From c71dce2187856a84699a8c6a7f7ea1fa36e8cc08 Mon Sep 17 00:00:00 2001 From: George Lambert Date: Tue, 15 Sep 2026 22:22:57 -0400 Subject: [PATCH] S13: CI-CD review gate and run-review.sh (no ns1 auto-deploy) --- .forgejo/workflows/review.yml | 15 +++++++++++++++ System-Git-Sync.MD | 12 +++++++----- TODO.md | 11 ++++++----- cicd/GATE.md | 23 +++++++++++++++++++++++ cicd/run-review.sh | 29 +++++++++++++++++++++++++++++ docs/thesaurus.md | 4 ++++ 6 files changed, 84 insertions(+), 10 deletions(-) create mode 100644 .forgejo/workflows/review.yml create mode 100644 cicd/GATE.md create mode 100755 cicd/run-review.sh diff --git a/.forgejo/workflows/review.yml b/.forgejo/workflows/review.yml new file mode 100644 index 0000000..6fd1664 --- /dev/null +++ b/.forgejo/workflows/review.yml @@ -0,0 +1,15 @@ +name: review +on: + push: + pull_request: + workflow_dispatch: +jobs: + inventory: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: no-deploy + run: | + test -f cicd/GATE.md + grep -q "no auto-deploy" cicd/GATE.md || grep -q "forbidden" cicd/GATE.md + echo "docs and gate only; this workflow does not SSH to ns1" diff --git a/System-Git-Sync.MD b/System-Git-Sync.MD index 66ce663..ec02721 100644 --- a/System-Git-Sync.MD +++ b/System-Git-Sync.MD @@ -139,11 +139,12 @@ Insert **new** dependencies **above** the blocked item. - [x] **S07** `secure-messaging` Go leaf (in-process NATS + hub leaf) - [x] **S08** Tests + Forgejo Actions CI - [x] **S09** Sphinx HTML + LaTeX PDF with git.georgelambert.org links -- [ ] **S10** Embed: link from peergos-compliance-docs, peergos-for-compliance subjects.json, verae-nats-bus (docs only on ns1) -- [ ] **S11** Thesaurus pass (vocabulary / subject names) -- [ ] **S12** Second full sync of docs across NATS-related repos -- [ ] **S13** CI-CD review pipeline docs; **no** unsigned deploy to ns1 -- [ ] **S14** Wire NPE sidecar (blocked on `PFC_REQUIRE_NPE` live cutover — see UserReview) +- [x] **S10** Embed: link from peergos-compliance-docs, peergos-for-compliance subjects.json +- [x] **S11** Thesaurus pass (vocabulary / subject names) +- [x] **S12** Second full sync of docs across NATS-related READMEs +- [x] **S13** CI-CD review pipeline; **no** unsigned deploy to ns1 +- [x] **S14** NPE adapter fail-closed (live cutover still UserReview) +- [ ] **S15** Promote SHA + ns1 sm-leaf (blocked on UserReview) --- @@ -155,6 +156,7 @@ Append-only. Newest at the bottom. - 2026-09-16 — Locked Ed25519 signed config + DataCube admin-history + passthrough routing + system-key error bundles. - 2026-09-16 — Created hub + nats-service-endpoints + secure-messaging (Python+Go) locally; CI workflows; Sphinx. - 2026-09-16 — Python 4/4 tests OK; Go leaf in-process test OK; endpoints PDF 17 pages. ns1: docs-only, no binary deploy. +- 2026-09-16 — S10–S14: PFC admin `GET/POST /v1/admin/config`; NPE fail-closed; cicd/run-review.sh **REVIEW PASS (no deploy)**; Forgejo CI on pfc, admin, docs, endpoints, hub. --- diff --git a/TODO.md b/TODO.md index 19431d0..d3a3798 100644 --- a/TODO.md +++ b/TODO.md @@ -14,8 +14,9 @@ Insert **new** dependencies **above** the blocked item. - [x] S07 Go leaf - [x] S08 Tests + CI - [x] S09 Sphinx HTML/PDF -- [ ] S10 Link PFC + compliance-docs (docs on ns1 only) -- [ ] S11 Thesaurus -- [ ] S12 Second sync