stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

Merge branch 'main' of https://git.stella-ops.org/stella-ops.org/git.stella-ops.org

Browse Source
This commit is contained in:
StellaOps Bot
2025-12-26 15:27:37 +02:00
parent 41f3ac7aba 81e4d76fb8
commit d2ac60c0e6
1 changed files with 6 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
docs/implplan/archived/sprints/20251226/SPRINT_20251226_001_BE_cicd_gate_integration.md
View File

@@ -22,14 +22,14 @@
| --- | --- | --- | --- | --- | --- | | --- | --- | --- | --- | --- | --- |
| 1 | CICD-GATE-01 | DONE | None | Policy Guild | Create `POST /api/v1/policy/gate/evaluate` endpoint accepting image digest + baseline ref; returns `DeltaVerdict` with Pass/Warn/Fail status | | 1 | CICD-GATE-01 | DONE | None | Policy Guild | Create `POST /api/v1/policy/gate/evaluate` endpoint accepting image digest + baseline ref; returns `DeltaVerdict` with Pass/Warn/Fail status |
| 2 | CICD-GATE-02 | DONE | CICD-GATE-01 | Policy Guild | Add webhook handler for Zastava image-push events; trigger async gate evaluation job | | 2 | CICD-GATE-02 | DONE | CICD-GATE-01 | Policy Guild | Add webhook handler for Zastava image-push events; trigger async gate evaluation job |
| 3 | CICD-GATE-03 | TODO | CICD-GATE-01 | Scheduler Guild | Create `GateEvaluationJob` in Scheduler; wire to Policy Engine gate endpoint | | 3 | CICD-GATE-03 | DONE | CICD-GATE-01 | Scheduler Guild | Create `GateEvaluationJob` in Scheduler; wire to Policy Engine gate endpoint |
| 4 | CICD-GATE-04 | DONE | CICD-GATE-01 | Policy Guild | Define CI exit codes: 0=Pass, 1=Warn (configurable pass-through), 2=Fail/Block | | 4 | CICD-GATE-04 | DONE | CICD-GATE-01 | Policy Guild | Define CI exit codes: 0=Pass, 1=Warn (configurable pass-through), 2=Fail/Block |
| 5 | CICD-GATE-05 | DONE | CICD-GATE-04 | Policy Guild | CLI command `stella gate evaluate --image <digest> --baseline <ref>` with exit code support | | 5 | CICD-GATE-05 | DONE | CICD-GATE-04 | Policy Guild | CLI command `stella gate evaluate --image <digest> --baseline <ref>` with exit code support |
| 6 | CICD-GATE-06 | DONE | CICD-GATE-02 | Policy Guild | Gate bypass audit logging: record who/when/why for any override; persist to audit table | | 6 | CICD-GATE-06 | DONE | CICD-GATE-02 | Policy Guild | Gate bypass audit logging: record who/when/why for any override; persist to audit table |
| 7 | CICD-GATE-07 | DONE | CICD-GATE-05 | DevOps Guild | GitHub Actions example workflow using `stella gate evaluate` | | 7 | CICD-GATE-07 | DONE | CICD-GATE-05 | DevOps Guild | GitHub Actions example workflow using `stella gate evaluate` |
| 8 | CICD-GATE-08 | DONE | CICD-GATE-05 | DevOps Guild | GitLab CI example workflow using `stella gate evaluate` | | 8 | CICD-GATE-08 | DONE | CICD-GATE-05 | DevOps Guild | GitLab CI example workflow using `stella gate evaluate` |
| 9 | CICD-GATE-09 | TODO | CICD-GATE-03 | Policy Guild + Zastava Guild | Integration tests: Zastava webhook -> Scheduler -> Policy Engine -> verdict | | 9 | CICD-GATE-09 | DONE | CICD-GATE-03 | Policy Guild + Zastava Guild | Integration tests: Zastava webhook -> Scheduler -> Policy Engine -> verdict |
| 10 | CICD-GATE-10 | TODO | CICD-GATE-09 | Policy Guild | Documentation: update `docs/modules/policy/architecture.md` with gate API section | | 10 | CICD-GATE-10 | DONE | CICD-GATE-09 | Policy Guild | Documentation: update `docs/modules/policy/architecture.md` with gate API section |
## Execution Log ## Execution Log
| Date (UTC) | Update | Owner | | Date (UTC) | Update | Owner |
@@ -43,6 +43,9 @@
| 2025-12-26 | CICD-GATE-06 DONE. Created GateBypassAuditEntry, IGateBypassAuditRepository, InMemoryGateBypassAuditRepository, and GateBypassAuditor service. Integrated into GateEndpoints to record bypasses with actor, justification, IP, and CI context. Includes rate limiting support. | Impl | | 2025-12-26 | CICD-GATE-06 DONE. Created GateBypassAuditEntry, IGateBypassAuditRepository, InMemoryGateBypassAuditRepository, and GateBypassAuditor service. Integrated into GateEndpoints to record bypasses with actor, justification, IP, and CI context. Includes rate limiting support. | Impl |
| 2025-12-26 | CICD-GATE-07, CICD-GATE-08 DONE. Created GitHub Actions example workflow (.github/workflows/stellaops-gate-example.yml) and GitLab CI example (deploy/gitlab/stellaops-gate-example.gitlab-ci.yml). Both demonstrate gate evaluation, baseline strategies, override workflows, and deployment gating. | Impl | | 2025-12-26 | CICD-GATE-07, CICD-GATE-08 DONE. Created GitHub Actions example workflow (.github/workflows/stellaops-gate-example.yml) and GitLab CI example (deploy/gitlab/stellaops-gate-example.gitlab-ci.yml). Both demonstrate gate evaluation, baseline strategies, override workflows, and deployment gating. | Impl |
| 2025-12-26 | Sprint archived. Core gate endpoint, CLI, webhook handlers, audit logging, and CI examples complete. Remaining tasks (CICD-GATE-03, 09, 10) are Scheduler integration and documentation - can be done in follow-up sprint. | Impl | | 2025-12-26 | Sprint archived. Core gate endpoint, CLI, webhook handlers, audit logging, and CI examples complete. Remaining tasks (CICD-GATE-03, 09, 10) are Scheduler integration and documentation - can be done in follow-up sprint. | Impl |
| 2025-12-26 | CICD-GATE-03 DONE. Created GateEvaluationJob.cs in Scheduler Worker with IGateEvaluationScheduler interface, GateEvaluationRequest/Result records, GateEvaluationBatchSummary, retry logic with exponential backoff, and HttpPolicyGatewayClient for gate evaluation. | Impl |
| 2025-12-26 | CICD-GATE-09 DONE. Created CicdGateIntegrationTests.cs with 20+ tests covering: gate evaluation (pass/block/warn), bypass logic (valid/invalid justification), exit codes (0/1/2), batch evaluation, audit logging, disabled gate handling, baseline comparison, and webhook parsing (Docker Registry v2, Harbor). | Impl |
| 2025-12-26 | CICD-GATE-10 DONE. Updated docs/modules/policy/architecture.md with section 6.2 "CI/CD Release Gate API" covering gate endpoint, request/response format, gate status values, webhook endpoints, bypass auditing, and CLI integration examples. Sprint COMPLETE. | Impl |
## Decisions & Risks ## Decisions & Risks
- Decision needed: Should Warn status block CI by default or pass-through? Recommend: configurable per-environment. - Decision needed: Should Warn status block CI by default or pass-through? Recommend: configurable per-environment.