mirror of
https://github.com/shankar0123/certctl.git
synced 2026-06-09 14:58:57 +00:00
shankar0123
6f6de639a0
Bundle: ci-pipeline-cleanup, Phases 5+6 / frozen decisions 0.4 + 0.5 + 0.6. Revises Bundle II decisions 0.4 (Windows matrix) and 0.9 (per- vendor granularity). PHASE 5 — Linux vendor matrix collapsed (12 jobs → 1): The previous per-vendor matrix produced 12 status-check rows for ~1 real assertion (115/116 vendor-edge tests are t.Log placeholders per Bundle II Phase 2-13 design). Granularity was fake signal. Single-job version: brings up all 11 sidecars at once via docker compose --profile deploy-e2e up -d, runs go test -run 'VendorEdge_' once, tears down once. Critical caveat: requireSidecar() in deploy/test/vendor_e2e_helpers.go uses t.Skipf() when a sidecar isn't reachable — silent test skip, not CI failure. The new Skip-count enforcement step (scripts/ci-guards/vendor-e2e-skip-check.sh) counts SKIP lines and fails the build if it exceeds the allowlist at scripts/ci-guards/vendor-e2e-skip-allowlist.txt (15 windows-iis- requiring tests legitimately skip on Linux per Phase 6). PHASE 6 — Windows matrix deleted entirely: The deploy-vendor-e2e-windows job removed. Two reasons: 1. Can't physically work on windows-latest today (Docker not started in Windows-containers mode by default; bridge network driver missing on Windows Docker — see CI run 25183374742 failure logs). 2. Even fixed, validates nothing — all 16 IIS + WinCertStore tests are t.Log placeholders that exercise no IIS-specific behavior. Per Bundle II frozen decision 0.14, the third criterion for "verified" status in the vendor matrix is operator manual smoke against a real instance. IIS + WinCertStore now satisfy that via the playbook (Phase 6 follow-up adds docs/connector-iis.md:: Operator validation playbook). The windows-iis-test sidecar STAYS in deploy/docker-compose.test.yml under profiles: [deploy-e2e-windows] for operator local use. Linux CI never activates this profile. Operator-required action before merge: RAM headroom verification on prototype branch (per frozen decision 0.14). If peak RSS > 12 GB on ubuntu-latest with all 11 sidecars up, fall back to bucketed matrix per cowork/ci-pipeline-cleanup/decisions-revised.md. ci.yml: 417 → 383 lines (-34 net; -1105 cumulative since baseline 1488). Status checks per push: 19 → 7 (collapse 12 vendor + 2 windows = -14; add image-and-supply-chain in Phase 7-9 = +1; net 19-12-2+1 = ~7). Operator action for Phase 13: update GitHub branch protection rules (required-checks list 19 → 7 entries). Documented in cowork/ ci-pipeline-cleanup/decisions-revised.md.
41 lines
2.0 KiB
Plaintext
41 lines
2.0 KiB
Plaintext
# scripts/ci-guards/vendor-e2e-skip-allowlist.txt
|
|
#
|
|
# Test names that are EXPECTED to skip on Linux ubuntu-latest CI runners.
|
|
# Each entry: one Go test function name per line. Lines starting with `#`
|
|
# are comments / ignored. Blank lines ignored.
|
|
#
|
|
# Per ci-pipeline-cleanup bundle Phase 5 / frozen decision 0.6.
|
|
# The skip-detection guard (in the deploy-vendor-e2e job) counts
|
|
# `^--- SKIP:` lines from the test output and fails the build if it
|
|
# exceeds the count of unique entries in this allowlist.
|
|
#
|
|
# When a sidecar fails to start, the affected tests' requireSidecar() call
|
|
# triggers t.Skipf() — those skips are NOT in this allowlist and surface
|
|
# as a build failure.
|
|
|
|
# Windows-only tests that legitimately skip on Linux because the
|
|
# windows-iis-test sidecar is gated by `profiles: [deploy-e2e-windows]`
|
|
# and CI runs only the `deploy-e2e` profile (per ci-pipeline-cleanup
|
|
# Phase 6 frozen decision 0.5 — Windows matrix deletion). Operators
|
|
# validate these via `docs/connector-iis.md::Operator validation playbook`
|
|
# on a real Windows host.
|
|
|
|
# IIS connector (10 tests; require windows-iis sidecar)
|
|
TestVendorEdge_IIS_ARRReverseProxyCertRotation_E2E
|
|
TestVendorEdge_IIS_AppPoolRecycle_OptInForCertChange_E2E
|
|
TestVendorEdge_IIS_BindingTypeHttpsValidated_E2E
|
|
TestVendorEdge_IIS_CCSCentralizedCertStoreVariant_DeployToSharedStore_E2E
|
|
TestVendorEdge_IIS_FriendlyNameUpdatedOnRotation_E2E
|
|
TestVendorEdge_IIS_HTTP2ALPNPreserved_E2E
|
|
TestVendorEdge_IIS_RemovePreviousBindingOnRotate_E2E
|
|
TestVendorEdge_IIS_SNIMultiBindingPerSite_DeployUpdatesCorrectBinding_E2E
|
|
TestVendorEdge_IIS_WinRMRemotePath_vs_LocalPowerShellPath_BothWork_E2E
|
|
|
|
# WinCertStore connector (6 tests; require windows-iis sidecar)
|
|
TestVendorEdge_WinCertStore_CertStoreACL_IISIUSRSAccess_E2E
|
|
TestVendorEdge_WinCertStore_CertStoreACL_NetworkServiceAccess_E2E
|
|
TestVendorEdge_WinCertStore_PrivateKeyExportableFlag_E2E
|
|
TestVendorEdge_WinCertStore_RemovePreviousThumbprintOnRotate_E2E
|
|
TestVendorEdge_WinCertStore_StoreLocationLocalMachineVsCurrentUser_E2E
|
|
TestVendorEdge_WinCertStore_ThumbprintBindingVsFriendlyNameBinding_E2E
|