test: verify gt's bulwark toolchain caching on Go (DO NOT MERGE) - #288
Draft
pedromvgomes wants to merge 8 commits into
Draft
test: verify gt's bulwark toolchain caching on Go (DO NOT MERGE)#288pedromvgomes wants to merge 8 commits into
pedromvgomes wants to merge 8 commits into
Conversation
Onboards this repository onto gt's governance subsystem (pedromvgomes/gt#31). A committed .gt-repo.yaml is the source of truth and `gt repo sync` renders the files from it. Must not merge before gt v1 is cut: every rendered caller pins pedromvgomes/gt@v1, which does not exist yet. The pulumi group survives intact, applies-to included. gt could not express `applies_to` at all until this repository forced it: dropping it would have folded security advisories on pulumi modules into the routine batch instead of raising them immediately, which is the kind of change that shows up as nothing at all until it matters. Verified by parsing both files and diffing — nothing dropped, one entry added. npm under /website is new coverage. It is deliberately outside bulwark's scope, but its dependencies still need updating. Cooldown was already 7 days here; what changes is the commit prefix, now build(deps)/ci(deps) with include: scope, and the PR limit, 10 to 25. bulwark is off. ci.yml already runs it against build-test's coverage artifact, and gt's stage would be a second run competing for the same baselines on the bulwark-state branch. It goes on in the PR that moves that job into ci-test — which should be the easiest migration in the fleet, since this pipeline is already shaped the way gt's is. CD is off. cd-orchestration fires on v*.*.*, which release.yml already owns, and its verify-attestation runs with require: true. The ci-* stages land as empty no-ops; end2end is omitted, there being no e2e suite. ci.yml and its PR Gate keep running unchanged. Claude-Session: https://claude.ai/code/session_01PvwKxJ5vnqa9h9XXyTEj43
Picks up pedromvgomes/gt#31's annotation. semgrep's secrets-inherit rule flagged the rendered orchestrator; gt cannot enumerate a repository's secret names, so the reasoning is recorded at each site rather than the rule being silenced. Claude-Session: https://claude.ai/code/session_01PvwKxJ5vnqa9h9XXyTEj43
The governance PR added the gt workflows but left ci.yml in place, so
ci-gate went green on a pipeline that ran nothing. This moves the work.
ci.yml's four jobs land as follows:
- lint -> ci-build, as its own job. gt's stage vocabulary is
preflight/build/test/end2end with no lint stage, and lint is not a test.
Keeping it a separate job inside ci-build preserves the parallelism it
had. bulwark does NOT make it redundant: bulwark runs gosec and
govulncheck, not golangci-lint, so dropping it would lose real coverage.
- build-test splits. `go build ./...` joins ci-build; `go test -race
-coverprofile` and the artifact upload become ci-test.
- bulwark is deleted, and bulwark.enabled comes out of .gt-repo.yaml so
gt's own stage takes over. The override existed because this repository
hand-rolled the job gt could not generically reproduce — that is no
longer true once the pipeline is gt's. gt's version also names its
secrets rather than inheriting them, which is what works across owners.
- pr-gate is deleted; ci-gate is its replacement, and the ruleset's
required context has to move with it — "PR Gate" stops existing the
moment this merges.
The coverage artifact is renamed coverage-out -> gt-coverage. That exact
name is the contract gt's bulwark stage consumes; it mirrors the artifact's
tree into the scan root, and a single module rooted here means one
coverage.out at the top level lands where bulwark already looks.
.bulwark.yml already declares coverage.source: report, so this keeps the
one-test-run property ci.yml was built for.
Every setup-go now reads go-version-file: go.mod, in release.yml as well as
the new stages, so the toolchain is stated once. That depends on the
toolchain line added by #287 — without it go-version-file resolves to
1.25.11 and silently downgrades CI from 1.26.6.
The README's CI badge pointed at ci.yml and would have gone blank; it now
points at ci-orchestration.yml.
Re-synced with gt 1.3.0 first as its own step; `gt repo config` was
byte-identical across it apart from the version stamp.
.agents/CODE-MAP.md was a hash-verified snapshot last regenerated on 2026-05-31 and it had already drifted well before this branch touched anything: it described "three workflows", listed a deploy-raw.yml that no longer exists, and tracked blob hashes for files that have since changed. Retiring ci.yml here would have made it wronger still, and editing it by hand is not a fix — the blob hashes are the mechanism by which it knows whether it is current, so a hand-edited entry claims freshness it does not have. A generated artifact that is wrong is worse than no artifact: it reads as authoritative. Nothing references it — no workflow, no doc, no tooling. AGENTS.md and CLAUDE.md are hand-written and stay, as do .agents/rules and .agents/skills. Regenerate it if the map is wanted back.
#279 added a table recording every place the Pulumi CLI/SDK version is pinned, precisely because nothing in the toolchain links them and Dependabot only sees go.mod. Retiring ci.yml moves one of those four rows, and a sync-the-pins table that names a file which no longer exists is worse than no table — someone bumps three of four and believes they are done. release.yml's comment pointed at "ci.yml's build-test" for the same explanation; that reasoning now lives in ci-test.yml. The pin itself moved with the job: ci-test.yml carries pulumi-version 3.253.0, matching what #279 set.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Throwaway branch. It is
chore/gt-repo-governance(#278) with one line changed — the bulwark stage points atpedromvgomes/gt@fix/bulwark-toolchain-cacheinstead of@v1.#278 is the repo where the missing
setup-goshows up: its bulwark scan was reclaimed by the runner three times running, always mid-gosec on the Pulumi-heavy packages. This checks whether the gt-side fix clears it.Closing and deleting once the run is observed. Nothing here is meant to merge.