Jon Chery
0d2cbdb423
Genericize forge-detection code: gitea→forge/generic_forge, GITEA_ACTOR→FORGE_ACTOR. Drop .gitea byte-identity test assertions (keep GitHub-side + contract conformance). Add test_no_forge_mentions.py guard test (REQ-230). Delete completed migration docs (NOVA_MIGRATION.md, NOVA_AWS_MIGRATION.md). Move NO_HUMANS_THESIS.md to .ciagent/ (internal artifact). Strip ciagent-internal provenance from synced docs (REQ-/D-/P-/CAP- IDs, milestone headers, .ciagent/PROJECT.md citations). Trim README.md (reusable deploy section, local key rotation paragraph). Fix version-tag drift (@v1.13→@v1.19, acdl/→nova/). ---ci--- project: acdl phase: 1 milestone: v1.20 status: execute requirements: [REQ-230, REQ-231, REQ-232] ---/ci---
88 lines
3.7 KiB
YAML
88 lines
3.7 KiB
YAML
name: acdl-modules-lifecycle
|
|
|
|
# Nova Modules Lifecycle Pipeline — apply→modify→destroy against live AWS.
|
|
#
|
|
# Matrix-runs each L1 module's examples/{simple,complex}.yml contracts:
|
|
# 1. --apply simple.yml (terraform apply — creates resources)
|
|
# 2. --apply complex.yml (same state key — terraform modifies)
|
|
# 3. --destroy complex.yml (terraform destroy — cleans up)
|
|
#
|
|
# No per-module Python. The "test" = the pipeline cell going green.
|
|
# VPC-dependent L1s (alb, ecs-service, rds, uptime) reference the platform
|
|
# VPC applied by a prerequisite job. Non-VPC L1s run independent.
|
|
#
|
|
# Lifecycle mode (REQ-134, v1.12): `default_mode: plan` — the lifecycle
|
|
# scripts run `run_platform.sh --plan-only` (fast, no AWS mutation, no
|
|
# AWS credentials, no cost) on every PR. Set the NOVA_LIFECYCLE_MODE CI
|
|
# variable (workflow_dispatch input `lifecycle_mode`) to `full` for the
|
|
# real apply→modify→destroy against live AWS. The CI VPC apply/destroy
|
|
# jobs are skipped in plan mode (nothing is applied).
|
|
#
|
|
# GitHub
|
|
# (.github/workflows/modules-lifecycle.yml) implements this contract
|
|
# byte-identically.
|
|
|
|
triggers:
|
|
pull_request: [main]
|
|
workflow_dispatch:
|
|
inputs:
|
|
- name: lifecycle_mode
|
|
description: "Lifecycle mode: 'plan' (default, fast) or 'full' (real apply→destroy)"
|
|
default: plan
|
|
|
|
runner: ubuntu-latest
|
|
python_version: "3.12"
|
|
terraform_version: "1.9.*"
|
|
|
|
# Default lifecycle mode: "plan" (plan-only, fast, no AWS mutation) or "full"
|
|
# (real apply→modify→destroy against live AWS). Overridable via the
|
|
# NOVA_LIFECYCLE_MODE CI variable / workflow_dispatch input.
|
|
default_mode: plan
|
|
|
|
stages:
|
|
- name: platform-vpc-apply
|
|
command: cd terraform/platform && terraform init -input=false && terraform apply -auto-approve -lock=false
|
|
required: true
|
|
description: "Apply the shared platform VPC (prerequisite for VPC-dependent L1s)"
|
|
|
|
- name: lifecycle-apply
|
|
command: bash scripts/run_platform.sh --apply "modules/l1/${MODULE}/examples/simple.yml"
|
|
required: true
|
|
description: "Apply the module's simple example contract (terraform apply)"
|
|
|
|
- name: lifecycle-modify
|
|
command: bash scripts/run_platform.sh --apply "modules/l1/${MODULE}/examples/complex.yml"
|
|
required: true
|
|
description: "Apply the module's complex example (same state key — terraform modifies)"
|
|
|
|
- name: lifecycle-destroy
|
|
command: bash scripts/run_platform.sh --destroy "modules/l1/${MODULE}/examples/complex.yml"
|
|
required: true
|
|
description: "Destroy the module's resources (terraform destroy)"
|
|
|
|
- name: platform-vpc-destroy
|
|
command: cd terraform/platform && terraform destroy -auto-approve -lock=false
|
|
required: false
|
|
description: "Destroy the shared platform VPC (cleanup — runs even if lifecycle steps fail)"
|
|
|
|
# L2 lifecycle stages (composition modules)
|
|
- name: l2-lifecycle-apply
|
|
command: bash scripts/run_platform.sh --apply "modules/l2/${L2_MODULE}/examples/simple.yml"
|
|
required: true
|
|
description: "Apply the L2 module's simple example contract (terraform apply)"
|
|
|
|
- name: l2-lifecycle-modify
|
|
command: bash scripts/run_platform.sh --apply "modules/l2/${L2_MODULE}/examples/complex.yml"
|
|
required: true
|
|
description: "Apply the L2 module's complex example (same state key — terraform modifies)"
|
|
|
|
- name: l2-lifecycle-destroy
|
|
command: bash scripts/run_platform.sh --destroy "modules/l2/${L2_MODULE}/examples/complex.yml"
|
|
required: true
|
|
description: "Destroy the L2 module's resources (terraform destroy)"
|
|
|
|
matrix:
|
|
modules: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc, alb, ecs-service, rds, uptime]
|
|
vpc_dependent: [alb, ecs-service, rds, uptime]
|
|
independent: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc]
|
|
l2_modules: [static-assets, microservice] |