From 79a35183aa80eff56647aef6da25b644f586012a Mon Sep 17 00:00:00 2001 From: Codex Date: Mon, 6 Jul 2026 15:32:08 +0000 Subject: [PATCH] docs: standardize gitea pac cicd architecture --- .agents/skills/unidesk-cicd/SKILL.md | 8 +++- .../references/branch-follower.md | 15 ++++--- .../unidesk-cicd/references/gitea-pac.md | 43 +++++++++++++++++++ .../unidesk-cicd/references/platform-ops.md | 2 +- config/cicd-branch-followers.yaml | 4 +- config/cicd-gitea-actions-poc.yaml | 18 +++++--- config/platform-infra/gitea.yaml | 13 ++++-- config/platform-infra/pipelines-as-code.yaml | 8 +++- docs/reference/platform-infra.md | 4 +- scripts/src/cicd-branch-follower.ts | 14 +++--- scripts/src/cicd-gitea-actions-poc.ts | 28 ++++++++---- scripts/src/cicd-help.ts | 20 ++++----- scripts/src/cicd-render.ts | 21 ++++++--- scripts/src/cicd.ts | 11 +++-- scripts/src/platform-infra-gitea.ts | 10 ++--- .../src/platform-infra-pipelines-as-code.ts | 24 +++++++++++ 16 files changed, 180 insertions(+), 63 deletions(-) create mode 100644 .agents/skills/unidesk-cicd/references/gitea-pac.md diff --git a/.agents/skills/unidesk-cicd/SKILL.md b/.agents/skills/unidesk-cicd/SKILL.md index db06225c..2e0a55e3 100644 --- a/.agents/skills/unidesk-cicd/SKILL.md +++ b/.agents/skills/unidesk-cicd/SKILL.md @@ -19,6 +19,7 @@ bun scripts/cli.ts platform-infra gitea mirror status --target JD01 bun scripts/cli.ts platform-infra gitea mirror webhook status --target JD01 bun scripts/cli.ts platform-infra gitea mirror webhook test --target JD01 --repo unidesk-master --confirm bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01 +bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01 --consumer hwlab-jd01-v03 bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10 bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --id bun scripts/cli.ts cicd branch-follower status @@ -30,6 +31,7 @@ bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel - PR monitor 与自动合并: [references/pr-monitor.md](references/pr-monitor.md)。 - Tekton/Argo、node-scoped runtime lane、D601 infra bootstrap: [references/control-plane.md](references/control-plane.md)。 - HWLAB/AgentRun git-mirror source authority 与 flush: [references/git-mirror.md](references/git-mirror.md)。 +- JD01 Gitea mirror + Pipelines-as-Code 正式架构、三 consumer 覆盖矩阵和旧入口处置: [references/gitea-pac.md](references/gitea-pac.md)。 - AgentRun/HWLAB env reuse 机制、证据解释和 PaC status/history 观察口径: [references/env-reuse.md](references/env-reuse.md)。 - Secret、observability、platform-infra、CI tools image、PipelineRun 清理和 rollout 补记: [references/platform-ops.md](references/platform-ops.md)。 - AgentRun YAML-only lane、v0.1 兼容入口和 AgentRun git-mirror: [references/agentrun.md](references/agentrun.md)。 @@ -38,9 +40,10 @@ bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel ## P0 边界 - CI/CD、GitOps、rollout、PipelineRun、Argo、git-mirror 和 AgentRun 部署必须走受控 CLI；不要用裸 `kubectl`、`argo`、`tkn`、`curl` 当正式控制入口。 -- CI/CD source authority 只能来自 YAML 声明的 Kubernetes 托管 source authority：legacy lane 使用 k8s git-mirror snapshot，迁移 lane 使用 Gitea controlled mirror + immutable snapshot ref。受控命令先在 k8s 内同步/创建不可变 `refs/unidesk/snapshots/.../` stage ref；build/status/publish 只消费该 snapshot，host worktree、本地 `git fetch/pull`、可变 branch ref 或 Pipeline 内直连 GitHub 都不能作为 authoritative source。 +- CI/CD source authority 只能来自 YAML 声明的 Kubernetes 托管 source authority：legacy lane 使用 k8s git-mirror snapshot，JD01 migrated lane 使用 Gitea controlled mirror + immutable snapshot ref + Pipelines-as-Code。受控命令先在 k8s 内同步/创建不可变 `refs/unidesk/snapshots/.../` stage ref；build/status/publish 只消费该 snapshot，host worktree、本地 `git fetch/pull`、可变 branch ref 或 Pipeline 内直连 GitHub 都不能作为 authoritative source。 +- JD01 `agentrun-jd01-v02`、`sentinel-jd01-v03`、`hwlab-jd01-v03` 的正式 CI/CD closeout 入口是 `platform-infra pipelines-as-code status|history --target JD01`。`cicd branch-follower` 和 `cicd gitea-actions-poc` 对这三者只保留历史/迁移只读用途，不得作为当前交付判断入口。 - GitHub/Git 相关 egress 必须走 YAML-first host proxy/sourceRef：branch-follower controller 读 `config/cicd-branch-followers.yaml#controller.source.githubSsh`，runtime legacy git-mirror 读 owning lane/control-plane YAML 的 host proxy 和 `githubTransport`，Gitea/PaC 迁移 lane 读 `config/platform-infra/gitea.yaml` 与 `config/platform-infra/pipelines-as-code.yaml`；禁止依赖未声明 host env、trans proxy、裸直连 GitHub 或 CLI 输出解析。 -- Gitea 迁移 lane 的 GitHub -> Gitea 自动同步必须用 `platform-infra gitea mirror webhook apply|status|test`。该路径是单向同步，只更新 Gitea branch 和 immutable snapshot ref；不得引入 Gitea -> GitHub 回写、轮询 fallback 或第二套状态存储。 +- Gitea/PaC lane 的 GitHub -> Gitea 自动同步必须用 `platform-infra gitea mirror webhook apply|status|test`。该路径是单向同步，只更新 Gitea branch 和 immutable snapshot ref；不得引入 Gitea -> GitHub 回写、轮询 fallback、Gitea Actions/act_runner fallback 或第二套状态存储。 - Gitea webhook/FRPC/Caddy 变更的 closeout 必须看受控 CLI 的 rollout/status/test 证据；Secret 或 ConfigMap apply 成功不等于 connector Pod 已加载新 proxy/path。 - `cicd branch-follower` 的自动跟随全过程不得读取或挂载 host worktree、target dev dir、`.worktree/*` 或 local git checkout；controller pod/一次性 reconcile Job 只能用 k8s git-mirror cache、Tekton PipelineRun、Argo Application、runtime workload 和 EmptyDir 执行，状态以 K8s ConfigMap/Lease 承载的 native observation 为准，不得解析下游 CLI 输出。 - k8s 运行面从拉取已构建镜像开始必须 0 Docker；CI 构建面可以使用 YAML 声明的原生构建工具，但不得把 Docker socket、Docker daemon 或 host Docker 带入运行面。 @@ -68,6 +71,7 @@ bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel - 手动触发、定点 PipelineRun/source commit、RBAC/Pipeline/Argo、node-scoped runtime lane：读 [references/control-plane.md](references/control-plane.md)。 - git-mirror source authority 或 flush：读 [references/git-mirror.md](references/git-mirror.md)。 - AgentRun/HWLAB env reuse、`IMAGE_STATUS=reused`、`ENV_REUSE=hit`、`skipped,skip=` 或 PaC history/status 解释：读 [references/env-reuse.md](references/env-reuse.md)。 +- JD01 三运行面 Gitea+PaC 覆盖、旧 branch-follower/Gitea Actions POC 处置和 closeout 顺序：读 [references/gitea-pac.md](references/gitea-pac.md)。 - Secret、observability、CI tools image、PipelineRun/PV 清理：读 [references/platform-ops.md](references/platform-ops.md)。 - AgentRun v0.1 或 YAML-only lane 部署：读 [references/agentrun.md](references/agentrun.md)。 - 三运行面 branch follower 自动跟随、`apply/status/run-once/events/logs`：读 [references/branch-follower.md](references/branch-follower.md)。 diff --git a/.agents/skills/unidesk-cicd/references/branch-follower.md b/.agents/skills/unidesk-cicd/references/branch-follower.md index 69995d0b..9febf1cc 100644 --- a/.agents/skills/unidesk-cicd/references/branch-follower.md +++ b/.agents/skills/unidesk-cicd/references/branch-follower.md @@ -2,11 +2,16 @@ SPEC: PJ2026-01060703 CI/CD branch follower draft-2026-07-03-p0-branch-follower +## Retired Scope + +For JD01 `agentrun-jd01-v02`, `sentinel-jd01-v03` and `hwlab-jd01-v03`, branch-follower is retired as a delivery authority. The current architecture is Gitea mirror + Pipelines-as-Code + Tekton + Argo; use [gitea-pac.md](gitea-pac.md) for closeout commands and coverage. + +The commands below remain historical/migration diagnostics. They must not be used to decide current delivery success for the three migrated JD01 consumers. + ## Entrypoints ```bash bun scripts/cli.ts cicd branch-follower plan -bun scripts/cli.ts cicd branch-follower apply --confirm --wait bun scripts/cli.ts cicd branch-follower status bun scripts/cli.ts cicd branch-follower status --live bun scripts/cli.ts cicd branch-follower run-once --all --dry-run @@ -21,7 +26,7 @@ bun scripts/cli.ts cicd branch-follower logs --follower bun scripts/cli.ts cicd branch-follower gate --follower hwlab-jd01-v03 --gate control-plane-refresh --source-commit --confirm --json ``` -`apply --confirm --wait` is the one-command deploy/update entry for the K8s controller. `status` is the default intermediate-state query. `status --live` and local `run-once` submit a bounded K8s reconcile Job; the Job performs all source, Tekton, Argo and runtime reads inside the cluster and may write only the compact state summary. `events` and `logs` are read-only drill-downs for the same Kubernetes-native state. `run-once --confirm --wait` is the manual one-command trigger and closeout path. +Historically, `apply --confirm --wait` deployed the K8s controller and `run-once --confirm --wait` was the manual trigger and closeout path. For the migrated JD01 consumers this is no longer the formal delivery path. `status`, `events`, `logs` and `debug-step` are retained only to inspect or retire old state. `debug-step` is the required single-step troubleshooting entry before changing branch-follower code for repeated CI/CD convergence issues. It runs in a bounded target-side Job when called from the operator host, and uses the same controller modules as the real flow: @@ -105,11 +110,11 @@ Timeout, TTL, retry/backoff, reconcile interval and end-to-end budget values mus ## First Followers -- `hwlab-jd01-v03`: follows `pikasTech/HWLAB@v0.3`, adapter `hwlab-node-runtime`, native trigger `Tekton PipelineRun -> Argo Application closeout -> runtime Deployment sourceCommit readiness`. -- `agentrun-jd01-v02`: historical first follower only. This lane has migrated to Gitea webhook -> Pipelines-as-Code -> Tekton -> GitOps/Argo -> runtime readiness; do not re-enable branch-follower, act_runner or custom trigger fallback for it. Current operation lives in `config/platform-infra/gitea.yaml`, `config/platform-infra/pipelines-as-code.yaml` and [agentrun.md](agentrun.md). +- `hwlab-jd01-v03`: historical follower only. This lane has migrated to Gitea webhook -> Pipelines-as-Code consumer `hwlab-jd01-v03` -> Tekton -> GitOps/Argo -> runtime readiness; do not re-enable branch-follower, Gitea Actions, act_runner or custom trigger fallback for it. +- `agentrun-jd01-v02`: historical first follower only. This lane has migrated to Gitea webhook -> Pipelines-as-Code -> Tekton -> GitOps/Argo -> runtime readiness; do not re-enable branch-follower, act_runner or custom trigger fallback for it. Current operation lives in `config/platform-infra/gitea.yaml`, `config/platform-infra/pipelines-as-code.yaml`, [gitea-pac.md](gitea-pac.md) and [agentrun.md](agentrun.md). - `web-probe-sentinel-master`: historical follower only. This lane has migrated to Gitea webhook -> Pipelines-as-Code consumer `sentinel-jd01-v03` -> Tekton publish -> GitOps/Argo -> runtime readiness; do not re-enable branch-follower, Gitea Actions, act_runner or custom fallback for it. -These entries describe the initial production set and migration history. HWLAB still runs on JD01 through branch-follower unless YAML changes; AgentRun JD01 v0.2 and Web 哨兵 JD01 now use the PaC/Gitea path. +These entries describe the initial production set and migration history. Current JD01 closeout for all three consumers uses the PaC/Gitea path. ## Reuse And Mirror Contract diff --git a/.agents/skills/unidesk-cicd/references/gitea-pac.md b/.agents/skills/unidesk-cicd/references/gitea-pac.md new file mode 100644 index 00000000..fe69e88b --- /dev/null +++ b/.agents/skills/unidesk-cicd/references/gitea-pac.md @@ -0,0 +1,43 @@ +# Gitea + Pipelines-as-Code + +JD01 migrated CI/CD uses one formal path: + +```text +GitHub push -> Gitea controlled mirror -> Pipelines-as-Code Repository webhook -> Tekton PipelineRun -> GitOps/Argo -> k8s runtime +``` + +Do not add Gitea Actions, `act_runner`, branch-follower, host worktree, direct GitHub-in-Pipeline, or custom script fallback for the migrated JD01 consumers. Gitea Actions material under `config/cicd-gitea-actions-poc.yaml` is archived read-only POC context only. + +## Source Of Truth + +- Gitea source authority, GitHub webhook bridge, public exposure and source snapshots: `config/platform-infra/gitea.yaml`. +- PaC controller, Repository CRs, consumer parameters, Tekton pipeline names and Argo applications: `config/platform-infra/pipelines-as-code.yaml`. +- Historical snapshot prefixes containing `gitea-actions` are retained only for existing refs. They do not mean Gitea Actions is the active trigger architecture. + +## Coverage Matrix + +| Consumer | Source | PaC namespace | Pipeline | Argo application | Status | +|---|---|---|---|---|---| +| `agentrun-jd01-v02` | `pikasTech/agentrun@v0.2` | `agentrun-ci` | `agentrun-jd01-v02-ci-image-publish` | `agentrun-jd01-v02` | `platform-infra pipelines-as-code status --target JD01 --consumer agentrun-jd01-v02` | +| `sentinel-jd01-v03` | `pikasTech/unidesk@master` | `devops-infra` | `hwlab-web-probe-sentinel-jd01-pac` | `hwlab-web-probe-sentinel-jd01` | `platform-infra pipelines-as-code status --target JD01 --consumer sentinel-jd01-v03` | +| `hwlab-jd01-v03` | `pikasTech/HWLAB@v0.3` | `hwlab-ci` | `hwlab-jd01-v03-ci-image-publish` | `hwlab-node-v03` | `platform-infra pipelines-as-code status --target JD01 --consumer hwlab-jd01-v03` | + +Use `bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10` for all-consumer trigger, timing and reuse audit. It must read live Gitea Repository CR plus Tekton PipelineRun/TaskRun objects on JD01, aggregate on the target side, and print `READ_ERRORS`. + +## Closeout Order + +1. `bun scripts/cli.ts platform-infra gitea mirror status --target JD01` +2. `bun scripts/cli.ts platform-infra gitea mirror webhook status --target JD01` +3. `bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01 --consumer ` +4. `bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --consumer --limit 10` +5. For ambiguous rows, drill into the PipelineRun with `bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --id `. + +Do not use `cicd branch-follower status` to decide whether the three migrated JD01 consumers are current. It is historical/migration-only and may contain stale state from before PaC cutover. + +## Reuse Interpretation + +- AgentRun `IMAGE_STATUS=reused` means the image build was skipped or registry artifact was reused for the same env identity. +- Sentinel `ENV_REUSE=hit` means dependency reuse was available; `cache=hit` is separate BuildKit evidence. +- HWLAB `skipped,skip=` means service-level artifact planning skipped reusable builds; inspect the PipelineRun detail when deciding which service changed. + +Missing reuse text is not proof of a failed reuse path. Check the consumer type and PipelineRun detail first. diff --git a/.agents/skills/unidesk-cicd/references/platform-ops.md b/.agents/skills/unidesk-cicd/references/platform-ops.md index 842cf209..ddd22874 100644 --- a/.agents/skills/unidesk-cicd/references/platform-ops.md +++ b/.agents/skills/unidesk-cicd/references/platform-ops.md @@ -46,7 +46,7 @@ bun scripts/cli.ts platform-infra wechat-archive plan|apply|status|validate|pull bun scripts/cli.ts platform-infra wechat-archive wcf-host-status|collector-plan|collector-apply|collector-status ``` -`platform-infra` 是 UniDesk 运维的平台基础设施控制面；新增平台服务优先进入该命名空间或对应 YAML 声明目标，旧 `devops-infra` 只作为渐进迁移来源。Sub2API 日常部署、Codex pool、FRP 暴露、master `~/.codex` 配置、验收和排障统一使用 `$unidesk-sub2api`。Gitea mirror 和 Pipelines-as-Code 是迁移后的 CI source/trigger 平台服务，source-of-truth 分别是 `config/platform-infra/gitea.yaml` 和 `config/platform-infra/pipelines-as-code.yaml`；PaC status 是 migrated lane closeout 入口，PaC history 是触发/耗时/env reuse 审计入口，默认输出必须包含 `READ_ERRORS` 并在目标 node 聚合，不能把读取失败或 namespace 过大误报为空表成功。不用 Gitea Actions、act_runner、branch-follower 或自维护脚本兜底。`agentrun-jd01-v02` 是默认 consumer；哨兵使用 `--consumer sentinel-jd01-v03` 查看 PaC/Tekton/Argo/env reuse 证据。WeChat archive 是 platform-infra 的 YAML-first 工作流入口；只读 collector 的副本、镜像、WCF host、端口和版本 pin 都以 YAML 为准。 +`platform-infra` 是 UniDesk 运维的平台基础设施控制面；新增平台服务优先进入该命名空间或对应 YAML 声明目标，旧 `devops-infra` 只作为渐进迁移来源。Sub2API 日常部署、Codex pool、FRP 暴露、master `~/.codex` 配置、验收和排障统一使用 `$unidesk-sub2api`。Gitea mirror 和 Pipelines-as-Code 是 JD01 migrated CI source/trigger 平台服务，source-of-truth 分别是 `config/platform-infra/gitea.yaml` 和 `config/platform-infra/pipelines-as-code.yaml`；正式架构和三 consumer 矩阵见 [gitea-pac.md](gitea-pac.md)。PaC status 是 migrated lane closeout 入口，PaC history 是触发/耗时/env reuse 审计入口，默认输出必须包含 `READ_ERRORS` 并在目标 node 聚合，不能把读取失败或 namespace 过大误报为空表成功。不用 Gitea Actions、act_runner、branch-follower 或自维护脚本兜底。`agentrun-jd01-v02` 是默认 consumer；哨兵使用 `--consumer sentinel-jd01-v03`，HWLAB 使用 `--consumer hwlab-jd01-v03` 查看 PaC/Tekton/Argo/env reuse 证据。WeChat archive 是 platform-infra 的 YAML-first 工作流入口；只读 collector 的副本、镜像、WCF host、端口和版本 pin 都以 YAML 为准。 ## CI Tools Image diff --git a/config/cicd-branch-followers.yaml b/config/cicd-branch-followers.yaml index e2e90e19..75732aa2 100644 --- a/config/cicd-branch-followers.yaml +++ b/config/cicd-branch-followers.yaml @@ -66,9 +66,9 @@ followers: repository: pikasTech/HWLAB branch: v0.3 branchRef: config/hwlab-node-lanes.yaml#lanes.v03.sourceBranch - authorityRef: config/platform-infra/gitea.yaml#sourceAuthority.repositories.hwlab-jd01-v03 + authorityRef: config/platform-infra/gitea.yaml#sourceAuthority.repositories snapshotPrefix: refs/unidesk/snapshots/gitea-actions/hwlab-node-runtime/v0.3 - snapshotRef: config/platform-infra/gitea.yaml#sourceAuthority.repositories.hwlab-jd01-v03.snapshot.prefix + snapshotRef: config/platform-infra/gitea.yaml#sourceAuthority.repositories target: node: JD01 lane: v03 diff --git a/config/cicd-gitea-actions-poc.yaml b/config/cicd-gitea-actions-poc.yaml index a497fde8..702825ec 100644 --- a/config/cicd-gitea-actions-poc.yaml +++ b/config/cicd-gitea-actions-poc.yaml @@ -1,16 +1,18 @@ -# SPEC: GH-1548 Gitea mirror/Actions visibility and controlled Docker builder POC +# SPEC: GH-1548 archived Gitea Actions POC; GH-1560 active path is Gitea mirror + Pipelines-as-Code. apiVersion: unidesk.pikapython.com/v1alpha1 kind: CicdGiteaActionsPoc metadata: id: gitea-actions-builder-poc owner: UniDesk issue: https://github.com/pikasTech/unidesk/issues/1548 - specRef: GH-1548 - version: draft-2026-07-05-p0-gitea-actions-builder-poc + specRef: GH-1548/GH-1560 + version: archived-2026-07-06-gitea-actions-poc + status: archived-readonly + replacement: config/platform-infra/pipelines-as-code.yaml spec: scope: - phase: p1-spec-p2-poc + phase: archived-readonly productionFollowerReplacement: false rolloutEnabled: false rolloutMode: diagnostic-only @@ -19,12 +21,14 @@ spec: migration: issue: https://github.com/pikasTech/unidesk/issues/1549 - primaryEntrypoint: bun scripts/cli.ts cicd gitea-actions-poc plan - replacementTarget: gitea-actions-driven-cicd + activeCloseoutIssue: https://github.com/pikasTech/unidesk/issues/1560 + primaryEntrypoint: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01 + replacementTarget: gitea-pac-driven-cicd + archivedEntrypoint: bun scripts/cli.ts cicd gitea-actions-poc plan branchFollower: status: deprecated mode: migration-only - reason: self-maintained branch observation and controller state machine are being replaced by Gitea mirror and Gitea Actions. + reason: self-maintained branch observation and controller state machine have been replaced for JD01 consumers by Gitea mirror and Pipelines-as-Code. allowedDuringMigration: - read-only-status - debug-migration-evidence diff --git a/config/platform-infra/gitea.yaml b/config/platform-infra/gitea.yaml index b0112bdd..efa32086 100644 --- a/config/platform-infra/gitea.yaml +++ b/config/platform-infra/gitea.yaml @@ -4,23 +4,27 @@ kind: platform-infra-gitea metadata: id: gitea-internal-mirror owner: unidesk - spec: GH-1548/GH-1550 + spec: GH-1548/GH-1550/GH-1560 relatedIssues: - 1548 - 1549 - 1550 - 1557 + - 1560 defaults: targetId: JD01 migration: - role: gitea-actions-driven-cicd-source-authority + role: gitea-pac-cicd-source-authority replaces: branch-follower-self-maintained-branch-observer parentConfigRef: config/cicd-gitea-actions-poc.yaml#spec.sourceAuthority.giteaMirror + archivedPocRef: config/cicd-gitea-actions-poc.yaml + activePacConfigRef: config/platform-infra/pipelines-as-code.yaml envReusePolicy: preserve-existing-runtime-env-reuse buildPlane: controlled-docker-or-buildkit-outside-runtime runtimePlane: k3s-gitea-service-zero-docker + activeTriggerPath: gitea-webhook-to-pipelines-as-code-to-tekton-to-argo sourceAuthority: enabled: true @@ -113,6 +117,7 @@ sourceAuthority: branch: jd01-v0.2-gitops flushDisposition: retained-for-gitops-flush snapshot: + naming: historical-gitea-actions-prefix-retained-for-existing-refs prefix: refs/unidesk/snapshots/gitea-actions/agentrun-v0.2 legacyGitMirror: readUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/agentrun.git @@ -134,6 +139,7 @@ sourceAuthority: branch: master flushDisposition: not-a-gitops-branch snapshot: + naming: historical-gitea-actions-prefix-retained-for-existing-refs prefix: refs/unidesk/snapshots/gitea-actions/unidesk-master legacyGitMirror: readUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/unidesk.git @@ -155,6 +161,7 @@ sourceAuthority: branch: v0.3-gitops flushDisposition: retained-for-gitops-flush snapshot: + naming: historical-gitea-actions-prefix-retained-for-existing-refs prefix: refs/unidesk/snapshots/gitea-actions/hwlab-node-runtime/v0.3 legacyGitMirror: readUrl: http://git-mirror-http.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git @@ -165,7 +172,7 @@ targets: - id: JD01 route: JD01:k3s namespace: devops-infra - role: active-poc + role: active-source-authority enabled: true createNamespace: true storageClassName: local-path diff --git a/config/platform-infra/pipelines-as-code.yaml b/config/platform-infra/pipelines-as-code.yaml index fb4b255a..9595a695 100644 --- a/config/platform-infra/pipelines-as-code.yaml +++ b/config/platform-infra/pipelines-as-code.yaml @@ -4,11 +4,12 @@ kind: platform-infra-pipelines-as-code metadata: id: pac-gitea-consumers owner: unidesk - spec: GH-1552/GH-1555 + spec: GH-1552/GH-1555/GH-1560 relatedIssues: - 1552 - 1555 - 1557 + - 1560 defaults: targetId: JD01 @@ -29,7 +30,7 @@ targets: - id: JD01 route: JD01:k3s namespace: agentrun-ci - role: active-poc + role: active-cicd-trigger-authority enabled: true gitea: @@ -67,6 +68,7 @@ repositories: git_write_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-agentrun.git source_branch: v0.2 gitops_branch: jd01-v0.2-gitops + # Historical prefix name retained for existing snapshot refs; active architecture is Gitea + PaC, not Gitea Actions. source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/agentrun-v0.2 pipeline_name: agentrun-jd01-v02-ci-image-publish pipeline_run_prefix: agentrun-jd01-v02-ci @@ -87,6 +89,7 @@ repositories: params: git_read_url: http://gitea-http.devops-infra.svc.cluster.local:3000/mirrors/pikasTech-unidesk.git source_branch: master + # Historical prefix name retained for existing snapshot refs; active architecture is Gitea + PaC, not Gitea Actions. source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/unidesk-master node: JD01 lane: v03 @@ -110,6 +113,7 @@ repositories: git_write_url: http://git-mirror-write.devops-infra.svc.cluster.local:8080/pikasTech/HWLAB.git source_branch: v0.3 gitops_branch: v0.3-gitops + # Historical prefix name retained for existing snapshot refs; active architecture is Gitea + PaC, not Gitea Actions. source_snapshot_prefix: refs/unidesk/snapshots/gitea-actions/hwlab-node-runtime/v0.3 pipeline_name: hwlab-jd01-v03-ci-image-publish pipeline_run_prefix: hwlab-jd01-v03-ci-poll diff --git a/docs/reference/platform-infra.md b/docs/reference/platform-infra.md index 8b1b73ec..3151ea29 100644 --- a/docs/reference/platform-infra.md +++ b/docs/reference/platform-infra.md @@ -19,9 +19,9 @@ - Applying Gitea public exposure or webhook sync must roll the affected connector workloads after Secret or ConfigMap changes. A successful Secret apply is not sufficient evidence that `frpc` loaded a new proxy; closeout should use `platform-infra gitea apply` output plus `platform-infra gitea mirror webhook status|test` rather than assuming unchanged connector Pods picked up mounted config. - The canonical PaC entrypoints are `bun scripts/cli.ts platform-infra pipelines-as-code plan|apply|status|history|webhook-test --target `. PaC status is the operator-facing closeout surface for migrated CI lanes and must expose webhook count, latest PipelineRun/TaskRun duration, image status, env identity, digest, GitOps commit, Argo revision and runtime provenance without requiring raw `kubectl`, `tkn` or Gitea UI inspection. - PaC history is the trigger/timing audit surface for Gitea/PaC-managed lanes. It must query Gitea Repository CR and Tekton PipelineRun/TaskRun live objects on the target node, aggregate there, return Beijing-time display by YAML timezone, expose a detail id for drill-down, and report read errors explicitly; a large namespace or unreadable target object must never be rendered as a successful empty table. -- `config/platform-infra/pipelines-as-code.yaml` may declare multiple repositories and consumers. `agentrun-jd01-v02` is the default consumer; Web 哨兵 uses `--consumer sentinel-jd01-v03`. Consumer-scoped status must not mix PipelineRuns or env reuse evidence across repositories. +- `config/platform-infra/pipelines-as-code.yaml` may declare multiple repositories and consumers. JD01 currently has `agentrun-jd01-v02`, `sentinel-jd01-v03` and `hwlab-jd01-v03`; use `history --target JD01` for all-consumer audit and `status --target JD01 --consumer ` for consumer-scoped closeout. Consumer-scoped status must not mix PipelineRuns or env reuse evidence across repositories. - Public Gitea UI may use the YAML-declared HTTPS hostname, but k8s-internal consumers must use the ClusterIP service URL from YAML. Internal CI/Argo/runtime reads must not loop through public DNS/Caddy/FRP, and migrated lanes must not fall back to legacy git-mirror read URLs when the commit exists only in Gitea. -- A PaC-migrated lane must keep a single trigger path: Gitea webhook -> Pipelines-as-Code -> Tekton -> GitOps/Argo -> k8s runtime. Do not add Gitea Actions, `act_runner`, branch-follower or custom script fallback unless a later issue explicitly changes the architecture. +- A PaC-migrated lane must keep a single trigger path: Gitea webhook -> Pipelines-as-Code -> Tekton -> GitOps/Argo -> k8s runtime. Do not add Gitea Actions, `act_runner`, branch-follower or custom script fallback unless a later issue explicitly changes the architecture. `config/cicd-gitea-actions-poc.yaml` is archived POC context only; snapshot refs that still contain `gitea-actions` are historical names retained for compatibility, not evidence that Gitea Actions is active. - k8s runtime remains Docker-free from the point it pulls already built images. CI build steps may use YAML-declared native build tooling, but Docker socket/daemon access must not become part of the runtime plane. ## Secret Distribution Boundary diff --git a/scripts/src/cicd-branch-follower.ts b/scripts/src/cicd-branch-follower.ts index 8fa4537a..672b6350 100644 --- a/scripts/src/cicd-branch-follower.ts +++ b/scripts/src/cicd-branch-follower.ts @@ -572,9 +572,11 @@ function buildPlan(registry: BranchFollowerRegistry, options: ParsedOptions): Re }, followers, next: { - apply: "bun scripts/cli.ts cicd branch-follower apply --confirm --wait", - status: "bun scripts/cli.ts cicd branch-follower status", - dryRun: "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run", + pacStatus: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01", + pacHistory: "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10", + legacyApply: "bun scripts/cli.ts cicd branch-follower apply --confirm --wait", + legacyStatus: "bun scripts/cli.ts cicd branch-follower status", + legacyDryRun: "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run", }, }; } @@ -654,9 +656,11 @@ async function buildStatus(registry: BranchFollowerRegistry, options: ParsedOpti errors: k8s.errors, warnings: k8s.warnings, next: { - apply: "bun scripts/cli.ts cicd branch-follower apply --confirm --wait", + pacStatus: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01", + pacHistory: "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10", + legacyApply: "bun scripts/cli.ts cicd branch-follower apply --confirm --wait", liveStatus: "bun scripts/cli.ts cicd branch-follower status --live", - dryRun: "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run", + legacyDryRun: "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run", }, }; } diff --git a/scripts/src/cicd-gitea-actions-poc.ts b/scripts/src/cicd-gitea-actions-poc.ts index ffd54fe6..73501e0e 100644 --- a/scripts/src/cicd-gitea-actions-poc.ts +++ b/scripts/src/cicd-gitea-actions-poc.ts @@ -1,5 +1,5 @@ -// SPEC: GH-1548 Gitea mirror/Actions visibility and controlled Docker builder POC. -// Responsibility: read-only YAML-first plan/status for the proposed CI/CD governance split. +// SPEC: GH-1548/GH-1560 archived Gitea Actions POC. +// Responsibility: read-only historical plan/status for the retired Gitea Actions POC. import { existsSync, readFileSync } from "node:fs"; import { isAbsolute } from "node:path"; import { rootPath, type UniDeskConfig } from "./config"; @@ -29,6 +29,8 @@ interface LoadedPoc { export function cicdGiteaActionsPocHelp(): unknown { return { command: "cicd gitea-actions-poc plan|status", + archived: true, + replacement: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01", output: "text by default; use --json, --raw, or -o json|yaml for machine output", usage: [ "bun scripts/cli.ts cicd gitea-actions-poc plan", @@ -36,8 +38,8 @@ export function cicdGiteaActionsPocHelp(): unknown { "bun scripts/cli.ts cicd gitea-actions-poc plan --target agentrun-jd01-v02", ], config: DEFAULT_CONFIG_PATH, - issue: "https://github.com/pikasTech/unidesk/issues/1548", - description: "Read-only P1/P2 plan for replacing branch-follower responsibilities with Gitea mirror, Gitea Actions visibility, controlled Docker/BuildKit builder plane, existing Tekton, existing Argo CD, and bounded UniDesk status while preserving env reuse.", + issue: "https://github.com/pikasTech/unidesk/issues/1560", + description: "Archived read-only POC. JD01 production CI/CD uses Gitea mirror -> Pipelines-as-Code -> Tekton -> Argo/k8s runtime; do not use Gitea Actions or act_runner as a fallback.", }; } @@ -385,6 +387,9 @@ function renderPlanHuman(payload: Record): string { return [ `CI/CD GITEA-ACTIONS POC PLAN (${payload.ok === false ? "blocked" : "ok"})`, "", + "ARCHIVE NOTICE", + "This is historical GH-1548 POC material. Current JD01 CI/CD closeout is platform-infra pipelines-as-code status/history; Gitea Actions and act_runner are not fallback paths.", + "", table(["TARGET", "SOURCE", "NODE/LANE", "BASELINE", "SNAPSHOT", "TEKTON", "ARGO", "RUNTIME"], arrayRecords(payload.targets).map((target) => [ target.id, `${target.repository ?? "-"}@${target.branch ?? "-"}`, @@ -428,8 +433,10 @@ function renderPlanHuman(payload: Record): string { errors.length === 0 ? "" : `\nERRORS\n${errors.map((item) => `- ${item}`).join("\n")}`, "", "NEXT", - `status: ${next?.status ?? "-"}`, - `existing-follower: ${next?.existingFollowerStatus ?? "-"}`, + `pac-status: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01`, + `pac-history: bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10`, + `archived-status: ${next?.status ?? "-"}`, + `legacy-follower: ${next?.existingFollowerStatus ?? "-"}`, `issue: ${next?.pocIssue ?? payload.issue ?? "-"}`, "", ].filter((line) => line !== "").join("\n"); @@ -443,6 +450,9 @@ function renderStatusHuman(payload: Record): string { return [ `CI/CD GITEA-ACTIONS POC STATUS (${payload.ok === false ? "blocked" : "declared-only"})`, "", + "ARCHIVE NOTICE", + "This command reads an archived POC spec only. Use platform-infra pipelines-as-code status/history for current JD01 CI/CD evidence.", + "", `statusSource=${payload.statusSource ?? "-"} mode=${payload.statusMode ?? "-"}`, `replacement=${migration?.replacementTarget ?? "-"} branchFollower=${branchFollower?.status ?? "-"}:${branchFollower?.mode ?? "-"}`, "", @@ -460,8 +470,10 @@ function renderStatusHuman(payload: Record): string { errors.length === 0 ? "" : `\nERRORS\n${errors.map((item) => `- ${item}`).join("\n")}`, "", "NEXT", - `plan: ${next?.plan ?? "-"}`, - `existing-follower: ${next?.existingFollowerStatus ?? "-"}`, + `pac-status: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01`, + `pac-history: bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10`, + `archived-plan: ${next?.plan ?? "-"}`, + `legacy-follower: ${next?.existingFollowerStatus ?? "-"}`, "", ].filter((line) => line !== "").join("\n"); } diff --git a/scripts/src/cicd-help.ts b/scripts/src/cicd-help.ts index eb2095cd..26255294 100644 --- a/scripts/src/cicd-help.ts +++ b/scripts/src/cicd-help.ts @@ -5,21 +5,15 @@ export function buildCicdHelp(configPath: string, spec: string): unknown { return { command: "cicd branch-follower plan|apply|status|run-once|debug-step|cleanup-state|events|logs|taskrun|job|runtime|gate", deprecated: true, - mode: "migration-only", - replacement: "bun scripts/cli.ts cicd gitea-actions-poc plan", - issue: "https://github.com/pikasTech/unidesk/issues/1549", + mode: "retired-readonly-for-jd01-consumers", + replacement: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01", + issue: "https://github.com/pikasTech/unidesk/issues/1560", output: "text by default; use --json, --raw, or -o json|yaml for machine output", usage: [ - "bun scripts/cli.ts cicd branch-follower plan", - "bun scripts/cli.ts cicd branch-follower apply --confirm --wait", "bun scripts/cli.ts cicd branch-follower status", "bun scripts/cli.ts cicd branch-follower status --live", - "bun scripts/cli.ts cicd branch-follower run-once --all --dry-run", - "bun scripts/cli.ts cicd branch-follower run-once --follower hwlab-jd01-v03 --confirm --wait", "bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel-master --step controller-source", "bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel-master --step state-read", - "bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel-master --step state-write --confirm", - "bun scripts/cli.ts cicd branch-follower cleanup-state --follower web-probe-sentinel-master --confirm", "bun scripts/cli.ts cicd branch-follower events --follower agentrun-jd01-v02", "bun scripts/cli.ts cicd branch-follower logs --follower web-probe-sentinel-master", "bun scripts/cli.ts cicd branch-follower taskrun --follower hwlab-jd01-v03 --taskrun runtime-ready --logs-tail 120 --json", @@ -31,6 +25,12 @@ export function buildCicdHelp(configPath: string, spec: string): unknown { ], config: configPath, spec, - description: "Deprecated migration-only branch follower controller. Existing production status/debug remains available during cutover, but new CI/CD replacement work should use Gitea mirror and Gitea Actions.", + description: "Retired branch-follower controller surface for the JD01 migrated consumers. Use PaC status/history for current closeout; branch-follower commands remain only for historical state and bounded migration diagnostics.", + currentCloseout: [ + "bun scripts/cli.ts platform-infra gitea mirror status --target JD01", + "bun scripts/cli.ts platform-infra gitea mirror webhook status --target JD01", + "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01", + "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10", + ], }; } diff --git a/scripts/src/cicd-render.ts b/scripts/src/cicd-render.ts index e0472fc8..bf4bdf52 100644 --- a/scripts/src/cicd-render.ts +++ b/scripts/src/cicd-render.ts @@ -53,8 +53,8 @@ function renderPlanHuman(payload: Record): string { `CI/CD BRANCH-FOLLOWER PLAN (${payload.ok === false ? "blocked" : "ok"})`, "", "DEPRECATION", - "branch-follower=migration-only replacement=\"bun scripts/cli.ts cicd gitea-actions-poc plan\" issue=https://github.com/pikasTech/unidesk/issues/1549", - "Do not add new branch-follower controller-loop features; use the Gitea Actions driven path from #1548/#1549.", + "branch-follower=retired-for-jd01-consumers replacement=\"bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01\" issue=https://github.com/pikasTech/unidesk/issues/1560", + "Do not use branch-follower or Gitea Actions as the current delivery path for JD01 AgentRun, sentinel, or HWLAB v0.3; use Gitea mirror + Pipelines-as-Code.", "", table(["FOLLOWER", "ENABLED", "ADAPTER", "SOURCE", "TARGET", "BUDGET", "REFS", "CHECKS"], rows), "", @@ -62,9 +62,11 @@ function renderPlanHuman(payload: Record): string { `hostWorktreeAuthority=${payload.hostWorktreeAuthority === true ? "true" : "false"} mode=${asOptionalRecord(payload.sourceAuthority)?.mode ?? "-"} resolver=${asOptionalRecord(payload.sourceAuthority)?.resolver ?? "-"}`, "", "NEXT", - `apply: ${next?.apply ?? "-"}`, - `status: ${next?.status ?? "-"}`, - `dry-run: ${next?.dryRun ?? "-"}`, + `pac-status: ${next?.pacStatus ?? "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01"}`, + `pac-history: ${next?.pacHistory ?? "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10"}`, + `legacy-apply: ${next?.legacyApply ?? "-"}`, + `legacy-status: ${next?.legacyStatus ?? next?.status ?? "-"}`, + `legacy-dry-run: ${next?.legacyDryRun ?? next?.dryRun ?? "-"}`, "", ].join("\n"); } @@ -124,6 +126,9 @@ function renderStatusHuman(payload: Record, _options: ParsedOpt return [ `CI/CD BRANCH-FOLLOWER STATUS (${payload.ok === false ? "degraded" : "ok"})`, "", + "RETIREMENT", + "This status is historical/migration-only for JD01 migrated consumers. Current closeout: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01; audit: bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10", + "", table( ["CTRL_NS", "ROUTE", "DEPLOY", "READY", "PODS", "PODS_READ", "STATE_CM", "LEASE"], [[controller?.namespace ?? "-", controller?.route ?? "-", controller?.deploymentName ?? "-", `${controller?.availableReplicas ?? 0}/${controller?.replicas ?? 0}`, controller?.pods ?? "-", controller?.podsReadStatus ?? "-", controller?.stateConfigMapPresent === true ? "present" : "missing", controller?.leaseHolder ?? "-"]], @@ -141,8 +146,10 @@ function renderStatusHuman(payload: Record, _options: ParsedOpt errors.length === 0 ? "" : `\nERRORS\n${errors.map((item) => `- ${item}`).join("\n")}`, "", "NEXT", - `live-status: ${next?.liveStatus ?? "-"}`, - `dry-run: ${next?.dryRun ?? "-"}`, + `pac-status: bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01`, + `pac-history: bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10`, + `legacy-live-status: ${next?.liveStatus ?? "-"}`, + `legacy-dry-run: ${next?.legacyDryRun ?? next?.dryRun ?? "-"}`, "", ].filter((line) => line !== "").join("\n"); } diff --git a/scripts/src/cicd.ts b/scripts/src/cicd.ts index c41dd186..e29e6261 100644 --- a/scripts/src/cicd.ts +++ b/scripts/src/cicd.ts @@ -1,4 +1,4 @@ -// SPEC: PJ2026-01060703 CI/CD branch follower and GH-1548 Gitea Actions POC. +// SPEC: PJ2026-01060703 CI/CD branch follower and GH-1548/GH-1560 Gitea PaC migration. // Responsibility: thin CI/CD top-level route entry; subcommand logic lives in responsibility modules. import type { UniDeskConfig } from "./config"; import { renderMachine } from "./cicd-render"; @@ -11,10 +11,13 @@ export function cicdHelp(): unknown { command: "cicd gitea-actions-poc|branch-follower", output: "text by default for subcommands; top-level help is json", migration: { - issue: "https://github.com/pikasTech/unidesk/issues/1549", - primary: "cicd gitea-actions-poc", + issue: "https://github.com/pikasTech/unidesk/issues/1560", + primary: "platform-infra pipelines-as-code", + primaryStatus: "bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01", + primaryHistory: "bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10", + archived: "cicd gitea-actions-poc", deprecated: "cicd branch-follower", - note: "New CI/CD replacement work should use the Gitea Actions driven path; branch-follower is migration-only.", + note: "JD01 CI/CD source/trigger authority is Gitea mirror -> Pipelines-as-Code -> Tekton -> Argo/k8s runtime. Gitea Actions POC and branch-follower are historical or migration-only surfaces.", }, subcommands: [ cicdGiteaActionsPocHelp(), diff --git a/scripts/src/platform-infra-gitea.ts b/scripts/src/platform-infra-gitea.ts index cdd1e081..1d1babdd 100644 --- a/scripts/src/platform-infra-gitea.ts +++ b/scripts/src/platform-infra-gitea.ts @@ -292,7 +292,7 @@ export function giteaHelp(): Record { "bun scripts/cli.ts platform-infra gitea mirror sync --target JD01 --confirm", "bun scripts/cli.ts platform-infra gitea mirror status --target JD01 [--full|--raw]", ], - boundary: "Gitea is installed as an internal ClusterIP source-authority service for GH-1548/GH-1549/GH-1550; mirror source-authority takeover precedes Actions/CI integration.", + boundary: "Gitea is installed as an internal ClusterIP source-authority service for GH-1560; CI trigger authority is Pipelines-as-Code, not Gitea Actions.", }; } @@ -587,7 +587,7 @@ function validateConfig(gitea: GiteaConfig): void { if (!/^docker\.gitea\.com\/gitea$/u.test(gitea.app.image.repository)) throw new Error(`${configLabel}.app.image.repository must use the official Gitea image registry`); if (!/-rootless$/u.test(gitea.app.image.tag)) throw new Error(`${configLabel}.app.image.tag must use a rootless Gitea image`); if (gitea.app.service.type !