wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 3 Packages Projects Releases Wiki Activity

fix(ci): keep workflow guard changes on narrow cd profile
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 25s
Details
CD Pipeline / post-deploy-checks (push) Has been cancelled
Details
CD Pipeline / build-and-deploy (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Your Name
2026-06-30 08:28:33 +08:00
parent eb93cc833f
commit ff7febbf62
2 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
.gitea/workflows/cd.yaml
View File

@@ -200,6 +200,23 @@ jobs:
;;
.gitea/workflows/cd.yaml)
;;
# 2026-06-30 Codex: workflow secret-transport and guard-only
# hardening must stay on the narrow profile. These changes are
# validated by workflow-shape, the secret-surface guard, and the
# runner pressure/profile tests; sending them to full/B5 would
# reintroduce the heavy runner path while not increasing coverage.
.gitea/workflows/cd-dev.yaml)
;;
.gitea/workflows/code-review.yaml)
;;
.gitea/workflows/deploy-alerts.yaml)
;;
.gitea/workflows/e2e-health.yaml)
;;
.gitea/workflows/run-migration.yml)
;;
scripts/ci/check-gitea-step-env-secrets.js)
;;
# 2026-06-29 Codex: the onboarding warning-step workflow is
# copied in a disabled workflow_dispatch-only state. Treat the
# source and template files as controlled-runtime sources so the

15
ops/runner/test_cd_controlled_runtime_profile.py
View File

@@ -35,6 +35,21 @@ def test_deploy_marker_k8s_files_stay_on_controlled_runtime_profile() -> None:
assert "k8s/awoooi-prod/kustomization.yaml)" in text
def test_workflow_secret_transport_sources_stay_on_controlled_runtime_profile() -> None:
text = _workflow_text()
assert "workflow secret-transport and guard-only" in text
expected_sources = [
".gitea/workflows/cd-dev.yaml)",
".gitea/workflows/code-review.yaml)",
".gitea/workflows/deploy-alerts.yaml)",
".gitea/workflows/e2e-health.yaml)",
".gitea/workflows/run-migration.yml)",
"scripts/ci/check-gitea-step-env-secrets.js)",
]
for source in expected_sources:
assert source in text
def test_onboarding_warning_step_template_stays_on_controlled_runtime_profile() -> None:
text = _workflow_text()
assert "onboarding warning-step workflow is" in text