ontoref/reflection/migrations/0014-workflow-layer-model.ncl

58 lines
2.5 KiB
Text
Raw Normal View History

feat: workflow layer model — NCL-first CI/build/distribution generator Adds a declarative workflow system where .ontology/workflow.ncl declares independent layers (commit-fast, ci-standard, ci-exhaustive), each with a trigger and a set of providers. The generator materialises Woodpecker YAML, justfile recipes, and pre-commit hook stubs from that single declaration. Layers form a set, not a chain — no layer depends on another at the declaration level. Woodpecker steps express fine-grained parallelism internally (lint → test/docs/build). Schema and catalog: - reflection/schemas/workflow.ncl — types, contracts, provider constructors - reflection/defaults/workflow.ncl — standard Rust/Nushell/Nickel catalog (14 validations, 4 builds) Generator (ore workflow generate): - PreCommit: prints hook fragments for manual merge into .pre-commit-config.yaml - Woodpecker: writes per-layer YAML with image selection, tool installs, depends_on chains, and CI-aware command translation (nu --ide-check → find+xargs; markdownlint-cli2 → node:lts image) - Justfile: single justfiles/workflow.just aggregated from all Justfile layers (hoisted out of per-provider loop — was writing N times, now once) Dispatcher: ore workflow validate|list|generate|diff + ore wf v|l|gen|diff Cargo/nextest profiles: - .cargo/config.toml: [profile.ci-test] (debug=0, no-incremental) and [profile.ci] (line-tables-only) — shared by test + docs hooks to reuse .rlib artifacts; CI retains actionable backtraces - .config/nextest.toml: ci-test (fail-fast, no retries) and ci (all failures, one retry) Pre-commit: nextest run with --profile ci-test --cargo-profile ci-test; docs-links hook shares same profile to reuse artifacts Self-application: ontoref declares its own workflow in .ontology/workflow.ncl and the generated .woodpecker/ files are the authoritative CI definition Migration 0014: checks workflow.ncl + both cargo and nextest profiles present Adoption: reflection/templates/ontology/workflow.ncl stub + install_workflow confirm in adopt_ontoref form + step 5 in adoption script template
2026-04-08 14:20:38 +01:00
{
id = "0014",
slug = "workflow-layer-model",
description = "Workflow layer model: .ontology/workflow.ncl declares independent CI/build/distribution layers. Cargo profiles ci-test (pre-commit, debug=0) and ci (CI pipeline, line-tables-only) must exist. Nextest profiles ci-test and ci must exist. Generator: ore workflow generate.",
check = {
tag = "NuCmd",
feat: #[onto_mcp_tool] catalog, OCI credential vault layer, validate ADR-018 mode hierarchy ontoref-derive: #[onto_mcp_tool] attribute macro registers MCP tool unit-structs in the catalog at link time via inventory::submit!; annotated item is emitted unchanged, ToolBase/AsyncTool impls stay on the struct. All 34 tools migrated from manual wiring (net +5: ontoref_list_projects, ontoref_search, ontoref_describe, ontoref_list_ontology_extensions, ontoref_get_ontology_extension). validate modes (ADR-018): reads level_hierarchy from workflow.ncl and checks every .ncl mode for level declared, strategy declared, delegate chain coherent, compose extends valid. mode resolve <id> shows which hierarchy level handles a mode and why. --self-test generates synthetic fixtures in a temp dir for CI smoke-testing. validate run-cargo: two-step Cargo.toml resolution — workspace layout first (crates/<check.crate>/Cargo.toml), single-crate fallback by package name or repo basename. Lets the same ADR constraint shape apply to workspace and single-crate repos. ontology/schemas/manifest.ncl: registry_topology_type contract — multi-registry coordination, push targets, participant scopes, per-namespace capability. reflection/requirements/base.ncl: oras ≥1.2.0, cosign ≥2.0.0, sops ≥3.9.0, age ≥1.1.0, restic declared as Hard/Soft requirements with version_min, check_cmd, and install_hint (ADR-017 toolchain surface). ADR-019: per-file recipient routing for tenant isolation without multi-vault. Schema additions: sops.recipient_groups + sops.recipient_rules in ontoref-project.ncl. secrets-bootstrap generates .sops.yaml from project.ncl in declarative mode. Three new secrets-audit checks: recipient-routing-coherent, recipient-routing-coverage, no-multi-vault. Adoption templates: single-team/, multi-tenant/, agent-first/. Integration templates: domain-producer/, mode-producer/, mode-consumer/. UI: project_picker surfaces registry badge (⟳ participant) and vault badge (⛁ vault_id · N, green=declarative / amber=legacy) per project card. Expanded panel adds collapsible Registry section with namespace, endpoint, and push/pull capability. manage.html gains Runtime Services card — MCP and GraphQL toggleable without restart via HTMX POST /ui/manage/services/{service}/toggle. describe.nu: capabilities JSON includes registry_topology and vault_state per project. sync.nu: drift check extended to detect //! absence on newly registered crates. qa.ncl: six entries — credential-vault-best-practice (layered data-flow diagram), credential-vault-templates (paths A/B/C), credential-vault-troubleshooting (15 named errors), integration-what-and-why (ADR-042 OCI federation), integration-how-to-implement, integration-troubleshooting. on+re: core.ncl + manifest.ncl updated to reflect OCI, MCP, and mode-hierarchy nodes. Deleted stale presentation assets (2026-02 slides + voice notes).
