ci: make assurance gates fail closed #500

Merged

didericis merged 12 commits from fix/ci-assurance-498 into main 2026-07-26 05:10:11 -04:00

Conversation 0 Commits 12 Files Changed 27

+967 -218

didericis-codex commented 2026-07-26 04:14:32 -04:00

Collaborator

Copy Link

Copy Source

Closes #498

What changed

• validate the complete critical-module manifest and enforce its 90% floor in CI and badge updates
• prevent failed unit runs or malformed reports from publishing coverage badges
• make the required Docker suite run all security/isolation scenarios under the socket-shared runner topology
• require an explicit minimum of 22 executed Docker tests with zero skips
• configure the shared gateway subnet for pinned source-IP attribution and serialize singleton Docker jobs
• add a real gitleaks release/checksum/executable canary with a minimum-executed/no-skip gate
• expand workflow path filters and align CI documentation with the required/manual topology

Validation

• hosted unit suite: 2,423 tests passed
• required Docker integration: 22 tests passed, 0 skipped
• aggregate critical-core coverage: 94% (minimum 90%)
• changed executable lines: 97.7% (127/130; minimum 90%)
• lint, tracker policy, and PRD-number policy: passed
• scheduled-canary workflow manually dispatched: passed
• server-side gitleaks on every push: no leaks found

Runs: required test/coverage, recorded canary, lint.

Closes #498 ## What changed - validate the complete critical-module manifest and enforce its 90% floor in CI and badge updates - prevent failed unit runs or malformed reports from publishing coverage badges - make the required Docker suite run all security/isolation scenarios under the socket-shared runner topology - require an explicit minimum of 22 executed Docker tests with zero skips - configure the shared gateway subnet for pinned source-IP attribution and serialize singleton Docker jobs - add a real gitleaks release/checksum/executable canary with a minimum-executed/no-skip gate - expand workflow path filters and align CI documentation with the required/manual topology ## Validation - hosted unit suite: 2,423 tests passed - required Docker integration: 22 tests passed, 0 skipped - aggregate critical-core coverage: 94% (minimum 90%) - changed executable lines: 97.7% (127/130; minimum 90%) - lint, tracker policy, and PRD-number policy: passed - scheduled-canary workflow manually dispatched: passed - server-side gitleaks on every push: no leaks found Runs: [required test/coverage](https://gitea.dideric.is/didericis/bot-bottle/actions/runs/3356), [recorded canary](https://gitea.dideric.is/didericis/bot-bottle/actions/runs/3336), [lint](https://gitea.dideric.is/didericis/bot-bottle/actions/runs/3354).

didericis-codex added 5 commits 2026-07-26 04:14:33 -04:00

ci(coverage): enforce the critical core contract fafb828bb7

ci(docker): require the full integration suite 583ff98b27

test(canary): verify the pinned gitleaks release 1c6d30ffd8

docs(ci): document the assurance topology 671d91070e

test(ci): cover assurance gate entry points 1022247ce5

didericis added 1 commit 2026-07-26 04:15:28 -04:00

fix(ci): enable the scheduled canary suite d4889663d1

didericis added 1 commit 2026-07-26 04:24:30 -04:00

fix(ci): bypass proxies for Docker host probes f0fe33b1d0

didericis added 2 commits 2026-07-26 04:31:15 -04:00

test(orchestrator): make wrong-key coverage deterministic b2245ae1f3

fix(ci): join control planes to the runner network f3fbfb3cc3

didericis added 1 commit 2026-07-26 04:35:47 -04:00

fix(docker): configure the attributed gateway subnet d744bec7b1

didericis added 1 commit 2026-07-26 04:38:23 -04:00

test(docker): wait for multitenant probe readiness 73e70e326c

didericis added 1 commit 2026-07-26 04:41:07 -04:00

test(docker): authenticate multitenant egress probes 1827593b89

didericis merged commit 1827593b89 into main 2026-07-26 05:10:11 -04:00

didericis deleted branch fix/ci-assurance-498 2026-07-26 05:10:18 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

Compat/Breaking

Breaking change that won't be backward compatible

Kind/Bug

Something is not working

Kind/Documentation

Documentation changes

Kind/Enhancement

Improve existing functionality

Kind/Feature

New functionality

Kind/Security

This is security issue

Kind/Testing

Issue or pull request related to testing

Priority

Critical

1

The priority is critical

Priority

High

2

The priority is high

Priority

Low

4

The priority is low

Priority

Medium

3

The priority is medium

Status

Abandoned

3

Somebody has started to work on this but abandoned work

Status

Blocked

1

Something is blocking this issue or pull request

Status

Need More Info

2

Feedback is required to reproduce issue or to continue work

Status/Needs Triage

Awaiting initial classification

No Label

Milestone

No items

No Milestone

Assignees

Clear assignees

didericis-claude (didericis (claude)) didericis-codex (didericis (codex)) didericis-gemma (gemma) didericis

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: didericis/bot-bottle#500