9d42ff33f5
Resolve 8 conflicts, uniting #16's daemonless image-release lane with #14's SCM broker + node-audit boundary. Nothing dropped from either side. - quality_coverage.py / test_quality_coverage_helpers.py: take main's dual-metric gate (line+branch enforced per file at minimum_percent); drop #14's now-dead branch_tracked_files/minimum_branch_percent keys. - quality_contract.json: union all lists (managed_modules, lint_paths, coverage_sources, tracked_files, hygiene globs) so #14's scm-broker, git_pack_objects, receive_pack_scan, deadline_http and node_polkit_audit are branch-checked alongside #16's image-builder modules. - Vault auth (vault_k8s_auth_configure.sh): coexist both role sets. Keep #16's hermes-switchyard split + hermes-jenkins-token-seed; keep #14's hermes-scm-broker role. Preserve #14's security property: hermes-agent no longer holds developer-gitea (broker role carries it). - agent-deployment.yaml / stage_runtime_access.py: keep #16's jenkins-image-build-token injection/staging; keep #14's removal of the agent's gitea-token/gitea-username. - Bump vault-k8s-auth-hermes job -9 -> -10 (and its health check + test) so the merged auth config re-applies over any -9 already in-cluster. - flux hermes dependsOn: union jenkins + hermes-scm-broker + observer-rbac. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
250 lines
9.1 KiB
JSON
250 lines
9.1 KiB
JSON
{
|
|
"required_docs": [
|
|
{
|
|
"path": "README.md",
|
|
"description": "Top-level repository handbook."
|
|
},
|
|
{
|
|
"path": "Jenkinsfile",
|
|
"description": "Top-level Jenkins mirror for multibranch discovery."
|
|
},
|
|
{
|
|
"path": "ci/Jenkinsfile.titan-iac",
|
|
"description": "Canonical titan-iac Jenkins pipeline definition."
|
|
}
|
|
],
|
|
"managed_modules": [
|
|
"ci/scripts/hermes_image_release.py",
|
|
"dockerfiles/hermes-kaniko-heredoc-runner.py",
|
|
"services/harbor/scripts/harbor_hermes_agent_immutability_ensure.py",
|
|
"services/hermes/scripts/jenkins_image_build_trigger.py",
|
|
"ci/scripts/publish_test_metrics.py",
|
|
"ci/scripts/publish_test_metrics_quality.py",
|
|
"ci/scripts/semgrep_report.py",
|
|
"ci/scripts/supply_chain_report.py",
|
|
"services/mailu/scripts/mailu_sync.py",
|
|
"services/mailu/scripts/mailu_sync_listener.py",
|
|
"testing/__init__.py",
|
|
"testing/quality_contract.py",
|
|
"testing/quality_docs.py",
|
|
"testing/quality_hygiene.py",
|
|
"testing/quality_coverage.py",
|
|
"testing/quality_gate.py",
|
|
"ci/tests/glue/test_ariadne_schedules.py",
|
|
"ci/tests/glue/test_glue_metrics.py",
|
|
"testing/tests/test_publish_test_metrics.py",
|
|
"testing/tests/test_supply_chain_report.py",
|
|
"testing/tests/test_semgrep_report.py",
|
|
"testing/tests/test_quality_contract.py",
|
|
"testing/tests/test_quality_gate.py",
|
|
"services/gitea/scripts/gitea_branch_protection_check.py",
|
|
"services/hermes/scm-common/scripts/gitea_api.py",
|
|
"services/hermes/scm-common/scripts/gitea_api_policy.py",
|
|
"services/hermes/scm-common/scripts/scm_broker.py",
|
|
"services/hermes/scm-common/scripts/scm_broker_client.py",
|
|
"services/hermes/scm-common/scripts/scm_broker_io.py",
|
|
"services/hermes/scm-common/scripts/scm_broker_server.py",
|
|
"services/hermes/scripts/hermes_coordinator.py",
|
|
"services/hermes/scripts/node_account_audit.py",
|
|
"services/hermes/scripts/node_account_hardening.py",
|
|
"services/hermes/scripts/node_account_io.py",
