pdurlej/platform

Fork 0

test(platformctl): parse apply workflow contract structurally #672

Merged

pdurlej merged 1 commit from codex/209-workflow-contract-structure into main

2026-06-01 17:08:43 +02:00

codex commented

2026-06-01 16:46:08 +02:00

Collaborator

Canary status: missing — fire canary 3+3 manually before merge

Canary Context Pack

Product story

Forgejo workflow contract tests guard the apply lane. They should fail because a workflow contract changed, not because a brittle whole-file substring happened to move.

What changed

Added structured YAML helpers for loading the apply workflow, locating jobs, locating steps by name, collecting artifact paths, and scanning structured string values.
Refactored apply workflow contract tests to assert structured fields for job config, step names/ids, env vars, action versions, and artifact paths.
Kept substring assertions only inside shell run: snippets where the contract is inherently shell text.

Why it changed

M06 apply-hardening issue #209 asks to replace fragile text/regex assumptions with structural YAML assertions while preserving contract coverage strength.

Files touched

control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py

Relevant context

Issue #209: parse Forgejo workflow contract structurally.
control-plane/forgejo-actions/apply.yaml remains unchanged and is treated as the contract under test.

Runtime evidence

No runtime action, no workflow mutation, no SSH, no DB, no service restart. This PR changes tests only.

Known constraints

Shell bodies still require substring assertions for snippets such as trap handling, output writes, and jq field checks. Those assertions now target the specific step's run: field instead of the entire workflow file.

Explicit out-of-scope

No Forgejo workflow behavior changes.
No apply runtime changes.
No break-glass or actor binding changes.
No changes to unrelated Infisical inventory files currently dirty in the worktree.

Requested decision

Review and merge if checks stay green.

Merge blockers

Loss of apply workflow contract coverage.
Any structural helper masking a missing step/action/env/artifact path.

Spec sources read

Forgejo issue #209 — acceptance criteria for structural workflow contract parsing.
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py — existing contract tests and refactor scope.
control-plane/forgejo-actions/apply.yaml — workflow contract under test.

Validation

UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_forgejo_ci_scripts_contract.py — 42 passed
UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_apply_phase3.py platformctl/tests/test_apply_env_file.py platformctl/tests/test_pr_sanity.py platformctl/tests/test_forgejo_ci_scripts_contract.py platformctl/tests/test_health_phase3.py — 208 passed
PYTHONPATH=control-plane UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run --project control-plane python -m platformctl.cli validate all --json — passed, exitCode=0

Closes #209

Canary status: missing — fire canary 3+3 manually before merge ## Canary Context Pack ### Product story Forgejo workflow contract tests guard the apply lane. They should fail because a workflow contract changed, not because a brittle whole-file substring happened to move. ### What changed - Added structured YAML helpers for loading the apply workflow, locating jobs, locating steps by name, collecting artifact paths, and scanning structured string values. - Refactored apply workflow contract tests to assert structured fields for job config, step names/ids, env vars, action versions, and artifact paths. - Kept substring assertions only inside shell `run:` snippets where the contract is inherently shell text. ### Why it changed M06 apply-hardening issue #209 asks to replace fragile text/regex assumptions with structural YAML assertions while preserving contract coverage strength. ### Files touched - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` ### Relevant context - Issue #209: parse Forgejo workflow contract structurally. - `control-plane/forgejo-actions/apply.yaml` remains unchanged and is treated as the contract under test. ### Runtime evidence No runtime action, no workflow mutation, no SSH, no DB, no service restart. This PR changes tests only. ### Known constraints Shell bodies still require substring assertions for snippets such as trap handling, output writes, and jq field checks. Those assertions now target the specific step's `run:` field instead of the entire workflow file. ### Explicit out-of-scope - No Forgejo workflow behavior changes. - No apply runtime changes. - No break-glass or actor binding changes. - No changes to unrelated Infisical inventory files currently dirty in the worktree. ### Requested decision Review and merge if checks stay green. ### Merge blockers - Loss of apply workflow contract coverage. - Any structural helper masking a missing step/action/env/artifact path. ## Spec sources read - Forgejo issue #209 — acceptance criteria for structural workflow contract parsing. - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` — existing contract tests and refactor scope. - `control-plane/forgejo-actions/apply.yaml` — workflow contract under test. ## Validation - `UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_forgejo_ci_scripts_contract.py` — 42 passed - `UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run pytest platformctl/tests/test_apply_phase3.py platformctl/tests/test_apply_env_file.py platformctl/tests/test_pr_sanity.py platformctl/tests/test_forgejo_ci_scripts_contract.py platformctl/tests/test_health_phase3.py` — 208 passed - `PYTHONPATH=control-plane UV_CACHE_DIR=/private/tmp/codex-uv-cache uv run --project control-plane python -m platformctl.cli validate all --json` — passed, `exitCode=0` Closes #209

