DongHyeonkaandClaude Opus 5
e34519113b
가장 큰 것: 문서화된 아키텍처 게이트가 규칙을 하나도 실행하지 않았다. 워크플로 7곳과 CLAUDE.md 가 --tests '*CleanArchitectureTest' 를 지정했으나 그 이름의 클래스는 존재하지 않는다. 4곳은 매칭 0건으로 하드 실패하고, 3곳은 다른 필터와 병기돼 아키텍처 규칙 0개를 돌고 초록으로 통과했다. 필터를 패키지 글롭 dev.caskeleton.bootstrap.architecture.* 로 교체했다. *ArchitectureTest 글롭은 20개 중 12개만 잡고 ArchRuleDiscoveryContractTest 등 8개를 놓치므로 쓰지 않았다. 그 외: - ci-gate-matrix 의 release_blocking 이 강제되지 않아 trivy-fs 가 빨개도 release-gate 가 초록이던 것을 실제 의존으로 연결 - build-logic TestKit 이 어떤 CI 에서도 돌지 않던 것을 ci-quality-gates 에 연결 - jpa-next-* 3개, object-storage, fileserver-pr 의 실패할 수 없거나 트리거되지 않던 잡 정리 - 릴리스 태그 네임스페이스 분열로 v* 태그가 web·websocket 게이트를 건너뛰던 것 수정 - 워크플로 SHA 잠금 28개 재생성 (verify-gradle-wrapper.sh) Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
398 lines
14 KiB
YAML
398 lines
14 KiB
YAML
# Current repository CI controls. This file lists only mechanisms and jobs that exist in this
|
|
# checkout. Build/release supply-chain, image, signing, provenance, SBOM, and tag-release jobs are
|
|
# intentionally absent until their later bounded reconstruction.
|
|
#
|
|
# Fields:
|
|
# release_blocking: true, false, or conditional
|
|
# mechanism: gradle-custom-task, gradle-plugin-task, contract-test, workflow-job,
|
|
# or delegated-pending
|
|
# ref: task, plugin@task, repository-relative test path below src/, or workflow job id
|
|
# workflow/job: canonical workflow and job that execute or represent the control
|
|
# execution: check (through Gradle check), explicit (named in the job), or job
|
|
gates:
|
|
- id: format-lint
|
|
release_blocking: true
|
|
mechanism: gradle-plugin-task
|
|
ref: com.diffplug.spotless@spotlessCheck
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: unit-and-contract-tests
|
|
release_blocking: true
|
|
mechanism: gradle-plugin-task
|
|
ref: java@test
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: conditional-transport-qualification
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: conditionalTransportQualification
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: explicit
|
|
- id: clean-architecture-dependencies
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyCleanArchitectureDependencies
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: environment-contract
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyEnvKeys
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: documented-leaf-count
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyDocumentedLeafCount
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: declared-dependency-absence
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyDependencyPolicy
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: notification-api-surface
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyNotificationApiSurface
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: notification-configuration-contract
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyNotificationConfiguration
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: notification-support-grade-evidence