|
|
"services/hermes/scripts/stage_runtime_access.py",
|
|
"services/hermes/scm-common/scripts/deadline_http.py",
|
|
"services/hermes/scm-common/scripts/git_pack_objects.py",
|
|
"services/hermes/scm-common/scripts/receive_pack_scan.py",
|
|
"services/hermes/scripts/node_polkit_audit.py"
|
|
],
|
|
"lint_paths": [
|
|
"ci/scripts/hermes_image_release.py",
|
|
"dockerfiles/hermes-kaniko-heredoc-runner.py",
|
|
"services/harbor/scripts/harbor_hermes_agent_immutability_ensure.py",
|
|
"services/hermes/scripts/jenkins_image_build_trigger.py",
|
|
"ci/scripts/publish_test_metrics.py",
|
|
"ci/scripts/publish_test_metrics_quality.py",
|
|
"ci/scripts/semgrep_report.py",
|
|
"ci/tests/glue",
|
|
"scripts/tests",
|
|
"services/comms/scripts/tests",
|
|
"services/mailu/scripts/mailu_sync.py",
|
|
"services/mailu/scripts/mailu_sync_listener.py",
|
|
"testing/tests",
|
|
"testing",
|
|
"services/gitea/scripts/gitea_branch_protection_check.py",
|
|
"services/hermes/scm-common/scripts",
|
|
"services/hermes/scripts/hermes_coordinator.py",
|
|
"services/hermes/scripts/node_account_audit.py",
|
|
"services/hermes/scripts/node_account_hardening.py",
|
|
"services/hermes/scripts/node_account_io.py",
|
|
"services/hermes/scripts/stage_runtime_access.py",
|
|
"services/hermes/scripts/node_polkit_audit.py"
|
|
],
|
|
"pytest_suites": {
|
|
"unit": {
|
|
"description": "Fast unit and contract tests for repo automation.",
|
|
"paths": [
|
|
"scripts/tests",
|
|
"services/comms/scripts/tests",
|
|
"testing/tests"
|
|
],
|
|
"junit": "build/junit-unit.xml",
|
|
"coverage_sources": [
|
|
"ci/scripts",
|
|
"dockerfiles",
|
|
"scripts.render.dashboards_render_atlas",
|
|
"services/harbor/scripts",
|
|
"services/hermes/scripts",
|
|
"services/mailu/scripts",
|
|
"testing",
|
|
"services/gitea/scripts",
|
|
"services/hermes/scm-common/scripts"
|
|
],
|
|
"coverage_xml": "build/coverage-unit.xml"
|
|
},
|
|
"glue": {
|
|
"description": "Cluster-live glue checks that validate CronJobs and exported metrics.",
|
|
"paths": [
|
|
"ci/tests/glue"
|
|
],
|
|
"junit": "build/junit-glue.xml"
|
|
}
|
|
},
|
|
"profiles": {
|
|
"local": [
|
|
"docs",
|
|
"smell",
|
|
"hygiene",
|
|
"unit",
|
|
"coverage"
|
|
],
|
|
"jenkins": [
|
|
"docs",
|
|
"smell",
|
|
"hygiene",
|
|
"unit",
|
|
"coverage",
|
|
"sonarqube",
|
|
"ironbank",
|
|
"glue"
|
|
]
|
|
},
|
|
"manual_scripts": [
|
|
{
|
|
"path": "scripts/manual-tests/test_atlas_user_cleanup.py",
|
|
"description": "Manual cleanup validation for Atlas user lifecycle automation."
|
|
},
|
|
{
|
|
"path": "scripts/manual-tests/test_user_cleanup.py",
|
|
"description": "Manual cleanup validation for shared user lifecycle automation."
|
|
},
|
|
{
|
|
"path": "scripts/manual-tests/test_vaultwarden_user_cleanup.py",
|
|
"description": "Manual cleanup validation for Vaultwarden user lifecycle automation."
|
|
},
|
|
{
|
|
"path": "services/bstein-dev-home/scripts/test_portal_onboarding_flow.py",
|
|
"description": "Portal onboarding end-to-end flow validation with mail delivery checks."
|
|
},
|
|
{
|
|
"path": "services/keycloak/scripts/tests/test_keycloak_execute_actions_email.py",
|
|
"description": "Standalone Keycloak SMTP execute-actions-email validation script."
|
|
},
|
|
{
|
|
"path": "services/keycloak/scripts/tests/test_portal_token_exchange.py",
|
|
"description": "Standalone Keycloak token-exchange validation script."
