DongHyeonkaandClaude Opus 5
ef947e5bb0
외부 리뷰("현재 상태를 유지하기 위한 검증이 너무 많고, 그 검증 자체를
다시 검증하는 구조까지 생겼다")를 설계 문서로 정리하고 코드로 반영한다.
설계·판단 근거는 docs/superpowers/specs/2026-09-16-verification-surface-reduction-design.md.
삭제
- .github/ci-gate-matrix.yml(1,025줄) + verify-gate-matrix.sh(568줄):
Gradle task graph와 workflow graph에 이미 있는 정보의 3중 복제
- verify-gradle-wrapper.sh(799줄): workflow 바이트 해시 잠금.
wrapper 검증은 gradle/actions/wrapper-validation(full SHA 핀)에 위임
- DeveloperExperienceContractTest 등의 CI YAML mutation 테스트:
애플리케이션 test suite가 GitHub Actions YAML 파서를 검증하던 계층 역전
- 문서 drift 파서: verifyReadmeCommands, verifyRunbookReferences,
verifyDocumentedLeafCount, verifyTestSourceSetRegistry
- 빈 레지스트리를 지키던 커스텀 YAML 파서: verifyTrivyignore,
verifyQuarantineSunset, flaky-quarantine.yaml
- verifyConfigurationPropertiesProcessor, verifyOneTypePerFile:
각각 ca.spring-config convention과 Checkstyle OneTopLevelClass가 대체
- 정상 입력으로도 성공할 수 없던 messaging always-fail task
- ModuleRegistry의 JSON 필드 집합 정확 일치, sample-portfolio negative guard
이동
- java/quality/spring 공통 설정을 configure(subprojects) 블록에서
ca.java-conventions / ca.quality-conventions / ca.java-library /
ca.spring-library convention plugin으로
- 아키텍처 검증을 ca.architecture로, JPA·messaging qualification을
gradle/qualification/ 아래로, verifyEnvKeys를 :app-bootstrap 소유로
완화
- Git revision은 releaseCheck·아카이브 생성에서만 요구. 일반 빌드는 SNAPSHOT
- SpotBugs/FindSecBugs는 로컬 check에서 빼고 qualityCheck 레인으로
task 계층
- leaf check는 그 leaf만. architectureCheck / qualityCheck /
configContractCheck / integrationCheck / ci / releaseCheck로 이름 분리
CI
- _reusable-gradle.yml 신규. checkout + wrapper validation + JDK/캐시 공통화
- fileserver-release.yml -> fileserver-certification.yml (CD가 아니라 certification)
- GitHub Actions = CI + artifact, Argo CD = CD 경계를 docs/ci-cd/boundary.md로 고정
순증감 +3,274 / -7,483.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
80 lines
3.4 KiB
YAML
80 lines
3.4 KiB
YAML
name: object-storage-qualification
|
|
|
|
on:
|
|
pull_request:
|
|
schedule:
|
|
- cron: "23 3 * * 2"
|
|
workflow_dispatch:
|
|
inputs:
|
|
run_protected_aws:
|
|
description: Run the protected AWS sandbox qualification lane
|
|
required: true
|
|
default: false
|
|
type: boolean
|
|
# AwsS3DirectTransferQualificationTest requires a second, separate authority
|
|
# (OBJECT_STORAGE_AWS_DIRECT_MUTATION_ENABLED) before the direct-transfer lane may run, and
|
|
# the job never supplied it. objectStorageAwsQualificationTest is a strict qualification task
|
|
# that requires both of its classes, so the lane could not be run to a pass from any input:
|
|
# dispatching it always failed on the missing variable. The authority now exists as its own
|
|
# input rather than as a constant, which is what "separate" was supposed to mean.
|
|
run_protected_aws_direct_mutation:
|
|
description: Also authorize the direct-transfer mutation lane against the sandbox bucket
|
|
required: true
|
|
default: false
|
|
type: boolean
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
TESTCONTAINERS_REUSE_ENABLE: "false"
|
|
|
|
jobs:
|
|
poster-image-v7-migration:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
|
|
- uses: ./.github/actions/setup-gradle-java
|
|
- name: Run non-skipping Poster image migration qualification
|
|
working-directory: src
|
|
run: ./gradlew :sample-portfolio:posterImageMigrationTest --no-daemon --stacktrace
|
|
|
|
minio-managed-contract:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
|
|
- uses: ./.github/actions/setup-gradle-java
|
|
- name: Run exact-release MinIO managed contract
|
|
working-directory: src
|
|
run: ./gradlew :adapter:outbound:objectstorage:objectStorageMinioContractTest --no-daemon --stacktrace
|
|
|
|
minio-managed-fault:
|
|
if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
|
|
- uses: ./.github/actions/setup-gradle-java
|
|
- name: Run digest-pinned MinIO and Toxiproxy fault contract
|
|
working-directory: src
|
|
run: ./gradlew :adapter:outbound:objectstorage:objectStorageMinioFaultTest --no-daemon --stacktrace
|
|
|
|
aws-managed-common-subset:
|
|
if: >-
|
|
github.event_name == 'workflow_dispatch'
|
|
&& inputs.run_protected_aws
|
|
&& inputs.run_protected_aws_direct_mutation
|
|
environment: object-storage-aws-qualification
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
OBJECT_STORAGE_AWS_QUALIFICATION_ENABLED: "true"
|
|
OBJECT_STORAGE_AWS_DIRECT_MUTATION_ENABLED: ${{ inputs.run_protected_aws_direct_mutation }}
|
|
OBJECT_STORAGE_AWS_BUCKET: ${{ secrets.OBJECT_STORAGE_AWS_BUCKET }}
|
|
OBJECT_STORAGE_AWS_REGION: ${{ secrets.OBJECT_STORAGE_AWS_REGION }}
|
|
OBJECT_STORAGE_AWS_EXPECTED_OWNER: ${{ secrets.OBJECT_STORAGE_AWS_EXPECTED_OWNER }}
|
|
steps:
|
|
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # actions/checkout@v4.2.2
|
|
- uses: ./.github/actions/setup-gradle-java
|
|
- name: Run protected AWS common-subset qualification
|
|
working-directory: src
|
|
run: ./gradlew :adapter:outbound:objectstorage:objectStorageAwsQualificationTest --no-daemon --stacktrace
|