2026-05-12 04:46:15 +01:00
cmd = "let root = ($env.ONTOREF_PROJECT_ROOT? | default ($env.ONTOREF_ROOT? | default (pwd | path expand))); let wf = $\"($root)/.ontology/workflow.ncl\"; if not ($wf | path exists) { exit 1 }; let has_rust = ($\"($root)/Cargo.toml\" | path exists); if not $has_rust { exit 0 }; let cargo_cfg = $\"($root)/.cargo/config.toml\"; if not ($cargo_cfg | path exists) { exit 1 }; let cargo_txt = (open --raw $cargo_cfg); let has_ci_test = ($cargo_txt | str contains \"[profile.ci-test]\"); let has_ci = ($cargo_txt | str contains \"[profile.ci]\"); let nextest_cfg = $\"($root)/.config/nextest.toml\"; if not ($nextest_cfg | path exists) { exit 1 }; let nextest_txt = (open --raw $nextest_cfg); let nx_ci_test = ($nextest_txt | str contains \"[profile.ci-test]\"); let nx_ci = ($nextest_txt | str contains \"[profile.ci]\"); if $has_ci_test and $has_ci and $nx_ci_test and $nx_ci { exit 0 } else { exit 1 }",
feat: workflow layer model — NCL-first CI/build/distribution generator Adds a declarative workflow system where .ontology/workflow.ncl declares independent layers (commit-fast, ci-standard, ci-exhaustive), each with a trigger and a set of providers. The generator materialises Woodpecker YAML, justfile recipes, and pre-commit hook stubs from that single declaration. Layers form a set, not a chain — no layer depends on another at the declaration level. Woodpecker steps express fine-grained parallelism internally (lint → test/docs/build). Schema and catalog: - reflection/schemas/workflow.ncl — types, contracts, provider constructors - reflection/defaults/workflow.ncl — standard Rust/Nushell/Nickel catalog (14 validations, 4 builds) Generator (ore workflow generate): - PreCommit: prints hook fragments for manual merge into .pre-commit-config.yaml - Woodpecker: writes per-layer YAML with image selection, tool installs, depends_on chains, and CI-aware command translation (nu --ide-check → find+xargs; markdownlint-cli2 → node:lts image) - Justfile: single justfiles/workflow.just aggregated from all Justfile layers (hoisted out of per-provider loop — was writing N times, now once) Dispatcher: ore workflow validate|list|generate|diff + ore wf v|l|gen|diff Cargo/nextest profiles: - .cargo/config.toml: [profile.ci-test] (debug=0, no-incremental) and [profile.ci] (line-tables-only) — shared by test + docs hooks to reuse .rlib artifacts; CI retains actionable backtraces - .config/nextest.toml: ci-test (fail-fast, no retries) and ci (all failures, one retry) Pre-commit: nextest run with --profile ci-test --cargo-profile ci-test; docs-links hook shares same profile to reuse artifacts Self-application: ontoref declares its own workflow in .ontology/workflow.ncl and the generated .woodpecker/ files are the authoritative CI definition Migration 0014: checks workflow.ncl + both cargo and nextest profiles present Adoption: reflection/templates/ontology/workflow.ncl stub + install_workflow confirm in adopt_ontoref form + step 5 in adoption script template
2026-04-08 14:20:38 +01:00
expect_exit = 0,
},
instructions = "
Adopt the workflow layer model:
1. Create .ontology/workflow.ncl declaring your CI layers.
Use the template at reflection/templates/ontology/workflow.ncl
or copy from an existing workspace.
2. Add cargo profiles to .cargo/config.toml:
[profile.ci-test]
# Pre-commit: no debug info, no incremental — shared .rlib between test + docs hooks
inherits = \"test\"
debug = 0
incremental = false
[profile.ci]
# CI pipeline: line-tables-only for actionable backtraces on remote failures
inherits = \"test\"
debug = \"line-tables-only\"
incremental = false
3. Add nextest profiles to .config/nextest.toml:
[profile.ci-test]
fail-fast = true
retries = 0
[profile.ci]
fail-fast = false
retries = 1
4. Generate CI artifacts from the declaration:
ore workflow generate
This writes:
- .woodpecker/ci.yml (from layers with provider Woodpecker + trigger OnPR)
- .woodpecker/ci-exhaustive.yml (from layers with trigger OnMainMerge)
- justfiles/workflow.just (from layers with provider Justfile)
Pre-commit hooks are printed for manual merge into .pre-commit-config.yaml.
5. Verify:
ore workflow validate
ore workflow list
",
}