== "ClusterIP") throw new Error(`${configLabel}.app.service.type must stay ClusterIP`); - if (!gitea.app.actions.enabled) throw new Error(`${configLabel}.app.actions.enabled must be true for GH-1548/GH-1549`); + if (!gitea.app.actions.enabled) throw new Error(`${configLabel}.app.actions.enabled must stay explicit while Gitea is the source-authority service`); if (!gitea.app.registration.disabled) throw new Error(`${configLabel}.app.registration.disabled must be true for the internal POC service`); if (gitea.app.probes.healthPath !== gitea.validation.healthPath) throw new Error(`${configLabel}.app.probes.healthPath must match validation.healthPath`); if (gitea.app.server.rootUrl !== gitea.app.publicExposure.publicBaseUrl.replace(/\/?$/u, "/")) throw new Error(`${configLabel}.app.server.rootUrl must match app.publicExposure.publicBaseUrl for the Web UI`); @@ -1294,11 +1294,11 @@ function remoteScript(action: "apply" | "status" | "validate" | "mirror-bootstra function policyChecks(gitea: GiteaConfig, target: GiteaTarget, manifest: string): Array> { return [ { name: "yaml-source-of-truth", ok: true, detail: "Gitea target, namespace, image, storage, ports and probes are read from config/platform-infra/gitea.yaml." }, - { name: "gh-1548-service-contract", ok: target.namespace === "devops-infra" && gitea.app.serviceName === "gitea-http", detail: "The service matches config/cicd-gitea-actions-poc.yaml sourceAuthority.giteaMirror." }, + { name: "gitea-pac-service-contract", ok: target.namespace === "devops-infra" && gitea.app.serviceName === "gitea-http", detail: "The service matches the active Gitea source authority consumed by config/platform-infra/pipelines-as-code.yaml." }, { name: "cluster-internal-only", ok: !/^\s*type:\s*(NodePort|LoadBalancer)\s*$/mu.test(manifest) && !/^\s*kind:\s*Ingress\s*$/mu.test(manifest), detail: "Gitea is ClusterIP-only for the POC." }, { name: "runtime-zero-docker", ok: !manifest.includes("/var/run/docker.sock") && !/^\s*hostPath:\s*$/mu.test(manifest), detail: "Runtime Gitea does not mount Docker socket or hostPath." }, { name: "rootless-image", ok: /-rootless$/u.test(gitea.app.image.tag), detail: "The runtime image is Gitea rootless." }, - { name: "actions-enabled", ok: gitea.app.actions.enabled, detail: "Gitea Actions is enabled; runner registration is a later controlled stage." }, + { name: "actions-not-trigger-authority", ok: gitea.app.actions.enabled, detail: "Gitea may expose its built-in Actions capability, but JD01 CI/CD trigger authority is Pipelines-as-Code, not act_runner." }, { name: "env-reuse-preserved", ok: gitea.migration.envReusePolicy === "preserve-existing-runtime-env-reuse", detail: "This install does not replace the existing env reuse path or runtime deployment." }, ]; } @@ -1852,7 +1852,7 @@ function renderPlan(result: Record): RenderedCliResult { ` status: ${stringValue(next.status)}`, ` validate: ${stringValue(next.validate)}`, "", - "Boundary: Gitea is internal ClusterIP source authority for GH-1548/GH-1549; runner and mirror repo bootstrap are separate controlled stages.", + "Boundary: Gitea is internal ClusterIP source authority for GH-1560; CI trigger authority is Pipelines-as-Code, not Gitea Actions/act_runner.", "Disclosure: Secret values are not printed; this stage does not create runner credentials.", ]); } diff --git a/scripts/src/platform-infra-pipelines-as-code.ts b/scripts/src/platform-infra-pipelines-as-code.ts index e19f8e2b..f04c633e 100644 --- a/scripts/src/platform-infra-pipelines-as-code.ts +++ b/scripts/src/platform-infra-pipelines-as-code.ts @@ -406,6 +406,7 @@ async function status(config: UniDeskConfig, options: CommonOptions): Promise { }; } +function consumerCoverage(pac: PacConfig, targetId: string): Record[] { + return pac.consumers.map((consumer) => { + const repository = resolveRepository(pac, consumer.repositoryRef); + const suffix = consumerSuffix(consumer.id, pac.defaults.consumerId); + return { + consumer: consumer.id, + source: `${repository.owner}/${repository.repo}@${repository.params.source_branch ?? "-"}`, + namespace: consumer.namespace, + pipeline: consumer.pipeline, + argoApplication: consumer.argoApplication, + statusCommand: `bun scripts/cli.ts platform-infra pipelines-as-code status --target ${targetId}${suffix}`, + historyCommand: `bun scripts/cli.ts platform-infra pipelines-as-code history --target ${targetId}${suffix}`, + }; + }); +} + function consumerSuffix(consumerId: string, defaultConsumerId: string): string { return consumerId === defaultConsumerId ? "" : ` --consumer ${consumerId}`; } @@ -759,12 +776,18 @@ function renderApply(result: Record): RenderedCliResult { function renderStatus(result: Record): RenderedCliResult { const summary = record(result.summary); const consumer = record(result.consumer); + const coverage = arrayRecords(result.coverage); const latest = record(summary.latestPipelineRun); const taskRuns = arrayRecords(summary.taskRuns); const artifact = record(summary.artifact); const argo = record(summary.argo); const lines = [ "PLATFORM-INFRA PIPELINES-AS-CODE STATUS", + ...(coverage.length === 0 ? [] : [ + "COVERAGE", + ...table(["CONSUMER", "SOURCE", "NAMESPACE", "PIPELINE", "ARGO_APP"], coverage.map((item) => [stringValue(item.consumer), stringValue(item.source), stringValue(item.namespace), stringValue(item.pipeline), stringValue(item.argoApplication)])), + "", + ]), ...table(["CONSUMER", "READY", "CRD", "CONTROLLER", "WEBHOOKS", "REPOSITORY"], [[stringValue(consumer.id), boolText(summary.ready), boolText(summary.crdPresent), stringValue(summary.controllerReady), stringValue(summary.webhookCount), compactLine(stringValue(summary.repositoryCondition))]]), "", "LATEST PIPELINERUN", @@ -781,6 +804,7 @@ function renderStatus(result: Record): RenderedCliResult { "", "NEXT", ` full: ${stringValue(record(result.next).status)} --full`, + ` all-history: ${stringValue(record(result.next).history).replace(/ --consumer [^ ]+/u, "")} --limit 10`, ]; return rendered(result, "platform-infra pipelines-as-code status", lines); }