codex added 1 commit

2026-06-01 16:46:08 +02:00

test(platformctl): parse apply workflow contract structurally

canary-required / collect-diff (pull_request) Successful in 4s

Details

python-ci / Python 3.11 (pull_request) Successful in 36s

Details

python-ci / Python 3.12 (pull_request) Successful in 36s

Details

canary-required / canary (pull_request) Successful in 11s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 17s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 16s

Details

python-ci / Python 3.13 (pull_request) Successful in 36s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 3s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 17s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 3s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 3m37s

Details

ea85acc32d

codex added the

agent/codex

class/security-sensitive

risk/process

tier/full

labels

2026-06-01 16:46:26 +02:00

codex added this to the 06 - Agent execution and CI governance milestone

2026-06-01 16:46:27 +02:00

codex commented

2026-06-01 16:53:39 +02:00

Author

Collaborator

Patchwarden PR sanity

Status: advisory_findings
PR: 672
Commit: ea85acc32d257d04335e2a871166997b6d8964c8
Security-sensitive label: present
Authority: advisory model review plus deterministic blockers only
3+3 canary: still alive; this does not replace it

Deterministic findings

No deterministic findings.

Model reviewers

`global-glm` / `glm-5.1:cloud`

Status: ok
Verdict: OK
Findings: none

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.6:cloud`

Status: ok
Verdict: NOT_OK
high steps_by_name silently shadows duplicate step names, weakening contract assertions
- Evidence: control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py: steps_by_name() builds a dict comprehension keyed by step name, so duplicate names overwrite earlier entries. Previously the tests used next(step for step in steps if step
- Next: Change steps_by_name to return a list of tuples or assert name uniqueness, and provide first_step_named() / all_steps_named() helpers so callers explicitly choose match semantics.

Policy notes

GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot.
Optional red-team model is enabled only when PLATFORMCTL_PR_SANITY_REDTEAM_MODEL is configured.
Auto-merge is not enabled here.

# Patchwarden PR sanity - Status: `advisory_findings` - PR: `672` - Commit: `ea85acc32d257d04335e2a871166997b6d8964c8` - Security-sensitive label: `present` - Authority: advisory model review plus deterministic blockers only - 3+3 canary: still alive; this does not replace it ## Deterministic findings No deterministic findings. ## Model reviewers ### `global-glm` / `glm-5.1:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.6:cloud` - Status: `ok` - Verdict: `NOT_OK` - **`high`** steps_by_name silently shadows duplicate step names, weakening contract assertions - Evidence: `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py: steps_by_name() builds a dict comprehension keyed by step name, so duplicate names overwrite earlier entries. Previously the tests used next(step for step in steps if step` - Next: Change steps_by_name to return a list of tuples or assert name uniqueness, and provide first_step_named() / all_steps_named() helpers so callers explicitly choose match semantics. ## Policy notes - GLM 5.1 + DeepSeek V4 Pro are the operator-required model mix for this bot. - Optional red-team model is enabled only when `PLATFORMCTL_PR_SANITY_REDTEAM_MODEL` is configured. - Auto-merge is not enabled here.