ontoref/reflection/schemas/workflow.ncl

107 lines
5.1 KiB
Text
Raw Normal View History

feat: workflow layer model — NCL-first CI/build/distribution generator Adds a declarative workflow system where .ontology/workflow.ncl declares independent layers (commit-fast, ci-standard, ci-exhaustive), each with a trigger and a set of providers. The generator materialises Woodpecker YAML, justfile recipes, and pre-commit hook stubs from that single declaration. Layers form a set, not a chain — no layer depends on another at the declaration level. Woodpecker steps express fine-grained parallelism internally (lint → test/docs/build). Schema and catalog: - reflection/schemas/workflow.ncl — types, contracts, provider constructors - reflection/defaults/workflow.ncl — standard Rust/Nushell/Nickel catalog (14 validations, 4 builds) Generator (ore workflow generate): - PreCommit: prints hook fragments for manual merge into .pre-commit-config.yaml - Woodpecker: writes per-layer YAML with image selection, tool installs, depends_on chains, and CI-aware command translation (nu --ide-check → find+xargs; markdownlint-cli2 → node:lts image) - Justfile: single justfiles/workflow.just aggregated from all Justfile layers (hoisted out of per-provider loop — was writing N times, now once) Dispatcher: ore workflow validate|list|generate|diff + ore wf v|l|gen|diff Cargo/nextest profiles: - .cargo/config.toml: [profile.ci-test] (debug=0, no-incremental) and [profile.ci] (line-tables-only) — shared by test + docs hooks to reuse .rlib artifacts; CI retains actionable backtraces - .config/nextest.toml: ci-test (fail-fast, no retries) and ci (all failures, one retry) Pre-commit: nextest run with --profile ci-test --cargo-profile ci-test; docs-links hook shares same profile to reuse artifacts Self-application: ontoref declares its own workflow in .ontology/workflow.ncl and the generated .woodpecker/ files are the authoritative CI definition Migration 0014: checks workflow.ncl + both cargo and nextest profiles present Adoption: reflection/templates/ontology/workflow.ncl stub + install_workflow confirm in adopt_ontoref form + step 5 in adoption script template
2026-04-08 14:20:38 +01:00
let layer_trigger = [|
'OnCommit, # pre-commit (git) / jjw pre-op check (jj)
'OnPush, # pre-push (git) / rad patch submit (radicle)
'OnPR, # pull_request on remote CI
'OnMainMerge, # push to trunk/main branch
'OnTag, # semver tag event
'OnManual, # explicit user/agent trigger
|] in
let validation_kind = [| 'Lint, 'Test, 'Security, 'Compliance, 'Docs |] in
let build_kind = [| 'Binary, 'Library, 'Container, 'Docs, 'SBOM |] in
let distribution_kind = [| 'CargoRegistry, 'ContainerRegistry, 'Package, 'Artifact |] in
# Validation spec — tool invocation, VCS/provider agnostic.
# The generator translates this into provider-specific syntax.
let validation_spec = {
id | String | default = "",
kind | validation_kind | default = 'Lint,
tool | String | default = "",
args | Array String | default = [],
when | Array String | default = [], # glob patterns; empty = always run
fail_fast | Bool | default = true,
cargo_profile | String | default = "", # "" if not applicable
} in
# Build spec — artifact production, VCS/provider agnostic.
let build_spec = {
id | String | default = "",
kind | build_kind | default = 'Binary,
tool | String | default = "",
args | Array String | default = [],
cargo_profile | String | default = "",
target | String | default = "", # cargo target triple; "" = native
feat: #[onto_mcp_tool] catalog, OCI credential vault layer, validate ADR-018 mode hierarchy ontoref-derive: #[onto_mcp_tool] attribute macro registers MCP tool unit-structs in the catalog at link time via inventory::submit!; annotated item is emitted unchanged, ToolBase/AsyncTool impls stay on the struct. All 34 tools migrated from manual wiring (net +5: ontoref_list_projects, ontoref_search, ontoref_describe, ontoref_list_ontology_extensions, ontoref_get_ontology_extension). validate modes (ADR-018): reads level_hierarchy from workflow.ncl and checks every .ncl mode for level declared, strategy declared, delegate chain coherent, compose extends valid. mode resolve <id> shows which hierarchy level handles a mode and why. --self-test generates synthetic fixtures in a temp dir for CI smoke-testing. validate run-cargo: two-step Cargo.toml resolution — workspace layout first (crates/<check.crate>/Cargo.toml), single-crate fallback by package name or repo basename. Lets the same ADR constraint shape apply to workspace and single-crate repos. ontology/schemas/manifest.ncl: registry_topology_type contract — multi-registry coordination, push targets, participant scopes, per-namespace capability. reflection/requirements/base.ncl: oras ≥1.2.0, cosign ≥2.0.0, sops ≥3.9.0, age ≥1.1.0, restic declared as Hard/Soft requirements with version_min, check_cmd, and install_hint (ADR-017 toolchain surface). ADR-019: per-file recipient routing for tenant isolation without multi-vault. Schema additions: sops.recipient_groups + sops.recipient_rules in ontoref-project.ncl. secrets-bootstrap generates .sops.yaml from project.ncl in declarative mode. Three new secrets-audit checks: recipient-routing-coherent, recipient-routing-coverage, no-multi-vault. Adoption templates: single-team/, multi-tenant/, agent-first/. Integration templates: domain-producer/, mode-producer/, mode-consumer/. UI: project_picker surfaces registry badge (⟳ participant) and vault badge (⛁ vault_id · N, green=declarative / amber=legacy) per project card. Expanded panel adds collapsible Registry section with namespace, endpoint, and push/pull capability. manage.html gains Runtime Services card — MCP and GraphQL toggleable without restart via HTMX POST /ui/manage/services/{service}/toggle. describe.nu: capabilities JSON includes registry_topology and vault_state per project. sync.nu: drift check extended to detect //! absence on newly registered crates. qa.ncl: six entries — credential-vault-best-practice (layered data-flow diagram), credential-vault-templates (paths A/B/C), credential-vault-troubleshooting (15 named errors), integration-what-and-why (ADR-042 OCI federation), integration-how-to-implement, integration-troubleshooting. on+re: core.ncl + manifest.ncl updated to reflect OCI, MCP, and mode-hierarchy nodes. Deleted stale presentation assets (2026-02 slides + voice notes).
