chery
1fd37a2843
Phase 23 (v1.7) — tagging standards and security adapters.
* schemas/tagging-standard.json (D-054): canonical required-tags schema
(acdl:owner, acdl:contract, acdl:environment, acdl:cost-center).
* adapters/terraform/policy/custom_rules/acdl_tagging.py: Checkov custom
rule (ACDL_TAG_NAMING) loaded via --external-checks-dir; closes D-043
(synthetic SKIPPED record replaced by real PASS/FAIL records).
* checkov_adapter.py: removed _emit_tag_naming_skipped(), added
ACDL_TAG_NAMING to RULE_MAP, updated docstring.
* scripts/run_platform.sh: both Checkov invocations pass
--external-checks-dir adapters/terraform/policy/custom_rules/.
* adapters/wiz/ (D-052): Wiz adapter translating issue records to
PolicyCheckResult (engine: "wiz"); graceful degradation emits
WIZ_NOT_CONFIGURED SKIPPED when unconfigured; is_configured() gate.
* adapters/kyverno/ (D-053): Kyverno adapter translating PolicyReport
results to PolicyCheckResult (engine: "kyverno"); ready but inactive
for Terraform-only stacks; 3 sample ClusterPolicies in policies/.
* schemas/policy_check_result.schema.json: engine enum += "wiz".
* tests: fixtures + test_wiz_adapter.py (8 tests) + test_kyverno_adapter.py
(13 tests); updated test_checkov_adapter.py to not expect the removed
synthetic ACDL_TAG_NAMING SKIPPED record.
* scripts/run_ci.sh: lint stage compiles the new adapter modules.
202 tests pass; CI pipeline OK (lint + test + check-only).
Deviations:
- Wiz adapt() had an AttributeError on bare-list top-level input
(data.get() on a list); fixed to dispatch on isinstance(data, list)
before calling .get(). No spec change — bare-list handling is implied
by the original docstring's "data if isinstance(data, list)" branch.
- Kyverno _to_pcr({}) defaults result to "skipped" (entry.get("result",
"skip") -> "skip"), not "error"; test expectation corrected. Added an
explicit unknown-result-string test to cover the "error" fallback.
---ci---
project: acdl
phase: 23
milestone: v1.7
status: execute
---/ci---
68 lines
2.0 KiB
Bash
Executable File
68 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# scripts/run_ci.sh - reproduce the CI pipeline locally.
|
|
#
|
|
# Mirrors the central pipeline contract (pipelines/ci.yaml) which both
|
|
# .gitea/workflows/ci.yml (Gitea Actions, dev) and
|
|
# .github/workflows/ci.yml (GitHub Actions, production) implement.
|
|
#
|
|
# Runs the same three stages in the same order:
|
|
# 1. lint — py_compile all Python files
|
|
# 2. test — pytest test suite (offline)
|
|
# 3. check-only — run_platform.sh --check-only (offline, no AWS)
|
|
#
|
|
# Fails on the first stage that errors. Exits 0 with "CI PIPELINE OK"
|
|
# when all stages pass.
|
|
#
|
|
# Usage:
|
|
# bash scripts/run_ci.sh # run all stages
|
|
# bash scripts/run_ci.sh --quiet # suppress per-stage banners
|
|
set -euo pipefail
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
cd "$ROOT"
|
|
|
|
QUIET=0
|
|
for arg in "$@"; do
|
|
case "$arg" in
|
|
--quiet) QUIET=1 ;;
|
|
*) echo "FAIL: unknown argument: $arg" >&2; exit 1 ;;
|
|
esac
|
|
done
|
|
|
|
banner() {
|
|
[ "$QUIET" = "1" ] || echo ""
|
|
echo "── $1 ──"
|
|
[ "$QUIET" = "1" ] || echo ""
|
|
}
|
|
|
|
fail() { echo "FAIL: $*" >&2; exit 1; }
|
|
|
|
echo "=== ACDL CI Pipeline (local reproduction) ==="
|
|
echo "contract: pipelines/ci.yaml (3 stages)"
|
|
echo ""
|
|
|
|
banner "Stage 1/3: lint (py_compile)"
|
|
python3 -m py_compile \
|
|
core/confidence_signal.py \
|
|
core/outbox_writer.py \
|
|
core/contract_resolver.py \
|
|
adapters/terraform/adapter.py \
|
|
adapters/terraform/policy/checkov_adapter.py \
|
|
adapters/terraform/policy/custom_rules/acdl_tagging.py \
|
|
adapters/wiz/wiz_adapter.py \
|
|
adapters/kyverno/kyverno_adapter.py \
|
|
scripts/push_consumer_image.py \
|
|
|| fail "lint: py_compile failed"
|
|
echo "lint: OK"
|
|
|
|
banner "Stage 2/3: test (pytest)"
|
|
python3 -m pytest tests/ -v --tb=short || fail "test: pytest failed"
|
|
echo "test: OK"
|
|
|
|
banner "Stage 3/3: check-only (run_platform.sh --check-only)"
|
|
bash scripts/run_platform.sh --check-only || fail "check-only: run_platform.sh failed"
|
|
echo "check-only: OK"
|
|
|
|
echo ""
|
|
echo "=== CI PIPELINE OK ==="
|
|
echo "3 stages passed: lint, test, check-only"
|
|
exit 0 |