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyNotificationEvidence
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: runbook-reference-drift
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyRunbookReferences
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: graphql-api-surface
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyGraphQlApiSurface
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: mongo-api-surface
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyMongoApiSurface
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
# The strongest evidence this repository produces, and CI does not run it. Fifteen Compose lanes
|
|
# start real PostgreSQL, MongoDB, Kafka, MinIO, Mailpit and Keycloak, take a real client-credentials
|
|
# JWT, and prove things no in-JVM test can: that all-off boots with no external resource, that the
|
|
# notification handoff delivers exactly once across a restart on the same volume, that the startup
|
|
# log is silent. It runs from a developer's machine via scripts/run-compose-runtime-smoke.sh and
|
|
# from nowhere else — no workflow invokes it, so nothing re-runs it on a pull request.
|
|
#
|
|
# Registered delegated-pending so the gap is a tracked absence rather than an unstated one.
|
|
# Executing it in CI needs a Docker-capable runner and a decision about the minutes fifteen
|
|
# container lanes cost, which is an infrastructure choice rather than a wiring oversight.
|
|
- id: runtime-smoke-matrix
|
|
release_blocking: conditional
|
|
mechanism: delegated-pending
|
|
ref: runtime-smoke-matrix-lane
|
|
workflow: ci-quality-gates.yml
|
|
job: release-gate
|
|
execution: job
|
|
# `conditional-transport-qualification` above is the registered GraphQL control, and it is a
|
|
# boundary test: a @SpringBootTest over a nested test application with in-memory Basic Auth. Its own
|
|
# javadoc says so — "the nested application deliberately owns only test authentication and CORS
|
|
# policy". That is a legitimate transport-boundary proof and it is not release evidence for the
|
|
# security posture, which is the distinction the Definition of Done draws.
|
|
#
|
|
# The real proof exists: the local-graphql Compose lane obtains a Keycloak client-credentials token
|
|
# and posts it to /graphql on the running bootJar, asserting that anonymous and malformed
|
|
# credentials are refused and the authenticated query answers. It is part of the runtime smoke
|
|
# matrix above, so it inherits that control's pending status rather than having none of its own.
|
|
- id: graphql-runtime-jwt
|
|
release_blocking: conditional
|
|
mechanism: delegated-pending
|
|
ref: graphql-runtime-jwt-lane
|
|
workflow: ci-quality-gates.yml
|
|
job: release-gate
|
|
execution: job
|
|
- id: one-type-per-file
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyOneTypePerFile
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: readme-command-drift
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyReadmeCommands
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: trivy-suppression-governance
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyTrivyignore
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: quarantine-sunset
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyQuarantineSunset
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: public-path-snapshot
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyPublicPathSnapshot
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: explicit
|
|
- id: dependency-locks
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyDependencyLocks
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: explicit
|
|
# Points at the inventory guard rather than at one suite. The 87 architecture rules used to be
|
|
# 74-in-one-class plus a scattered remainder, so naming CleanArchitectureTest.java named most of
|
|
# them and silently omitted the rest; after the split (BOOT-012) it would have named a fifth of
|
|
# them. ArchRuleDiscoveryContractTest pins every rule in the package by name and fails if one is
|
|
# declared where ArchUnit cannot discover it, which is the property this gate actually exists to
|
|
# protect.
|
|
- id: architecture-contract-test
|
|
release_blocking: true
|
|
mechanism: contract-test
|
|
ref: app-bootstrap/src/test/java/dev/caskeleton/bootstrap/architecture/ArchRuleDiscoveryContractTest.java
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: sample-off
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: sampleOffTest
|
|
workflow: ci-quality-gates.yml
|
|
job: sample-off
|
|
execution: explicit
|
|
- id: gate-matrix-lint
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: gate-matrix-lint
|
|
workflow: ci-quality-gates.yml
|
|
job: gate-matrix-lint
|
|
execution: job
|
|
- id: redis-sdk
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: redis-sdk
|
|
workflow: ci-quality-gates.yml
|
|
job: redis-sdk
|
|
execution: job
|
|
- id: jpa-candidate-evidence
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: jpa-candidate-evidence
|
|
workflow: ci-quality-gates.yml
|
|
job: jpa-candidate-evidence
|
|
execution: job
|
|
- id: jpa-r2-evidence
|
|
release_blocking: conditional
|
|
mechanism: workflow-job
|
|
ref: jpa-r2-evidence
|
|
workflow: jpa-r2-evidence.yml
|
|
job: jpa-r2-evidence
|
|
execution: job
|
|
- id: quality-release-gate
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: release-gate
|
|
workflow: ci-quality-gates.yml
|
|
job: release-gate
|
|
execution: job
|
|
