Jon Chery
0d2cbdb423
Genericize forge-detection code: gitea→forge/generic_forge, GITEA_ACTOR→FORGE_ACTOR. Drop .gitea byte-identity test assertions (keep GitHub-side + contract conformance). Add test_no_forge_mentions.py guard test (REQ-230). Delete completed migration docs (NOVA_MIGRATION.md, NOVA_AWS_MIGRATION.md). Move NO_HUMANS_THESIS.md to .ciagent/ (internal artifact). Strip ciagent-internal provenance from synced docs (REQ-/D-/P-/CAP- IDs, milestone headers, .ciagent/PROJECT.md citations). Trim README.md (reusable deploy section, local key rotation paragraph). Fix version-tag drift (@v1.13→@v1.19, acdl/→nova/). ---ci--- project: acdl phase: 1 milestone: v1.20 status: execute requirements: [REQ-230, REQ-231, REQ-232] ---/ci---
72 lines
2.8 KiB
YAML
72 lines
2.8 KiB
YAML
# Nova Central Deployment Pipeline Contract (v1.8)
|
|
#
|
|
# This is the single source of truth for the deployment pipeline. It
|
|
# declares the stages that run when a consumer submits a contract:
|
|
# validate-contract -> resolve-stack -> terraform-plan -> checkov ->
|
|
# confidence -> apply (dev only) -> publish-outputs -> deploy-uptime ->
|
|
# comment-outputs
|
|
#
|
|
# Decommission mode (mode: decommission) runs a different set of stages:
|
|
# validate-change-request -> disable-deletion-protection (HITL SRE) ->
|
|
# zero-counts (HITL SRE) -> confirm-decommission
|
|
#
|
|
# This file is the declarative pipeline spec (a contract, not an executable
|
|
# workflow). The executable workflow is .github/workflows/deploy.yml
|
|
# (GitHub Actions), which
|
|
# implements these stages by invoking scripts/run_platform.sh.
|
|
#
|
|
# Validated against schemas/deploy-pipeline.schema.json.
|
|
|
|
name: nova-deploy
|
|
environment: dev
|
|
triggers:
|
|
push: [main]
|
|
pull_request: [main]
|
|
runner: ubuntu-latest
|
|
python_version: "3.12"
|
|
|
|
stages:
|
|
- name: validate-contract
|
|
description: Validate the consumer contract against the contract schema
|
|
command: python3 -c "import jsonschema, yaml; jsonschema.validate(yaml.safe_load(open('contracts/static-assets.yaml')), json.load(open('schemas/contract.schema.json')))"
|
|
required: true
|
|
|
|
- name: resolve-stack
|
|
description: Resolve the contract to a Target Stack instance via the contract resolver
|
|
command: python3 core/contract_resolver.py contracts/static-assets.yaml /tmp/acdl-stack.json
|
|
required: true
|
|
|
|
- name: terraform-plan
|
|
description: Compile the stack to Terraform and run terraform plan
|
|
command: bash scripts/run_platform.sh --plan-only contracts/static-assets.yaml
|
|
required: true
|
|
|
|
- name: checkov
|
|
description: Run Checkov policy checks on the emitted Terraform
|
|
command: bash scripts/run_platform.sh --check-only
|
|
required: false
|
|
|
|
- name: confidence
|
|
description: Compute the confidence signal from policy + validation inputs
|
|
command: python3 core/confidence_signal.py /tmp/acdl-deploy-inputs.json dev
|
|
required: true
|
|
|
|
- name: apply
|
|
description: Apply the Terraform plan (dev environment only, autonomous per §10)
|
|
command: bash scripts/run_platform.sh --plan-only
|
|
required: false
|
|
|
|
- name: publish-outputs
|
|
description: Publish deploy outputs to SSM Parameter Store (SecureString) + GitHub PR comment
|
|
command: bash scripts/run_platform.sh
|
|
required: false
|
|
|
|
- name: deploy-uptime
|
|
description: Deploy uptime-kuma monitoring stack (separate terraform state) with endpoints from L2 outputs
|
|
command: bash scripts/run_platform.sh --deploy-uptime
|
|
required: false
|
|
|
|
- name: comment-outputs
|
|
description: Post a structured GitHub PR comment with human-readable deploy outputs
|
|
command: bash scripts/post_stage_comment.sh publish-outputs pass
|
|
required: false |