|
|
}
|
|
],
|
|
"hygiene": {
|
|
"max_lines": 500,
|
|
"line_limit_globs": [
|
|
"testing/**/*.py",
|
|
"ci/scripts/*.py",
|
|
"ci/tests/**/*.py",
|
|
"scripts/tests/**/*.py",
|
|
"services/*/scripts/tests/**/*.py",
|
|
"services/mailu/scripts/mailu_sync.py",
|
|
"services/mailu/scripts/mailu_sync_listener.py",
|
|
"services/gitea/scripts/gitea_branch_protection_check.py",
|
|
"services/hermes/scm-common/scripts/*.py",
|
|
"services/hermes/scripts/hermes_coordinator.py",
|
|
"services/hermes/scripts/node_account_audit.py",
|
|
"services/hermes/scripts/node_account_hardening.py",
|
|
"services/hermes/scripts/node_account_io.py",
|
|
"services/hermes/scripts/stage_runtime_access.py",
|
|
"services/hermes/scripts/node_polkit_audit.py"
|
|
],
|
|
"naming_rules": [
|
|
{
|
|
"glob": "testing/*.py",
|
|
"pattern": "^(?:__init__|quality_[a-z0-9_]+)\\.py$",
|
|
"description": "Top-level testing helpers use quality_* module names."
|
|
},
|
|
{
|
|
"glob": "testing/tests/*.py",
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
"description": "Top-level pytest files use test_*.py names."
|
|
},
|
|
{
|
|
"glob": "ci/tests/**/*.py",
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
"description": "CI pytest files use test_*.py names."
|
|
},
|
|
{
|
|
"glob": "scripts/tests/**/*.py",
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
"description": "Script pytest files use test_*.py names."
|
|
},
|
|
{
|
|
"glob": "scripts/test_*.py",
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
"description": "Standalone script tests use test_*.py names."
|
|
},
|
|
{
|
|
"glob": "services/*/scripts/tests/**/*.py",
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
"description": "Service pytest files use test_*.py names."
|
|
},
|
|
{
|
|
"glob": "services/*/scripts/test_*.py",
|
|
"pattern": "^test_[a-z0-9_]+\\.py$",
|
|
"description": "Standalone service test scripts use test_*.py names."
|
|
}
|
|
]
|
|
},
|
|
"coverage": {
|
|
"minimum_percent": 95.0,
|
|
"tracked_files": [
|
|
"ci/scripts/hermes_image_release.py",
|
|
"dockerfiles/hermes-kaniko-heredoc-runner.py",
|
|
"services/harbor/scripts/harbor_hermes_agent_immutability_ensure.py",
|
|
"services/hermes/scripts/jenkins_image_build_trigger.py",
|
|
"ci/scripts/publish_test_metrics.py",
|
|
"ci/scripts/publish_test_metrics_quality.py",
|
|
"ci/scripts/semgrep_report.py",
|
|
"ci/scripts/supply_chain_report.py",
|
|
"services/mailu/scripts/mailu_sync.py",
|
|
"services/mailu/scripts/mailu_sync_listener.py",
|
|
"testing/quality_contract.py",
|
|
"testing/quality_docs.py",
|
|
"testing/quality_hygiene.py",
|
|
"testing/quality_coverage.py",
|
|
"testing/quality_gate.py",
|
|
"services/gitea/scripts/gitea_branch_protection_check.py",
|
|
"services/hermes/scm-common/scripts/gitea_api.py",
|
|
"services/hermes/scm-common/scripts/gitea_api_policy.py",
|
|
"services/hermes/scm-common/scripts/scm_broker.py",
|
|
"services/hermes/scm-common/scripts/scm_broker_client.py",
|
|
"services/hermes/scm-common/scripts/scm_broker_io.py",
|
|
"services/hermes/scm-common/scripts/scm_broker_server.py",
|
|
"services/hermes/scripts/hermes_coordinator.py",
|
|
"services/hermes/scripts/node_account_audit.py",
|
|
"services/hermes/scripts/node_account_hardening.py",
|
|
"services/hermes/scripts/node_account_io.py",
|
|
"services/hermes/scripts/stage_runtime_access.py",
|
|
"services/hermes/scm-common/scripts/deadline_http.py",
|
|
"services/hermes/scm-common/scripts/git_pack_objects.py",
|
|
"services/hermes/scm-common/scripts/receive_pack_scan.py",
|
|
"services/hermes/scripts/node_polkit_audit.py"
|
|
]
|
|
}
|
|
}
|