save progress

.gitea/config/path-filters.yml

@@ -0,0 +1,533 @@
+# =============================================================================
+# CENTRALIZED PATH FILTER DEFINITIONS
+# =============================================================================
+# This file documents the path filters used across all CI/CD workflows.
+# Each workflow should reference these patterns for consistency.
+#
+# Last updated: 2025-12-28
+# =============================================================================
+
+# -----------------------------------------------------------------------------
+# INFRASTRUCTURE FILES - Changes trigger FULL CI
+# -----------------------------------------------------------------------------
+infrastructure:
+  - 'Directory.Build.props'
+  - 'Directory.Build.rsp'
+  - 'Directory.Packages.props'
+  - 'src/Directory.Build.props'
+  - 'src/Directory.Packages.props'
+  - 'nuget.config'
+  - 'StellaOps.sln'
+
+# -----------------------------------------------------------------------------
+# DOCUMENTATION - Should NOT trigger builds (paths-ignore)
+# -----------------------------------------------------------------------------
+docs_ignore:
+  - 'docs/**'
+  - '*.md'
+  - '!CLAUDE.md'      # Exception: Agent instructions SHOULD trigger
+  - '!AGENTS.md'      # Exception: Module guidance SHOULD trigger
+  - 'etc/**'
+  - 'LICENSE'
+  - '.gitignore'
+  - '.editorconfig'
+
+# -----------------------------------------------------------------------------
+# SHARED LIBRARIES - Trigger cascading tests
+# -----------------------------------------------------------------------------
+shared_libraries:
+  # Cryptography - CRITICAL, affects all security modules
+  cryptography:
+    paths:
+      - 'src/__Libraries/StellaOps.Cryptography*/**'
+      - 'src/Cryptography/**'
+    cascades_to:
+      - scanner
+      - attestor
+      - authority
+      - evidence_locker
+      - signer
+      - airgap
+
+  # Evidence & Provenance - Affects attestation chain
+  evidence:
+    paths:
+      - 'src/__Libraries/StellaOps.Evidence*/**'
+      - 'src/__Libraries/StellaOps.Provenance/**'
+    cascades_to:
+      - scanner
+      - attestor
+      - evidence_locker
+      - export_center
+      - sbom_service
+
+  # Infrastructure - Affects all database-backed modules
+  infrastructure:
+    paths:
+      - 'src/__Libraries/StellaOps.Infrastructure*/**'
+      - 'src/__Libraries/StellaOps.DependencyInjection/**'
+    cascades_to:
+      - all_integration_tests
+
+  # Replay & Determinism - Affects reproducibility tests
+  replay:
+    paths:
+      - 'src/__Libraries/StellaOps.Replay*/**'
+      - 'src/__Libraries/StellaOps.Testing.Determinism/**'
+    cascades_to:
+      - scanner
+      - determinism_tests
+      - replay
+
+  # Verdict & Policy Primitives
+  verdict:
+    paths:
+      - 'src/__Libraries/StellaOps.Verdict/**'
+      - 'src/__Libraries/StellaOps.DeltaVerdict/**'
+    cascades_to:
+      - policy
+      - risk_engine
+      - reach_graph
+
+  # Plugin Framework
+  plugin:
+    paths:
+      - 'src/__Libraries/StellaOps.Plugin/**'
+    cascades_to:
+      - authority
+      - scanner
+      - concelier
+
+  # Configuration
+  configuration:
+    paths:
+      - 'src/__Libraries/StellaOps.Configuration/**'
