242 lines
9.1 KiB
Text
242 lines
9.1 KiB
Text
# CI/CD Just Recipes
|
||
# Generated by dev-system/ci - Dynamic template
|
||
# Provides `just` recipes for running CI checks locally
|
||
# Based on detected languages and enabled tools
|
||
|
||
# Show CI help
|
||
[doc("Show ci help")]
|
||
help:
|
||
@echo "CI/CD Just Recipes"
|
||
@echo ""
|
||
@echo "Main Commands:"
|
||
@echo " just ci-full - Run all CI checks"
|
||
@echo " just ci-fmt - Format code"
|
||
@echo " just ci-lint - Run all linting checks"
|
||
@echo " just ci-test - Run all tests"
|
||
@echo " just ci-audit - Run security audits"
|
||
@echo " just ci-audit-protocol - Run the ontoref protocol audit (⛓G1 harness)"
|
||
@echo ""
|
||
@echo "Language-Specific:"
|
||
@echo " just ci-lint-rust - Lint Rust (clippy)"
|
||
@echo " just ci-fmt-toml - Check TOML formatting"
|
||
@echo " just ci-lint-toml - Lint TOML files (taplo)"
|
||
@echo " just ci-lint-nickel - Type check Nickel"
|
||
@echo " just ci-lint-markdown - Lint Markdown (markdownlint-cli2)"
|
||
@echo " just ci-lint-prose - Lint prose (Vale)"
|
||
@echo " just ci-lint-adr-refs - Check ADR cross-reference integrity"
|
||
@echo ""
|
||
@echo "Other:"
|
||
@echo " just ci-check-config-sync - Verify form/template parity"
|
||
@echo " just ci-sbom - Generate SBOM"
|
||
@echo " just ci-test-coverage - Run tests with coverage"
|
||
@echo " just setup-hooks - Install pre-commit hooks"
|
||
@echo " just hooks-run-all - Run pre-commit on all files"
|
||
@echo " just clean - Clean build artifacts"
|
||
|
||
# Run all CI checks
|
||
ci-full: ci-lint-rust ci-fmt-toml ci-lint-toml ci-lint-nickel ci-lint-markdown ci-lint-prose ci-lint-adr-refs ci-test ci-secrets-error-fixtures ci-secrets-smoke ci-vault-lock-smoke ci-audit ci-audit-protocol ci-check-config-sync ci-docs
|
||
@echo "✅ All CI checks passed!"
|
||
|
||
# ==============================================================================
|
||
# Formatting Checks
|
||
# ==============================================================================
|
||
|
||
# Check Rust code formatting
|
||
ci-fmt:
|
||
@echo "📝 Checking Rust code formatting..."
|
||
cargo fmt --all -- --check
|
||
# Check TOML file formatting
|
||
ci-fmt-toml:
|
||
@echo "📝 Checking TOML formatting..."
|
||
@command -v taplo >/dev/null || (echo "❌ taplo not installed: cargo install taplo-cli"; exit 1)
|
||
taplo format --check
|
||
|
||
|
||
# Format all code (alias — prefer dev-fmt)
|
||
fmt:
|
||
just dev-fmt
|
||
# ==============================================================================
|
||
# Linting
|
||
# ==============================================================================
|
||
|
||
# Run all linting checks
|
||
ci-lint: ci-lint-rust ci-lint-toml ci-lint-nickel ci-lint-markdown ci-lint-prose ci-lint-adr-refs ci-check-config-sync
|
||
@echo "✅ All lint checks passed!"
|
||
|
||
# Lint Rust code
|
||
ci-lint-rust:
|
||
@echo "🔍 Linting Rust (clippy)..."
|
||
cargo clippy --all-targets --all-features -- -D warnings
|
||
# Lint TOML files
|
||
ci-lint-toml:
|
||
@echo "🔍 Linting TOML files..."
