34 lines
1.7 KiB
YAML
34 lines
1.7 KiB
YAML
|
# Woodpecker CI — catalog/ (own repo: prvng_extensions.git)
|
||
|
|
#
|
||
|
|
# Self-contained: scripts/witness.nu and .governance/laws.ncl (+laws-schema.ncl,
|
||
|
|
# laws.ncl.minisig, witness.pub) are NATIVE to catalog/ — its own governance,
|
||
|
|
# never vendored from code/ or anywhere else (plural independent consumers of
|
||
|
|
# catalog/ exist beyond this checkout; no consumer needs its own copy of
|
||
|
|
# catalog's own rules). Hidden under .governance/ per code/.claude/
|
||
|
|
# layout_conventions.md's own precedent (tracked, team/agent-facing, not
|
||
|
|
# product docs — same profile as .claude/), not a bespoke visible root
|
||
|
|
# directory. schemas/ IS vendored from code/ (a real cross-repo Nickel-import
|
||
|
|
# dependency) via code/scripts/sync-catalog-schemas.nu — a stopgap
|
||
|
|
# pending the OCI/zot content-addressed distribution this project's own ADR-046
|
||
|
|
# already specifies. See
|
||
|
|
# provisioning/.coder/2026-07-03_laws-catalogo-provisioning.plan.md §8 T4, §11-13.
|
||
|
|
# This job only VERIFIES (public key + check commands); it never signs anything,
|
||
|
|
# so no private key or passphrase is ever needed in CI.
|
||
|
|
#
|
||
|
|
# Tool install mirrors the established pattern in code/.woodpecker/Dockerfile
|
||
|
|
# (rust:latest base + cargo install --locked), not a fresh curl-to-binary approach.
|
||
|
|
# skopeo added for L3 (versions-from-lock) — untested against a live Woodpecker
|
||
|
|
# runner, same honest caveat as the rest of this file (§8 T4).
|
||
|
|
|
||
|
|
when:
|
||
|
|
event: [push, pull_request, manual]
|
||
|
|
|
||
|
|
steps:
|
||
|
|
standing-laws:
|
||
|
|
image: rust:latest
|
||
|
|
commands:
|
||
|
|
- apt-get update -qq && apt-get install -y -qq ripgrep minisign skopeo
|
||
|
|
- cargo install nu nickel-lang-cli --locked
|
||
|
|
- export NICKEL_IMPORT_PATH="$(pwd)"
|
||
|
|
- nu scripts/witness.nu .governance/laws.ncl .governance/receipts/ci.jsonl --pubkey .governance/witness.pub --wo ci
|