290 lines
9.4 KiB
YAML
290 lines
9.4 KiB
YAML
# Current repository CI controls. This file lists only mechanisms and jobs that exist in this
|
|
# checkout. Build/release supply-chain, image, signing, provenance, SBOM, and tag-release jobs are
|
|
# intentionally absent until their later bounded reconstruction.
|
|
#
|
|
# Fields:
|
|
# release_blocking: true, false, or conditional
|
|
# mechanism: gradle-custom-task, gradle-plugin-task, contract-test, workflow-job,
|
|
# or delegated-pending
|
|
# ref: task, plugin@task, repository-relative test path below src/, or workflow job id
|
|
# workflow/job: canonical workflow and job that execute or represent the control
|
|
# execution: check (through Gradle check), explicit (named in the job), or job
|
|
gates:
|
|
- id: format-lint
|
|
release_blocking: true
|
|
mechanism: gradle-plugin-task
|
|
ref: com.diffplug.spotless@spotlessCheck
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: unit-and-contract-tests
|
|
release_blocking: true
|
|
mechanism: gradle-plugin-task
|
|
ref: java@test
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: conditional-transport-qualification
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: conditionalTransportQualification
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: explicit
|
|
- id: clean-architecture-dependencies
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyCleanArchitectureDependencies
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: environment-contract
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyEnvKeys
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: one-type-per-file
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyOneTypePerFile
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: readme-command-drift
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyReadmeCommands
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: trivy-suppression-governance
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyTrivyignore
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: quarantine-sunset
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyQuarantineSunset
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: public-path-snapshot
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyPublicPathSnapshot
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: explicit
|
|
- id: dependency-locks
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: verifyDependencyLocks
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: explicit
|
|
- id: architecture-contract-test
|
|
release_blocking: true
|
|
mechanism: contract-test
|
|
ref: app-bootstrap/src/test/java/dev/caskeleton/bootstrap/architecture/CleanArchitectureTest.java
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
- id: sample-off
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: sampleOffTest
|
|
workflow: ci-quality-gates.yml
|
|
job: sample-off
|
|
execution: explicit
|
|
- id: gate-matrix-lint
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: gate-matrix-lint
|
|
workflow: ci-quality-gates.yml
|
|
job: gate-matrix-lint
|
|
execution: job
|
|
- id: redis-sdk
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: redis-sdk
|
|
workflow: ci-quality-gates.yml
|
|
job: redis-sdk
|
|
execution: job
|
|
- id: jpa-candidate-evidence
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: jpa-candidate-evidence
|
|
workflow: ci-quality-gates.yml
|
|
job: jpa-candidate-evidence
|
|
execution: job
|
|
- id: jpa-r2-evidence
|
|
release_blocking: conditional
|
|
mechanism: workflow-job
|
|
ref: jpa-r2-evidence
|
|
workflow: jpa-r2-evidence.yml
|
|
job: jpa-r2-evidence
|
|
execution: job
|
|
- id: quality-release-gate
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: release-gate
|
|
workflow: ci-quality-gates.yml
|
|
job: release-gate
|
|
execution: job
|
|
- id: flaky-quarantine
|
|
release_blocking: false
|
|
mechanism: workflow-job
|
|
ref: quarantine
|
|
workflow: ci-quality-gates.yml
|
|
job: quarantine
|
|
execution: job
|
|
- id: dependency-review
|
|
release_blocking: conditional
|
|
mechanism: workflow-job
|
|
ref: dependency-review
|
|
workflow: dependency-vulnerability.yml
|
|
job: dependency-review
|
|
execution: job
|
|
- id: dependency-submission
|
|
release_blocking: false
|
|
mechanism: workflow-job
|
|
ref: dependency-submission
|
|
workflow: dependency-vulnerability.yml
|
|