|
||
@command -v taplo >/dev/null || (echo "❌ taplo not installed: cargo install taplo-cli"; exit 1)
|
||
taplo lint
|
||
|
||
# Lint Nickel schemas
|
||
ci-lint-nickel:
|
||
#!/usr/bin/env bash
|
||
echo "🔍 Type checking Nickel..."
|
||
SCHEMAS=$(find . -name "*.ncl" -type f \
|
||
! -path "./target/*" \
|
||
! -path "./.git/*" \
|
||
! -path "./node_modules/*" \
|
||
| head -20)
|
||
if [ -z "$SCHEMAS" ]; then
|
||
echo " ℹ️ No Nickel schemas found"
|
||
exit 0
|
||
fi
|
||
export NICKEL_IMPORT_PATH="/Users/Akasha/Tools/dev-system/ci/schemas:/Users/Akasha/Tools/dev-system/ci/validators:/Users/Akasha/Tools/dev-system/ci/defaults:."
|
||
for schema in $SCHEMAS; do
|
||
echo " Checking: $schema"
|
||
nickel typecheck "$schema" || exit 1
|
||
done
|
||
echo " ✓ All Nickel schemas valid"
|
||
|
||
# Lint Markdown files
|
||
ci-lint-markdown:
|
||
@echo "🔍 Linting Markdown files..."
|
||
@command -v markdownlint-cli2 >/dev/null || (echo "❌ markdownlint-cli2 not installed: npm install markdownlint-cli2"; exit 1)
|
||
markdownlint-cli2 "**/*.md" "#node_modules" "#.git"
|
||
# Lint prose/documentation
|
||
ci-lint-prose:
|
||
@echo "🔍 Linting prose with Vale..."
|
||
@command -v vale >/dev/null || (echo "❌ vale not installed: brew install vale"; exit 1)
|
||
vale sync
|
||
vale .
|
||
|
||
# Check ADR cross-reference integrity (structured related_adrs + prose ADR-NNN mentions)
|
||
ci-lint-adr-refs:
|
||
@echo "🔍 Checking ADR cross-reference integrity..."
|
||
ONTOREF_ACTOR=ci ./ontoref adr validate --refs
|
||
|
||
|
||
|
||
# ==============================================================================
|
||
# Testing
|
||
# ==============================================================================
|
||
|
||
# Run all tests
|
||
ci-test:
|
||
@echo "🧪 Running tests..."
|
||
cargo test --workspace --all-features
|
||
|
||
# Run tests with coverage (requires cargo-llvm-cov)
|
||
ci-test-coverage:
|
||
@echo "📊 Running tests with coverage..."
|
||
cargo llvm-cov --all-features --lcov --output-path lcov.info
|
||
|
||
# End-to-end credential chain smoke (ADR-017 + ADR-019).
|
||
# Pushes a throwaway vault to ZOT, pulls it back from an isolated HOME, decrypts.
|
||
# Skipped automatically when ZOT credentials are not exported — keeps `ci-full`
|
||
# green on CI workers without registry access. To run it: export
|
||
# RECOVERY_ZOT_USER and RECOVERY_ZOT_PASS, then `just ci-secrets-smoke`.
|
||
ci-secrets-smoke:
|
||
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
if [[ -z "${RECOVERY_ZOT_USER:-}${ZOT_USER:-}" ]] || [[ -z "${RECOVERY_ZOT_PASS:-}${ZOT_PASS:-}" ]]; then
|
||
echo "🔐 ci-secrets-smoke: skipped (RECOVERY_ZOT_USER/PASS not set)"
|
||
exit 0
|
||
fi
|
||
echo "🔐 Running credential chain smoke..."
|
||
bash reflection/tests/test_credential_chain.sh
|
||
|
||
# Vault lock concurrency smoke (ADR-017 G1). Same skip-when-unauth behavior.
|
||
ci-vault-lock-smoke:
|
||
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
if [[ -z "${RECOVERY_ZOT_USER:-}${ZOT_USER:-}" ]] || [[ -z "${RECOVERY_ZOT_PASS:-}${ZOT_PASS:-}" ]]; then
|
||
echo "🔐 ci-vault-lock-smoke: skipped (RECOVERY_ZOT_USER/PASS not set)"
|
||
exit 0
|
||
fi
|
||
echo "🔐 Running vault lock concurrency smoke..."
