hack/cozytest.sh serves two populations that want opposite things from a
runner: 32 hermetic unit tests of hack/*.sh, and 3 live-cluster imperative
tests. This moves the unit half to real bats and leaves the live half where
it is; the hack/e2e-*.bats filter already in BATS_UNIT_FILES is what keeps
them apart.
The unit files need no edits. They pass under vanilla bats 1.13 unchanged
because their authors wrote to the intersection of both runners -- no run,
no $status, no skip, repo-root-relative paths. Measured on this tree: 328
tests, 0 failures, 26s under `bats -j 8` against cozytest's 63s serial.
What this buys, none of which cozytest offers: --filter-status failed to
rerun only the previous failures, JUnit so CI annotates the failing test
instead of requiring a log read, -j, and deletion of a bespoke awk parser
whose rewrite rules void helper exit codes, corrupt heredoc fixtures on a
column-0 brace, and collide test names after sanitization.
Two consequences worth naming, neither covered by the issue:
bats is a new dependency. cozytest is pure bash+awk, so no runner image or
contributor machine has ever needed anything else. The checks job installs
it from a pinned tag rather than the distro package, whose version varies
by base image, and the make target says so plainly when it is absent. GNU
parallel stays optional -- BATS_JOBS resolves to 1 without it, since
`bats -j` exits non-zero rather than degrading.
The pre-commit lane is the second consumer and does NOT get bats. That job
lints changed YAML and Markdown on a runner with no bats, and the new
hook's path filter covers .github/workflows/, so a workflow edit would drag
the whole 328-test shell suite into a lint lane and duplicate the checks
job that already runs `make unit-tests`. It is skipped there by id, keeping
the hook a local-developer gate.
The tested shell changes. cozytest is #!/bin/sh, which is dash on the CI
runner, and bats runs bash. Seven POSIX scripts that tests source rather
than execute -- seaweedfs-naming-audit.sh, promote-rewrite-tags.sh,
lib/image-refs.sh, the three e2e-capture scripts and cozystack-version.sh
-- therefore lose a runtime dash check they had by accident. Four
shell=bash files under e2e-chainsaw/_lib gain correct fidelity for the same
reason. The static replacement is the shellcheck gate in item 5 of #3453,
which does not exist yet.
set -u is not restored here. bats enforces -e but not -u, and there is no
runner-level way to inject it: --setup-suite-file does not reach test
files, and SHELLOPTS=nounset is exported, so it leaks into the scripts
under test and drops two tests. Restoring it needs a per-file load and is
the layer above this one.
Refs: #3453
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Raise the OpenSSF Scorecard Token-Permissions and Pinned-Dependencies
checks (both currently 0/10) ahead of CNCF Incubation due diligence:
- Declare a top-level read-only default (permissions: contents: read) in
every workflow, plus an explicit per-job permissions: block that grants
only the writes that job actually needs. Workflows that previously held
write scopes at the workflow level (backport, pr-labeler, pr-size,
stale) now hold them at job level instead.
- Pin every GitHub-owned and third-party action to a full commit SHA with
a version comment. scorecard.yml was already pinned in #2721.
No triggers, job graph, or step logic change; only token scopes and
action refs. Self-hosted release jobs keep the exact write scopes they
already declared.
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Assisted-By: Claude <noreply@anthropic.com>
v1.6.0 adds the date-time string-format alias and the @example
annotation. Both are additive, opt-in directives: charts that do not
use them regenerate byte-identical schema, README and Go type output,
so the pre-commit check stays green without touching any committed
artifact.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
v1.5.0 adds the @immutable annotation support
(cozystack/cozyvalues-gen#24). Without the bump, pre-commit re-runs
make generate with the v1.4.0 binary, silently strips any
x-kubernetes-validations entries that downstream PRs add to
values.schema.json / embedded openAPISchema, and reports drift against
the committed artefacts.
This is a no-op for the current main: no chart currently uses
@immutable, so regeneration with v1.5.0 produces identical output to
v1.4.0. Unblocks cozystack/cozystack#2639 (apply @immutable to
storageClass across stateful apps).
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Aleksei Sviridkin <f@lex.la>
v1.4.0 adds the `intOrString` type alias used by the postgres package's
`postgresql.parameters` schema in this PR. CI must install v1.4.0 so the
"Verify generated code is up to date" check regenerates the same schema
shape (anyOf + x-kubernetes-int-or-string: true) rather than reverting
to {type: string}.
Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
Use https://github.com/cozystack/cozyvalues-gen for three apps:
- apps/postgres
- apps/virtual-machine
- extra/monitoring
Changes:
- Add type and enum definitions to values.yaml.
- Update READMEs with new information.
- Update values.schema.json with definitions for children objects,
allowing precise UI customization. Add regexp for specific types
such as resources: CPU like `500m` and RAM like `4GiB`.
- Remove direct injections with `yq` from Makefiles where they're not
needed anymore.
Co-authored-by: Nick Volynkin <nick.volynkin@gmail.com>
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Signed-off-by: Nick Volynkin <nick.volynkin@gmail.com>
I labeled my PR and CI was re-started, so now I have to wait even more.
We have no labels governing CI, so there's no reason to restart it on `labeled`.
Signed-off-by: Nick Volynkin <nick.volynkin@gmail.com>
Pre-commit is now required to merge PRs, so let it run even on documentation updates.
An alternative is to merge with administrator permissions, bypassing rules,
which is not a good practice.
Signed-off-by: Nick Volynkin <nick.volynkin@gmail.com>
Pre-commit checks used to trigger twice on PRs: for `push` and `pull_request`
triggers. Now they will only run on `push` to the main branch and on regular
updates to pull requests, except for those that only change the documentation.
Note that pushes to feature branches will not trigger this check until
a PR was opened.
Signed-off-by: Nick Volynkin <nick.volynkin@gmail.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Introduced a new pre-commit hook (`run-make-generate`) to automate the
generation process in application directories.
- **Documentation**
- Enhanced readability of the Managed NATS Service README by adjusting
formatting and removing unnecessary headers.
- **Bug Fixes**
- Corrected JSON structure in the Postgres values schema to ensure
validity.
- **Chores**
- Updated pre-commit configuration for improved consistency and
functionality.
- Reorganized properties in the NATS values schema, removing the `users`
property to reflect changes in user management capabilities.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Release Notes
- **New Features**
- Introduced a pre-commit workflow to automate checks before code
merges.
- Added a section in the README for testing packages locally.
- **Improvements**
- Enhanced PostgreSQL initialization script for better user and role
management.
- Updated documentation for Managed PostgreSQL Service with improved
formatting and additional backup parameters.
- Integrated pre-commit hooks for maintaining code quality in YAML and
Markdown files.
- Added a new target in the installer Makefile to run pre-checks before
building images.
- **Bug Fixes**
- Adjusted formatting in various README files to ensure consistent
presentation.
- **Chores**
- Updated image reference to use the latest version in configuration
files.
- Updated versioning for various packages in the versions map.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Myasnikov Daniil