up
This commit is contained in:
StellaOps Bot
@@ -10,5 +10,7 @@ Artifacts supporting `DEVOPS-AIRGAP-56-001`:
|
||||
- `build_bootstrap_pack.py` — Builds a Bootstrap Pack from images/charts/extras listed in a JSON config, writing `bootstrap-manifest.json` + `checksums.sha256` deterministically.
|
||||
- `build_bootstrap_pack.sh` — Wrapper for the bootstrap pack builder.
|
||||
- `build_mirror_bundle.py` — Generates mirror bundle manifest + checksums with dual-control approvals; optional cosign signing. Outputs `mirror-bundle-manifest.json`, `checksums.sha256`, and optional signature/cert.
|
||||
- `compose-syslog-smtp.yaml` — Local SMTP (MailHog) + syslog-ng stack for sealed environments.
|
||||
- `health_syslog_smtp.sh` — Brings up the syslog/SMTP stack via docker compose and performs health checks (MailHog API + syslog logger).
|
||||
|
||||
See also `ops/devops/sealed-mode-ci/` for the full sealed-mode compose harness and `egress_probe.py`, which this verification script wraps.
|
||||
|
||||
31
ops/devops/airgap/compose-syslog-smtp.yaml
Normal file
31
ops/devops/airgap/compose-syslog-smtp.yaml
Normal file
@@ -0,0 +1,31 @@
|
||||
version: "3.9"
|
||||
|
||||
services:
|
||||
smtp:
|
||||
image: mailhog/mailhog:v1.0.1
|
||||
container_name: mailhog
|
||||
ports:
|
||||
- "1025:1025" # SMTP (plain)
|
||||
- "8025:8025" # Web UI
|
||||
healthcheck:
|
||||
test: ["CMD", "wget", "-qO-", "http://localhost:8025/api/v2/health"]
|
||||
interval: 10s
|
||||
timeout: 3s
|
||||
retries: 5
|
||||
start_period: 5s
|
||||
restart: unless-stopped
|
||||
|
||||
syslog:
|
||||
image: balabit/syslog-ng:4.7.1
|
||||
container_name: syslog-ng
|
||||
ports:
|
||||
- "514:514/udp"
|
||||
- "514:514/tcp"
|
||||
command: ["/usr/sbin/syslog-ng", "-F", "-p", "/var/run/syslogd.pid"]
|
||||
healthcheck:
|
||||
test: ["CMD", "syslog-ng-ctl", "stats"]
|
||||
interval: 10s
|
||||
timeout: 3s
|
||||
retries: 5
|
||||
start_period: 5s
|
||||
restart: unless-stopped
|
||||
23
ops/devops/airgap/health_syslog_smtp.sh
Normal file
23
ops/devops/airgap/health_syslog_smtp.sh
Normal file
@@ -0,0 +1,23 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
# Health check for compose-syslog-smtp.yaml (DEVOPS-AIRGAP-58-001)
|
||||
|
||||
COMPOSE_FILE="$(cd "$(dirname "$0")" && pwd)/compose-syslog-smtp.yaml"
|
||||
|
||||
echo "Starting syslog+smtp stack..."
|
||||
docker compose -f "$COMPOSE_FILE" up -d
|
||||
|
||||
echo "Waiting for health checks..."
|
||||
docker compose -f "$COMPOSE_FILE" wait >/dev/null 2>&1 || true
|
||||
|
||||
echo "Current health status:"
|
||||
docker compose -f "$COMPOSE_FILE" ps
|
||||
|
||||
echo "Sending test syslog message (UDP)..."
|
||||
logger -n 127.0.0.1 -P 514 -d "test syslog message $(date -u +%s)"
|
||||
|
||||
echo "SMTP health endpoint:"
|
||||
curl -sf http://127.0.0.1:8025/api/v2/health || exit 1
|
||||
|
||||
echo "Done."
|
||||
29
ops/devops/sbom-ci-runner/README.md
Normal file
29
ops/devops/sbom-ci-runner/README.md
Normal file
@@ -0,0 +1,29 @@
|
||||
# SBOM Service CI Runner Harness (DEVOPS-SBOM-23-001)
|
||||
|
||||
Purpose: deterministic, offline-friendly CI harness for SBOM Service. Produces warmed-cache restore, build binlog, TRX outputs, and a NuGet cache hash to unblock SBOM console/consumer sprints.
|
||||
|
||||
Usage
|
||||
- From repo root run: `ops/devops/sbom-ci-runner/run-sbom-ci.sh`
|
||||
- Outputs land in `ops/devops/artifacts/sbom-ci/<UTC timestamp>/`:
|
||||
- `build.binlog` (solution build)
|
||||
- `tests/sbom.trx` (VSTest results)
|
||||
- `nuget-cache.hash` (sha256 over file name+size listing for offline cache traceability)
|
||||
- `summary.json` (paths + sources + cache hash)
|
||||
|
||||
Environment defaults
|
||||
- `DOTNET_CLI_TELEMETRY_OPTOUT=1`, `DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1`, `DOTNET_RESTORE_DISABLE_PARALLEL=1`
|
||||
- `NUGET_PACKAGES=$REPO/.nuget/packages`
|
||||
- `NUGET_SOURCES=$REPO/local-nugets;$REPO/.nuget/packages`
|
||||
- `TEST_FILTER` empty (set to narrow tests)
|
||||
|
||||
What it does
|
||||
1) Warm NuGet cache from `local-nugets/` into `$NUGET_PACKAGES` for air-gap parity.
