77 lines
3.4 KiB
YAML
77 lines
3.4 KiB
YAML
# Gate the CI helper-script unit tests on every homelab pull_request.
|
|
#
|
|
# scripts/ci/test-model-selection.sh is the regression test for the model-
|
|
# selection injection gate (valid-model.sh) and the fetch-models.sh response
|
|
# mapping. It is ALSO run on the daily/weekly crons via e2e.yml, but that would
|
|
# only catch a weakening of the gate up to a week after it merged — by which
|
|
# time pick-model.sh / pr-review.yml may have already run the weakened gate
|
|
# against adversarial PR input. Running it here fails the offending PR's checks
|
|
# before it can merge.
|
|
#
|
|
# scripts/ci/test-promtool-rules.sh is the same idea for the alert-rule gate.
|
|
# What it tests is not whether promtool evaluates PromQL — ci-manifests-test.yml
|
|
# does that with the real binary against the real rules — but whether
|
|
# promtool-rules.sh REFUSES TO REPORT SUCCESS when it has checked nothing: zero
|
|
# manifests discovered, zero suites discovered, a `rule_files` path that does not
|
|
# resolve (promtool warns, loads zero rules, and passes every assertion), a
|
|
# mutation the suites no longer catch. Those are the states a green pipeline
|
|
# cannot tell apart from real coverage, so they need a test that asserts the
|
|
# failure. It stubs promtool, so it needs neither the binary nor the heavy image.
|
|
#
|
|
# Both are unfiltered by path on purpose: this pipeline is two steps on one
|
|
# already-cached image, so running it everywhere is free, and a guard whose test
|
|
# only runs when someone remembers to touch the right directory is not a guard.
|
|
#
|
|
# Only in homelab (scripts/ci/ lives here); the file is not deployed to the
|
|
# mirrored repos, so it does not run on their PRs. All tests here are offline (no
|
|
# token, no network, no cluster) — the ci-claude image just provides sh + jq, and
|
|
# it is already pulled by pr-review.yml on the same event, so the runner has it
|
|
# cached.
|
|
when:
|
|
- event: pull_request
|
|
|
|
# `depends_on: []` on every step so they run in parallel and one failure does not hide
|
|
# the other. Same reasoning as the note above `steps:` in ci-manifests-test.yml.
|
|
steps:
|
|
- name: model-selection-tests
|
|
depends_on: []
|
|
image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
|
|
commands:
|
|
- sh scripts/ci/test-model-selection.sh
|
|
|
|
- name: pr-review-mistral-tests
|
|
depends_on: []
|
|
image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
|
|
commands:
|
|
- sh scripts/ci/test-pr-review-mistral.sh
|
|
|
|
- name: promtool-rules-guard-tests
|
|
depends_on: []
|
|
image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
|
|
commands:
|
|
- sh scripts/ci/test-promtool-rules.sh
|
|
|
|
- name: yaml-citations-guard-tests
|
|
depends_on: []
|
|
image: gitea.renner.uno/gitea_admin/ci-claude:2.1.306
|
|
commands:
|
|
- sh scripts/ci/test-yaml-citations.sh
|
|
|
|
# Offline unittests for the Hermes skill scripts
|
|
# (kubernetes/apps/hermes/skills/): the [alert] title, noise-log and blip
|
|
# fingerprint contract the alert-monitor dedup depends on, the issue->card
|
|
# bridge, and the secret guard.
|
|
- name: hermes-skill-tests
|
|
depends_on: []
|
|
image: python:3.14-alpine@sha256:f6a589d43c42b9e7f7dc67a12d37132491f362859a5d750607710cc56da3bc72
|
|
environment:
|
|
PYTHONDONTWRITEBYTECODE: "1"
|
|
commands:
|
|
- python3 -m unittest discover -s kubernetes/apps/hermes/skills/tests -v
|
|
|
|
- name: backup-verify-tests
|
|
depends_on: []
|
|
image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-10
|
|
commands:
|
|
- bash kubernetes/infrastructure/velero/backup-verify/tests/run.sh
|