- id: flaky-quarantine
|
|
release_blocking: false
|
|
mechanism: workflow-job
|
|
ref: quarantine
|
|
workflow: ci-quality-gates.yml
|
|
job: quarantine
|
|
execution: job
|
|
- id: dependency-review
|
|
release_blocking: conditional
|
|
mechanism: workflow-job
|
|
ref: dependency-review
|
|
workflow: dependency-vulnerability.yml
|
|
job: dependency-review
|
|
execution: job
|
|
- id: dependency-submission
|
|
release_blocking: false
|
|
mechanism: workflow-job
|
|
ref: dependency-submission
|
|
workflow: dependency-vulnerability.yml
|
|
job: dependency-submission
|
|
execution: job
|
|
- id: filesystem-vulnerability-scan
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: trivy-fs
|
|
workflow: dependency-vulnerability.yml
|
|
job: trivy-fs
|
|
execution: job
|
|
- id: documentation-links
|
|
release_blocking: conditional
|
|
mechanism: workflow-job
|
|
ref: lychee
|
|
workflow: link-check.yml
|
|
job: lychee
|
|
execution: job
|
|
- id: object-storage-minio-managed-contract
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: objectStorageMinioContractTest
|
|
workflow: object-storage-qualification.yml
|
|
job: minio-managed-contract
|
|
execution: explicit
|
|
- id: poster-image-migration
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: posterImageMigrationTest
|
|
workflow: object-storage-qualification.yml
|
|
job: poster-image-v7-migration
|
|
execution: explicit
|
|
- id: object-storage-minio-managed-fault
|
|
release_blocking: conditional
|
|
mechanism: gradle-custom-task
|
|
ref: objectStorageMinioFaultTest
|
|
workflow: object-storage-qualification.yml
|
|
job: minio-managed-fault
|
|
execution: explicit
|
|
- id: object-storage-aws-protected-qualification
|
|
release_blocking: conditional
|
|
mechanism: delegated-pending
|
|
ref: approval-gate-b
|
|
workflow: object-storage-qualification.yml
|
|
job: aws-managed-common-subset
|
|
execution: job
|
|
- id: redis-sdk-support-matrix
|
|
release_blocking: true
|
|
mechanism: contract-test
|
|
ref: adapter/outbound/cache-redis/src/test/java/dev/caskeleton/adapter/outbound/cache/redis/sdk/RedisSupportMatrixTest.java
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
# Promoted from delegated-pending: the workflow is no longer manual-only. A pull request that
|
|
# touches the Redis leaf runs the standalone lane, and the full supported-version x topology
|
|
# matrix runs nightly and on a release candidate. While it was dispatch-only, a release could
|
|
# claim topology evidence that nobody had produced for that commit.
|
|
- id: redis-sdk-topology-evidence
|
|
release_blocking: conditional
|
|
mechanism: workflow-job
|
|
ref: topology-evidence
|
|
workflow: redis-sdk-topology.yml
|
|
job: topology-evidence
|
|
execution: job
|
|
- id: httpclient-stable-contract
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientStableContractTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-security-suite
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientSecurityTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-fault-injection
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientFailureInjectionTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-performance-certification
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientPerformanceTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-spring62-api-surface
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: spring62ApiSurfaceScan
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
# The 6.2 API-surface scan above proves the common packages compile against the older surface. It
|
|
# does not prove they run on it, and the two were being conflated: a lane called
|
|
# "spring62CompatibilityTest" reads as a runtime compatibility proof. The Gradle task is renamed to
|
|
# say what it does, and the runtime claim is registered here as its own delegated-pending control
|
|
# so the gap is a tracked absence rather than an unstated one. Executing it needs a Spring
|
|
# Framework 6.2 distribution resolved into a separate test runtime, which this repository's
|
|
# Boot 4.0 baseline does not carry.
|
|
- id: httpclient-spring62-runtime
|
|
release_blocking: conditional
|
|
mechanism: delegated-pending
|
|
ref: spring62-runtime-lane
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: job
|
|
- id: httpclient-spring70-compatibility
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: spring70CompatibilityTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-documentation-drift
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: httpclient-documentation
|
|
workflow: httpclient-release.yml
|
|
job: httpclient-documentation
|
|
execution: job
|
|
- id: httpclient-event-loop-blocking
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientBlockHoundTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
# The messaging platform's only claim that needs a real broker to be true. The gate is the
|
|
# evidence check rather than the lane, and it depends on the lane: passing means both that every
|
|
# fault scenario produced the outcome the shared contract fixes and that the committed manifest is
|
|
# what this run wrote. Before it existed, `CertifiedEvidence` was a hand-authored list and
|
|
# "certified against a live broker" was a sentence a developer could type.
|
|
- id: messaging-broker-certification
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyMessagingCertificationEvidence
|
|
workflow: messaging-certification.yml
|
|
job: broker-certification
|
|
execution: explicit
|