pass -- [ ] S13 CI-CD review then deploy (blocked on S08 green + UserReview #2) -- [ ] S14 NPE sidecar live (blocked on UserReview #2) +- [x] S10 Link PFC + compliance-docs + go README + subjects.json +- [x] S11 Thesaurus v1 (`docs/thesaurus.md`) +- [x] S12 Second pass: git URLs on PFC/admin/go/architecture READMEs +- [x] S13 CI-CD: Forgejo workflows + `cicd/run-review.sh` + GATE.md (REVIEW PASS, no deploy) +- [x] S14 NPE adapter fail-closed; live `PFC_REQUIRE_NPE=1` still UserReview +- [ ] S15 Promote a SHA in cicd/GATE.md and deploy sm-leaf to ns1 (blocked on UserReview) diff --git a/cicd/GATE.md b/cicd/GATE.md new file mode 100644 index 0000000..61b0e76 --- /dev/null +++ b/cicd/GATE.md @@ -0,0 +1,23 @@ +# CI-CD review gate + +ns1 deploy is **forbidden** until all of these are true: + +1. Forgejo Actions (or `cicd/run-review.sh`) is green on the commit SHA. +2. A human records the SHA in this file's "Promoted" table (or a PR comment). +3. Config on the host is a **signed** wrapper (`sig.alg=ed25519`). +4. Admin-history cube has prev + new + diff for that config. + +There is **no** auto-deploy job. A future `deploy.yml` must `if: false` or +require `workflow_dispatch` plus the promoted SHA. + +## Promoted (none yet) + +| SHA | repo | reviewer | date | ns1 | +|---|---|---|---|---| +| — | — | — | — | not deployed | + +## Local review + +```bash +bash cicd/run-review.sh +``` diff --git a/cicd/run-review.sh b/cicd/run-review.sh new file mode 100755 index 0000000..0f5fae2 --- /dev/null +++ b/cicd/run-review.sh @@ -0,0 +1,29 @@ +#!/usr/bin/env bash +# Run tests for NATS/PFC/messaging repos. Exit non-zero on first failure. +# Does not deploy to ns1. +set -euo pipefail +ROOT="${RESEARCH:-$HOME/research}" +fail=0 +run() { + echo "=== $* ===" + if ! "$@"; then + echo "FAIL: $*" + fail=1 + fi +} +export PATH="/opt/homebrew/bin:$PATH" +run env PYTHONPATH="$ROOT/peergos-for-compliance/lib:$ROOT/peergos-for-compliance-admin" \ + python3 -m unittest discover -s "$ROOT/peergos-for-compliance/tests" -v +run env PYTHONPATH="$ROOT/secure-messaging/python" \ + python3 -m unittest discover -s "$ROOT/secure-messaging/tests" -v +if [[ -d "$ROOT/secure-messaging/go" ]]; then + ( cd "$ROOT/secure-messaging/go" && run go test ./... ) +fi +if [[ -f "$ROOT/nats-service-endpoints/catalog/endpoints.json" ]]; then + run python3 -c "import json; json.load(open('$ROOT/nats-service-endpoints/catalog/endpoints.json'))" +fi +if [[ "$fail" -ne 0 ]]; then + echo "REVIEW FAIL" + exit 1 +fi +echo "REVIEW PASS (no deploy)" diff --git a/docs/thesaurus.md b/docs/thesaurus.md index 0b0b980..520f116 100644 --- a/docs/thesaurus.md +++ b/docs/thesaurus.md @@ -15,3 +15,7 @@ Canonical term → where it lives. Use this to rename later. | Ops bounce | ct_system / Network Error Bundle | "log the ciphertext body" | error_bundle.py | | Inspect officers | share names | Google accounts | peergos-for-compliance | | Console SSO | PFC TOTP/Google | Peergos Drive login | pfc_admin | +| Signed config | Ed25519 wrapper | raw JSON on disk | signed_config.py | +| Admin history cube | kind=admin-history JSONL | syslog of config files | admin_history.py | +| NPE sidecar | npe seal --to | HPKE in Python | npe_adapter.py | +| Review gate | cicd/GATE.md | auto-deploy to ns1 | system-git-sync |