Jon Chery
eb7634da28
v1.15-Nova rebrand doc verification (phase/05-final-review-ship) found stale ACDL references where the code/terraform already uses Nova names. Critical drift fixed (doc said old name; code uses new): - README.md: `.acdl/contract.yml` -> `.nova/contract.yml`; `acdl-spike-runner` -> `nova-spike-runner`; ABAC tag keys `acdl:owner|contract` -> `nova:owner|contract`. - docs/environments/index.md: `acdl-contract-ingestor` -> `nova-contract-ingestor`; `aws:PrincipalTag/acdl:owner` -> `nova:owner`; `acdl-contracts` -> `nova-contracts`. - docs/consumer-guide.md: `acdl-change-requests` -> `nova-change-requests`; state bucket example `acdl-qa-state` -> `nova-qa-state`. - docs/presentations/* (4 decks + 2 HTML + talking-points): `acdl:owner|contract| environment|cost-center` -> `nova:*`; `ACDL_LIFECYCLE_MODE` -> `NOVA_LIFECYCLE_MODE`. - pipelines/modules-lifecycle.yml comments: `ACDL_LIFECYCLE_MODE` -> `NOVA_LIFECYCLE_MODE` (workflows already use NOVA_; the contract comments were stale). - docs/NOVA_MIGRATION.md: status banner -> COMPLETE (P5 cutoff passed). - .ciagent/ARCHITECTURE.md: header `ACDL` -> `Nova`; NOVA_LIFECYCLE_MODE rename noted in the live lifecycle-mode section (v1.15 addendum already correct). - .ciagent/ROADMAP.md: v1.15 phase statuses P1-P4 pending -> complete (v1.15.1..v1.15.4); P5 -> in progress (phase/05-final-review-ship). Verification: - grep for `acdl:*` tag keys / `.acdl/contract` / `acdl-contract-ingestor` / `acdl-contracts` / `ACDL_LIFECYCLE_MODE` in README/docs/pipelines -> 0 hits (excluding explicitly-unchanged repo path `acdl/.github/...`, `continuous-intelligence/acdl`, and historical narrative). - core/output_publisher.py uses `/nova`; schemas/tagging-standard.json uses `nova:*`; terraform uses `nova-*` (0 `acdl-` in *.tf) — docs now match. - git tag v1.15.0..v1.15.4 exist. - pytest tests/test_lifecycle_mode_flag.py tests/test_pipeline_contract.py -> 111 passed. ---ci--- project: acdl
88 lines
3.8 KiB
YAML
88 lines
3.8 KiB
YAML
name: acdl-modules-lifecycle
|
|
|
|
# Nova Modules Lifecycle Pipeline — apply→modify→destroy against live AWS.
|
|
#
|
|
# Matrix-runs each L1 module's examples/{simple,complex}.yml contracts:
|
|
# 1. --apply simple.yml (terraform apply — creates resources)
|
|
# 2. --apply complex.yml (same state key — terraform modifies)
|
|
# 3. --destroy complex.yml (terraform destroy — cleans up)
|
|
#
|
|
# No per-module Python. The "test" = the pipeline cell going green.
|
|
# VPC-dependent L1s (alb, ecs-service, rds, uptime) reference the platform
|
|
# VPC applied by a prerequisite job. Non-VPC L1s run independent.
|
|
#
|
|
# Lifecycle mode (REQ-134, v1.12): `default_mode: plan` — the lifecycle
|
|
# scripts run `run_platform.sh --plan-only` (fast, no AWS mutation, no
|
|
# AWS credentials, no cost) on every PR. Set the NOVA_LIFECYCLE_MODE CI
|
|
# variable (workflow_dispatch input `lifecycle_mode`) to `full` for the
|
|
# real apply→modify→destroy against live AWS. The CI VPC apply/destroy
|
|
# jobs are skipped in plan mode (nothing is applied).
|
|
#
|
|
# Both Gitea (.gitea/workflows/modules-lifecycle.yml) and GitHub
|
|
# (.github/workflows/modules-lifecycle.yml) implement this contract
|
|
# byte-identically.
|
|
|
|
triggers:
|
|
pull_request: [main]
|
|
workflow_dispatch:
|
|
inputs:
|
|
- name: lifecycle_mode
|
|
description: "Lifecycle mode: 'plan' (default, fast) or 'full' (real apply→destroy)"
|
|
default: plan
|
|
|
|
runner: ubuntu-latest
|
|
python_version: "3.12"
|
|
terraform_version: "1.9.*"
|
|
|
|
# Default lifecycle mode: "plan" (plan-only, fast, no AWS mutation) or "full"
|
|
# (real apply→modify→destroy against live AWS). Overridable via the
|
|
# NOVA_LIFECYCLE_MODE CI variable / workflow_dispatch input.
|
|
default_mode: plan
|
|
|
|
stages:
|
|
- name: platform-vpc-apply
|
|
command: cd terraform/platform && terraform init -input=false && terraform apply -auto-approve -lock=false
|
|
required: true
|
|
description: "Apply the shared platform VPC (prerequisite for VPC-dependent L1s)"
|
|
|
|
- name: lifecycle-apply
|
|
command: bash scripts/run_platform.sh --apply "modules/l1/${MODULE}/examples/simple.yml"
|
|
required: true
|
|
description: "Apply the module's simple example contract (terraform apply)"
|
|
|
|
- name: lifecycle-modify
|
|
command: bash scripts/run_platform.sh --apply "modules/l1/${MODULE}/examples/complex.yml"
|
|
required: true
|
|
description: "Apply the module's complex example (same state key — terraform modifies)"
|
|
|
|
- name: lifecycle-destroy
|
|
command: bash scripts/run_platform.sh --destroy "modules/l1/${MODULE}/examples/complex.yml"
|
|
required: true
|
|
description: "Destroy the module's resources (terraform destroy)"
|
|
|
|
- name: platform-vpc-destroy
|
|
command: cd terraform/platform && terraform destroy -auto-approve -lock=false
|
|
required: false
|
|
description: "Destroy the shared platform VPC (cleanup — runs even if lifecycle steps fail)"
|
|
|
|
# L2 lifecycle stages (composition modules)
|
|
- name: l2-lifecycle-apply
|
|
command: bash scripts/run_platform.sh --apply "modules/l2/${L2_MODULE}/examples/simple.yml"
|
|
required: true
|
|
description: "Apply the L2 module's simple example contract (terraform apply)"
|
|
|
|
- name: l2-lifecycle-modify
|
|
command: bash scripts/run_platform.sh --apply "modules/l2/${L2_MODULE}/examples/complex.yml"
|
|
required: true
|
|
description: "Apply the L2 module's complex example (same state key — terraform modifies)"
|
|
|
|
- name: l2-lifecycle-destroy
|
|
command: bash scripts/run_platform.sh --destroy "modules/l2/${L2_MODULE}/examples/complex.yml"
|
|
required: true
|
|
description: "Destroy the L2 module's resources (terraform destroy)"
|
|
|
|
matrix:
|
|
modules: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc, alb, ecs-service, rds, uptime]
|
|
vpc_dependent: [alb, ecs-service, rds, uptime]
|
|
independent: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc]
|
|
l2_modules: [static-assets, microservice] |