job: dependency-submission
|
|
execution: job
|
|
- id: filesystem-vulnerability-scan
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: trivy-fs
|
|
workflow: dependency-vulnerability.yml
|
|
job: trivy-fs
|
|
execution: job
|
|
- id: documentation-links
|
|
release_blocking: conditional
|
|
mechanism: workflow-job
|
|
ref: lychee
|
|
workflow: link-check.yml
|
|
job: lychee
|
|
execution: job
|
|
- id: object-storage-minio-managed-contract
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: objectStorageMinioContractTest
|
|
workflow: object-storage-qualification.yml
|
|
job: minio-managed-contract
|
|
execution: explicit
|
|
- id: poster-image-migration
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: posterImageMigrationTest
|
|
workflow: object-storage-qualification.yml
|
|
job: poster-image-v7-migration
|
|
execution: explicit
|
|
- id: object-storage-minio-managed-fault
|
|
release_blocking: conditional
|
|
mechanism: gradle-custom-task
|
|
ref: objectStorageMinioFaultTest
|
|
workflow: object-storage-qualification.yml
|
|
job: minio-managed-fault
|
|
execution: explicit
|
|
- id: object-storage-aws-protected-qualification
|
|
release_blocking: conditional
|
|
mechanism: delegated-pending
|
|
ref: approval-gate-b
|
|
workflow: object-storage-qualification.yml
|
|
job: aws-managed-common-subset
|
|
execution: job
|
|
- id: redis-sdk-support-matrix
|
|
release_blocking: true
|
|
mechanism: contract-test
|
|
ref: adapter/outbound/cache-redis/src/test/java/dev/caskeleton/adapter/outbound/cache/redis/sdk/RedisSupportMatrixTest.java
|
|
workflow: ci-quality-gates.yml
|
|
job: quality-gates
|
|
execution: check
|
|
# Promoted from delegated-pending: the workflow is no longer manual-only. A pull request that
|
|
# touches the Redis leaf runs the standalone lane, and the full supported-version x topology
|
|
# matrix runs nightly and on a release candidate. While it was dispatch-only, a release could
|
|
# claim topology evidence that nobody had produced for that commit.
|
|
- id: redis-sdk-topology-evidence
|
|
release_blocking: conditional
|
|
mechanism: workflow-job
|
|
ref: topology-evidence
|
|
workflow: redis-sdk-topology.yml
|
|
job: topology-evidence
|
|
execution: job
|
|
- id: httpclient-stable-contract
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientStableContractTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-security-suite
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientSecurityTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-fault-injection
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientFailureInjectionTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-performance-certification
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientPerformanceTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-spring62-api-surface
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: spring62ApiSurfaceScan
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
# The 6.2 API-surface scan above proves the common packages compile against the older surface. It
|
|
# does not prove they run on it, and the two were being conflated: a lane called
|
|
# "spring62CompatibilityTest" reads as a runtime compatibility proof. The Gradle task is renamed to
|
|
# say what it does, and the runtime claim is registered here as its own delegated-pending control
|
|
# so the gap is a tracked absence rather than an unstated one. Executing it needs a Spring
|
|
# Framework 6.2 distribution resolved into a separate test runtime, which this repository's
|
|
# Boot 4.0 baseline does not carry.
|
|
- id: httpclient-spring62-runtime
|
|
release_blocking: conditional
|
|
mechanism: delegated-pending
|
|
ref: spring62-runtime-lane
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: job
|
|
- id: httpclient-spring70-compatibility
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: spring70CompatibilityTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|
|
- id: httpclient-documentation-drift
|
|
release_blocking: true
|
|
mechanism: workflow-job
|
|
ref: httpclient-documentation
|
|
workflow: httpclient-release.yml
|
|
job: httpclient-documentation
|
|
execution: job
|
|
- id: httpclient-event-loop-blocking
|
|
release_blocking: true
|
|
mechanism: gradle-custom-task
|
|
ref: httpClientBlockHoundTest
|
|
workflow: httpclient-release.yml
|
|
job: release-gate
|
|
execution: explicit
|