|
||
bash reflection/tests/test_vault_lock.sh
|
||
|
||
# Named-error fixture coverage (15 [error-tag] cases — protocol baseline).
|
||
# Always runs — the fixtures are local, no registry needed.
|
||
ci-secrets-error-fixtures:
|
||
@echo "🔐 Running named-error fixture coverage..."
|
||
nu reflection/tests/test_secrets.nu
|
||
|
||
|
||
|
||
# ==============================================================================
|
||
# Security Auditing
|
||
# ==============================================================================
|
||
|
||
# Run all security audits
|
||
ci-audit: ci-audit-rust
|
||
@echo "✅ All security audits passed!"
|
||
|
||
# Audit Rust dependencies
|
||
ci-audit-rust:
|
||
@echo "🔒 Auditing Rust dependencies..."
|
||
cargo audit
|
||
cargo deny check licenses
|
||
cargo deny check advisories
|
||
|
||
# Run the ontoref protocol audit (⛓G1/A3 harness) — self-description, protocol
|
||
# version chain, manifest coverage, migration discovery, structural (ADR/gate/
|
||
# tools/justfiles) and docsite profiles. Distinct from ci-audit (cargo security
|
||
# audit); exits non-zero iff any Hard criterion fails.
|
||
ci-audit-protocol:
|
||
@echo "🔎 Running ontoref protocol audit..."
|
||
ONTOREF_ACTOR=ci ./ontoref audit
|
||
|
||
# Assert reflection/forms/config.ncl and config.ncl.j2 have matching fields
|
||
ci-check-config-sync:
|
||
@echo "🔍 Checking config form/template sync..."
|
||
nu install/check-config-sync.nu
|
||
|
||
# Generate SBOM
|
||
ci-sbom:
|
||
@echo "📦 Generating Software Bill of Materials..."
|
||
cargo sbom > sbom.json
|
||
@echo "✓ SBOM generated: sbom.json"
|
||
|
||
# ==============================================================================
|
||
# Documentation
|
||
# ==============================================================================
|
||
|
||
# Generate documentation (alias — prefer dev-docs)
|
||
docs:
|
||
just dev-docs
|
||
|
||
# Check documentation — broken intra-doc links are compile errors, not warnings.
|
||
# RUSTDOCFLAGS are inherited by cargo doc; -D flags turn lint groups into hard errors.
|
||
ci-docs:
|
||
RUSTDOCFLAGS="-D rustdoc::broken-intra-doc-links -D rustdoc::private-intra-doc-links" \
|
||
cargo doc --all-features --no-deps --workspace 2>&1
|
||
|
||
# ==============================================================================
|
||
# Pre-commit Setup
|
||
# ==============================================================================
|
||
|
||
# Install pre-commit hooks (alias — prefer dev-setup-hooks)
|
||
setup-hooks:
|
||
just dev-setup-hooks
|
||
|
||
# Run pre-commit on all files (alias — prefer dev-hooks-run-all)
|
||
hooks-run-all:
|
||
just dev-hooks-run-all
|
||
|
||
# ==============================================================================
|
||
# Install
|
||
# ==============================================================================
|
||
|
||
# Build and install ontoref locally (binary + CLI wrapper + data + nulib + config dir).
|
||
# Despite the name, this installs the full ontoref distribution — see install/install.nu.
|
||
install-daemon:
|
||
just build-daemon
|
||
|
||
# Alias for install-daemon — clearer name for the full local install.
|
||
install:
|
||
just install-daemon
|
||
|
||
# ==============================================================================
|
||
# Utility Commands
|
||
# ==============================================================================
|
||
|
||
# Clean build artifacts (alias — prefer dev-clean)
|
||
clean:
|
||
just dev-clean
|