+    cascades_to:
+      - all_modules
+
+# -----------------------------------------------------------------------------
+# MODULE PATHS - Each module with its source and test paths
+# -----------------------------------------------------------------------------
+modules:
+  # Scanning & Analysis
+  scanner:
+    source:
+      - 'src/Scanner/**'
+      - 'src/BinaryIndex/**'
+    tests:
+      - 'src/Scanner/__Tests/**'
+      - 'src/BinaryIndex/__Tests/**'
+    workflows:
+      - 'scanner-*.yml'
+      - 'scanner-analyzers*.yml'
+    dependencies:
+      - 'src/__Libraries/StellaOps.Evidence*/**'
+      - 'src/__Libraries/StellaOps.Cryptography*/**'
+      - 'src/__Libraries/StellaOps.Replay*/**'
+      - 'src/__Libraries/StellaOps.Provenance/**'
+
+  binary_index:
+    source:
+      - 'src/BinaryIndex/**'
+    tests:
+      - 'src/BinaryIndex/__Tests/**'
+
+  # Data Ingestion
+  concelier:
+    source:
+      - 'src/Concelier/**'
+    tests:
+      - 'src/Concelier/__Tests/**'
+    workflows:
+      - 'concelier-*.yml'
+      - 'connector-*.yml'
+    dependencies:
+      - 'src/__Libraries/StellaOps.Plugin/**'
+
+  excititor:
+    source:
+      - 'src/Excititor/**'
+    tests:
+      - 'src/Excititor/__Tests/**'
+    workflows:
+      - 'vex-*.yml'
+      - 'export-*.yml'
+
+  vexlens:
+    source:
+      - 'src/VexLens/**'
+    tests:
+      - 'src/VexLens/__Tests/**'
+
+  vexhub:
+    source:
+      - 'src/VexHub/**'
+    tests:
+      - 'src/VexHub/__Tests/**'
+
+  # Core Platform
+  authority:
+    source:
+      - 'src/Authority/**'
+    tests:
+      - 'src/Authority/__Tests/**'
+    workflows:
+      - 'authority-*.yml'
+    dependencies:
+      - 'src/__Libraries/StellaOps.Cryptography*/**'
+      - 'src/__Libraries/StellaOps.Plugin/**'
+
+  gateway:
+    source:
+      - 'src/Gateway/**'
+    tests:
+      - 'src/Gateway/__Tests/**'
+
+  router:
+    source:
+      - 'src/Router/**'
+    tests:
+      - 'src/Router/__Tests/**'
+    workflows:
+      - 'router-*.yml'
+
+  # Artifacts & Evidence
+  attestor:
+    source:
+      - 'src/Attestor/**'
+    tests:
+      - 'src/Attestor/__Tests/**'
+    workflows:
+      - 'attestation-*.yml'
+      - 'attestor-*.yml'
+    dependencies:
+      - 'src/__Libraries/StellaOps.Cryptography*/**'
+      - 'src/__Libraries/StellaOps.Evidence*/**'
+      - 'src/__Libraries/StellaOps.Provenance/**'
+
+  sbom_service:
+    source:
+      - 'src/SbomService/**'
+    tests:
+      - 'src/SbomService/__Tests/**'
+    dependencies:
+      - 'src/__Libraries/StellaOps.Evidence*/**'
+
+  evidence_locker:
+    source:
+      - 'src/EvidenceLocker/**'
+    tests:
+      - 'src/EvidenceLocker/__Tests/**'
+    workflows:
+      - 'evidence-*.yml'
+    dependencies:
+      - 'src/__Libraries/StellaOps.Evidence*/**'
+      - 'src/__Libraries/StellaOps.Cryptography*/**'
+
+  export_center:
+    source:
+      - 'src/ExportCenter/**'
+    tests:
+      - 'src/ExportCenter/__Tests/**'
+    workflows:
+      - 'export-*.yml'
+
+  findings:
+    source:
+      - 'src/Findings/**'
+    tests:
+      - 'src/Findings/__Tests/**'
+    workflows:
+      - 'findings-*.yml'
+      - 'ledger-*.yml'
+
+  provenance:
+    source:
+      - 'src/Provenance/**'
+    tests:
+      - 'src/Provenance/__Tests/**'
+    workflows:
+      - 'provenance-*.yml'
+
+  signer:
+    source:
+      - 'src/Signer/**'
+    tests:
+      - 'src/Signer/__Tests/**'
+    dependencies:
+      - 'src/__Libraries/StellaOps.Cryptography*/**'
+
+  # Policy & Risk
+  policy:
+    source:
+      - 'src/Policy/**'
+    tests:
+      - 'src/Policy/__Tests/**'
+    workflows:
+      - 'policy-*.yml'
+    dependencies:
+      - 'src/__Libraries/StellaOps.Verdict/**'
+
+  risk_engine:
+    source:
+      - 'src/RiskEngine/**'
+    tests:
+      - 'src/RiskEngine/__Tests/**'
+    dependencies:
+      - 'src/__Libraries/StellaOps.Verdict/**'
+
+  reach_graph:
+    source:
+      - 'src/ReachGraph/**'
+    tests:
+      - 'src/ReachGraph/__Tests/**'
+    workflows:
+      - 'reachability-*.yml'
+    dependencies:
+      - 'src/__Libraries/StellaOps.ReachGraph*/**'
+
+  # Operations
+  notify:
+    source:
+      - 'src/Notify/**'
+      - 'src/Notifier/**'
+    tests:
+      - 'src/Notify/__Tests/**'
+    workflows:
+      - 'notify-*.yml'
+
+  orchestrator:
+    source:
+      - 'src/Orchestrator/**'
+    tests:
+      - 'src/Orchestrator/__Tests/**'
+
+  scheduler:
+    source:
+      - 'src/Scheduler/**'
+    tests:
+      - 'src/Scheduler/__Tests/**'
+
+  task_runner:
+    source:
+      - 'src/TaskRunner/**'
+    tests:
+      - 'src/TaskRunner/__Tests/**'
+
+  packs_registry:
+    source:
+      - 'src/PacksRegistry/**'
+    tests:
+      - 'src/PacksRegistry/__Tests/**'
+    workflows:
+      - 'packs-*.yml'
+
+  replay:
+    source:
+      - 'src/Replay/**'
+    tests:
+      - 'src/Replay/__Tests/**'
+    workflows:
+      - 'replay-*.yml'
+    dependencies:
+      - 'src/__Libraries/StellaOps.Replay*/**'
+
+  # Infrastructure
+  cryptography:
+    source:
+      - 'src/Cryptography/**'
+    tests:
+      - 'src/__Libraries/__Tests/StellaOps.Cryptography*/**'
+    workflows:
+      - 'crypto-*.yml'
+
+  telemetry:
+    source:
+      - 'src/Telemetry/**'
+    tests:
+      - 'src/Telemetry/__Tests/**'
+
+  signals:
+    source:
+      - 'src/Signals/**'
+    tests:
+      - 'src/Signals/__Tests/**'
+    workflows:
+      - 'signals-*.yml'
+
+  airgap:
+    source:
+      - 'src/AirGap/**'
+    tests:
+      - 'src/AirGap/__Tests/**'
+    workflows:
+      - 'airgap-*.yml'
+      - 'offline-*.yml'
+    dependencies:
+      - 'src/__Libraries/StellaOps.Cryptography*/**'
+
+  aoc:
+    source:
+      - 'src/Aoc/**'
+    tests:
+      - 'src/Aoc/__Tests/**'
+    workflows:
+      - 'aoc-*.yml'
+
+  # Integration
+  cli:
+    source:
+      - 'src/Cli/**'
+    tests:
+      - 'src/Cli/__Tests/**'
+    workflows:
+      - 'cli-*.yml'
+
+  web:
+    source:
+      - 'src/Web/**'
+    tests:
+      - 'src/Web/**/*.spec.ts'
+    workflows:
+      - 'lighthouse-*.yml'
+
+  issuer_directory:
+    source:
+      - 'src/IssuerDirectory/**'
+    tests:
+      - 'src/IssuerDirectory/__Tests/**'
+
+  mirror:
+    source:
+      - 'src/Mirror/**'
+    tests:
+      - 'src/Mirror/__Tests/**'
+    workflows:
+      - 'mirror-*.yml'
+
+  advisory_ai:
+    source:
+      - 'src/AdvisoryAI/**'
+    tests:
+      - 'src/AdvisoryAI/__Tests/**'
+    workflows:
+      - 'advisory-*.yml'
+
+  symbols:
+    source:
+      - 'src/Symbols/**'
+    tests:
+      - 'src/Symbols/__Tests/**'
+    workflows:
+      - 'symbols-*.yml'
+
+  graph:
+    source:
+      - 'src/Graph/**'
+    tests:
+      - 'src/Graph/__Tests/**'
+    workflows:
+      - 'graph-*.yml'
+
+# -----------------------------------------------------------------------------
+# DEVOPS & CI/CD - Changes affecting infrastructure
+# -----------------------------------------------------------------------------
+devops:
+  docker:
+    - 'devops/docker/**'
+    - '**/Dockerfile'
+  compose:
+    - 'devops/compose/**'
+  helm:
+    - 'devops/helm/**'
+  database:
+    - 'devops/database/**'
+  scripts:
+    - '.gitea/scripts/**'
+  workflows:
+    - '.gitea/workflows/**'
+
+# -----------------------------------------------------------------------------
+# TEST INFRASTRUCTURE
+# -----------------------------------------------------------------------------
+test_infrastructure:
+  global_tests:
+    - 'src/__Tests/**'
+  shared_libraries:
+    - 'src/__Tests/__Libraries/**'
+  datasets:
+    - 'src/__Tests/__Datasets/**'
+  benchmarks:
+    - 'src/__Tests/__Benchmarks/**'
+
+# -----------------------------------------------------------------------------
+# TRIGGER CATEGORY DEFINITIONS
+# -----------------------------------------------------------------------------
+# Reference for which workflows belong to each trigger category
+
+categories:
+  # Category A: PR-Gating (MUST PASS for merge)
+  pr_gating:
+    trigger: 'pull_request + push to main'
+    workflows:
+      - build-test-deploy.yml
+      - test-matrix.yml
+      - determinism-gate.yml
+      - policy-lint.yml
+      - sast-scan.yml
+      - secrets-scan.yml
+      - dependency-license-gate.yml
+
+  # Category B: Main-Branch Only (Post-merge verification)
+  main_only:
+    trigger: 'push to main only'
+    workflows:
+      - container-scan.yml
+      - integration-tests-gate.yml
+      - api-governance.yml
+      - aoc-guard.yml
+      - provenance-check.yml
+      - manifest-integrity.yml
+
+  # Category C: Module-Specific (Selective by path)
+  module_specific:
+    trigger: 'PR + main with path filters'
+    patterns:
+      - 'scanner-*.yml'
+      - 'concelier-*.yml'
+      - 'authority-*.yml'
+      - 'attestor-*.yml'
+      - 'policy-*.yml'
+      - 'evidence-*.yml'
+      - 'export-*.yml'
+      - 'notify-*.yml'
+      - 'router-*.yml'
+      - 'crypto-*.yml'
+
+  # Category D: Release/Deploy (Tag or Manual only)
+  release:
+    trigger: 'tags or workflow_dispatch only'
+    workflows:
+      - release-suite.yml
+      - module-publish.yml
+      - service-release.yml
+      - cli-build.yml
+      - containers-multiarch.yml
+      - rollback.yml
+      - promote.yml
+    tag_patterns:
+      suite: 'suite-*'
+      module: 'module-*-v*'
+      service: 'service-*-v*'
+      cli: 'cli-v*'
+      bundle: 'v*.*.*'
+
+  # Category E: Scheduled (Nightly/Weekly)
+  scheduled:
+    workflows:
+      - nightly-regression.yml      # Daily 2:00 UTC
+      - dependency-security-scan.yml # Weekly Sun 2:00 UTC
+      - container-scan.yml          # Daily 4:00 UTC (also main-only)
+      - sast-scan.yml              # Weekly Mon 3:30 UTC
+      - renovate.yml               # Daily 3:00, 15:00 UTC
+      - benchmark-vs-competitors.yml # Weekly Sat 1:00 UTC