|
||||
2) `dotnet restore` + `dotnet build` on `src/SbomService/StellaOps.SbomService.sln` with `/bl`.
|
||||
3) Run `StellaOps.SbomService.Tests` with TRX output (honors `TEST_FILTER`).
|
||||
4) Produce `nuget-cache.hash` using sorted file name+size list hashed with sha256 (lightweight evidence of cache contents).
|
||||
5) Emit `summary.json` with artefact paths and cache hash value.
|
||||
|
||||
Notes
|
||||
- Offline-only; no external services required.
|
||||
- Timestamped output folders keep ordering deterministic; consumers should sort lexicographically.
|
||||
- Extend `test_project` in the script if additional SBOM test projects are added.
|
||||
72
ops/devops/sbom-ci-runner/run-sbom-ci.sh
Normal file
72
ops/devops/sbom-ci-runner/run-sbom-ci.sh
Normal file
@@ -0,0 +1,72 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
# SBOM Service CI runner (DEVOPS-SBOM-23-001)
|
||||
# Builds SBOM solution and runs tests with warmed NuGet cache; emits binlog + TRX + cache hash summary.
|
||||
|
||||
repo_root="$(cd "$(dirname "$0")/../../.." && pwd)"
|
||||
ts="$(date -u +%Y%m%dT%H%M%SZ)"
|
||||
out_dir="$repo_root/ops/devops/artifacts/sbom-ci/$ts"
|
||||
logs_dir="$out_dir/tests"
|
||||
mkdir -p "$logs_dir"
|
||||
|
||||
export DOTNET_CLI_TELEMETRY_OPTOUT=${DOTNET_CLI_TELEMETRY_OPTOUT:-1}
|
||||
export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=${DOTNET_SKIP_FIRST_TIME_EXPERIENCE:-1}
|
||||
export DOTNET_RESTORE_DISABLE_PARALLEL=${DOTNET_RESTORE_DISABLE_PARALLEL:-1}
|
||||
export NUGET_PACKAGES=${NUGET_PACKAGES:-$repo_root/.nuget/packages}
|
||||
export NUGET_SOURCES=${NUGET_SOURCES:-"$repo_root/local-nugets;$repo_root/.nuget/packages"}
|
||||
export TEST_FILTER=${TEST_FILTER:-""}
|
||||
|
||||
mkdir -p "$NUGET_PACKAGES"
|
||||
rsync -a "$repo_root/local-nugets/" "$NUGET_PACKAGES/" >/dev/null 2>&1 || true
|
||||
|
||||
restore_sources=()
|
||||
IFS=';' read -ra SRC_ARR <<< "$NUGET_SOURCES"
|
||||
for s in "${SRC_ARR[@]}"; do
|
||||
[[ -n "$s" ]] && restore_sources+=(--source "$s")
|
||||
done
|
||||
|
||||
solution="$repo_root/src/SbomService/StellaOps.SbomService.sln"
|
||||
dotnet restore "$solution" --ignore-failed-sources "${restore_sources[@]}"
|
||||
|
||||
build_binlog="$out_dir/build.binlog"
|
||||
dotnet build "$solution" -c Release /p:ContinuousIntegrationBuild=true /bl:"$build_binlog"
|
||||
|
||||
trx_name="sbom.trx"
|
||||
test_project="$repo_root/src/SbomService/StellaOps.SbomService.Tests/StellaOps.SbomService.Tests.csproj"
|
||||
common_test_args=( -c Release --no-build --results-directory "$logs_dir" )
|
||||
if [[ -n "$TEST_FILTER" ]]; then
|
||||
common_test_args+=( --filter "$TEST_FILTER" )
|
||||
fi
|
||||
|
||||
if [[ -f "$test_project" ]]; then
|
||||
dotnet test "$test_project" "${common_test_args[@]}" --logger "trx;LogFileName=$trx_name"
|
||||
fi
|
||||
|
||||
# Lightweight cache hash: list files with size, hash the listing
|
||||
cache_listing="$out_dir/nuget-cache.list"
|
||||
find "$NUGET_PACKAGES" -type f -printf "%P %s\n" | sort > "$cache_listing"
|
||||
cache_hash=$(sha256sum "$cache_listing" | awk '{print $1}')
|
||||
|
||||
echo "$cache_hash nuget-cache.list" > "$out_dir/nuget-cache.hash"
|
||||
|
||||
summary="$out_dir/summary.json"
|
||||
{
|
||||
printf '{\n'
|
||||
printf ' "timestamp_utc": "%s",\n' "$ts"
|
||||
printf ' "build_binlog": "%s",\n' "${build_binlog#${repo_root}/}"
|
||||
printf ' "tests": [\n'
|
||||
printf ' {"project":"SbomService","trx":"%s"}\n' "${logs_dir#${repo_root}/}/$trx_name"
|
||||
printf ' ],\n'
|
||||
printf ' "nuget_packages": "%s",\n' "${NUGET_PACKAGES#${repo_root}/}"
|
||||
printf ' "cache_hash": "%s",\n' "$cache_hash"
|
||||
printf ' "sources": [\n'
|
||||
for i in "${!SRC_ARR[@]}"; do
|
||||
sep=","; [[ $i -eq $((${#SRC_ARR[@]}-1)) ]] && sep=""
|
||||
printf ' "%s"%s\n' "${SRC_ARR[$i]}" "$sep"
|
||||
done
|
||||
printf ' ]\n'
|
||||
printf '}\n'
|
||||
} > "$summary"
|
||||
|
||||
echo "Artifacts written to ${out_dir#${repo_root}/}"
|
||||
Reference in New Issue
Block a user