2026-05-12 04:46:15 +01:00
artifacts | Array String | default = [], # expected output paths.
# Supported placeholders:
# {TARGET_DIR} → cargo `target_directory` (resolved via `cargo metadata`)
# {ROOT} → workspace root
# Use placeholders for paths that depend on the cargo target dir,
# since it may be redirected via .cargo/config.toml `target-dir`.
# Resolve via `reflection/modules/workflow.nu` `resolve-artifact-path`.
feat: workflow layer model — NCL-first CI/build/distribution generator Adds a declarative workflow system where .ontology/workflow.ncl declares independent layers (commit-fast, ci-standard, ci-exhaustive), each with a trigger and a set of providers. The generator materialises Woodpecker YAML, justfile recipes, and pre-commit hook stubs from that single declaration. Layers form a set, not a chain — no layer depends on another at the declaration level. Woodpecker steps express fine-grained parallelism internally (lint → test/docs/build). Schema and catalog: - reflection/schemas/workflow.ncl — types, contracts, provider constructors - reflection/defaults/workflow.ncl — standard Rust/Nushell/Nickel catalog (14 validations, 4 builds) Generator (ore workflow generate): - PreCommit: prints hook fragments for manual merge into .pre-commit-config.yaml - Woodpecker: writes per-layer YAML with image selection, tool installs, depends_on chains, and CI-aware command translation (nu --ide-check → find+xargs; markdownlint-cli2 → node:lts image) - Justfile: single justfiles/workflow.just aggregated from all Justfile layers (hoisted out of per-provider loop — was writing N times, now once) Dispatcher: ore workflow validate|list|generate|diff + ore wf v|l|gen|diff Cargo/nextest profiles: - .cargo/config.toml: [profile.ci-test] (debug=0, no-incremental) and [profile.ci] (line-tables-only) — shared by test + docs hooks to reuse .rlib artifacts; CI retains actionable backtraces - .config/nextest.toml: ci-test (fail-fast, no retries) and ci (all failures, one retry) Pre-commit: nextest run with --profile ci-test --cargo-profile ci-test; docs-links hook shares same profile to reuse artifacts Self-application: ontoref declares its own workflow in .ontology/workflow.ncl and the generated .woodpecker/ files are the authoritative CI definition Migration 0014: checks workflow.ncl + both cargo and nextest profiles present Adoption: reflection/templates/ontology/workflow.ncl stub + install_workflow confirm in adopt_ontoref form + step 5 in adoption script template
2026-04-08 14:20:38 +01:00
} in
# Distribution spec — where to send artifacts after build.
let distribution_spec = {
id | String | default = "",
kind | distribution_kind | default = 'Artifact,
tool | String | default = "",
args | Array String | default = [],
destination | String | default = "",
} in
# A workflow layer is an independent, self-contained set of operations.
# Layers do NOT depend on each other — they form a set, not a chain.
# A workspace may activate any combination of layers independently.
let workflow_layer = {
id | String | default = "",
trigger | layer_trigger | default = 'OnManual,
validations | Array String | default = [], # IDs from the active validations catalog
builds | Array String | default = [], # IDs from the active builds catalog
distributions | Array String | default = [], # IDs from the active distributions catalog
# Provider implementations enabled for this layer.
# Each provider generates a different artifact from the same layer declaration.
# Use the ProviderImpl helpers below to construct typed provider records.
providers | Array { tag | String, .. } | default = [],
} in
# Complete workflow declaration for a workspace.
# Workspaces import defaults/workflow.ncl and extend/override as needed.
let workflow_declaration = {
layers | Array workflow_layer | default = [],
validations | { _ | validation_spec } | default = {},
builds | { _ | build_spec } | default = {},
distributions | { _ | distribution_spec } | default = {},
} in
# ── Provider constructor helpers ──────────────────────────────────────────────
# Use these to build the providers array in WorkflowLayer.
let mk_pre_commit = fun s => { tag = "PreCommit", stage = s } in
let mk_woodpecker = fun f => { tag = "Woodpecker", file = f } in
let mk_github_actions = fun f => { tag = "GithubActions", file = f } in
let mk_justfile = fun r => { tag = "Justfile", recipe = r } in
let mk_jjw_wrapper = { tag = "JjwWrapper" } in
{
# Types / contracts — use as field contracts: `field | W.WorkflowLayer`
LayerTrigger = layer_trigger,
ValidationKind = validation_kind,
BuildKind = build_kind,
DistributionKind = distribution_kind,
ValidationSpec = validation_spec,
BuildSpec = build_spec,
DistributionSpec = distribution_spec,
WorkflowLayer = workflow_layer,
WorkflowDeclaration = workflow_declaration,
# Provider constructors — use in `providers = [W.pre_commit "pre-commit", ...]`
pre_commit = mk_pre_commit,
woodpecker = mk_woodpecker,
github_actions = mk_github_actions,
justfile = mk_justfile,
jjw_wrapper = mk_jjw_wrapper,
}