thanhnvandClaude Opus 4.8
8c20cfde9f
Organize CASAN as a reusable source hub with SPLIT releases so downstream adopts only the level it needs (packaging/levels.json is the single source of truth). Implemented now: - Level 1 Core: bin/casan CLI (run/gate/test/verify/reuse/dashboard) + VERSION. - Level 2 DevKit: packages/casan-devkit (install.sh, Dockerfile.harness, templates: project scaffold, domain-pack, gitea-workflow). - scripts/package-release.sh core|devkit|platform|all-in-one-demo — builds split bundles into dist/ (BUNDLE-MANIFEST + SHA256SUMS); platform is stamped PREVIEW/INCOMPLETE; enterprise (future) is REFUSED (exit 3, no fake-complete package). Bundles verified: extract → bin/casan works, deterministic + domain suites pass, casan reuse VALID. - docs/packaging: CASAN_PACKAGING_PLAN + ADOPTION + CI + DOMAIN_PACK + GITEA_PACKAGE + DOCKER. Structure + docs only: - Level 3 packages/casan-platform (dashboard exists; control-panel/viewers pending). - Level 4 packages/casan-enterprise (RBAC/tenant/KMS/WORM/approval exist in core; governed console pending). No Chat Console/RBAC-console/tenant-console/model-mgmt built in this task. Harness change (enables extracted bundles to self-resolve): casan-paths.sh + the Python project_root() walk-ups now accept a second root marker `packages/casan-harness` in addition to `.specify`, so a freshly-unpacked core/devkit/demo bundle (no `.specify` yet) roots correctly and creates state on first run. In an adopted repo `.specify` still matches first. policy-bundle.yaml paths corrected to packages/casan-harness (re-signed). Full gate 64/0/3. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
48 lines
2.1 KiB
Markdown
48 lines
2.1 KiB
Markdown
# CASAN CI Guide (Gitea Actions)
|
|
|
|
Wire the CASAN governance gate into your project's CI so every push/PR is governed.
|
|
|
|
## 1. Add the workflow
|
|
DevKit `install.sh` already drops `.gitea/workflows/casan-ci.yml`. To add manually, copy the
|
|
template:
|
|
```bash
|
|
cp packages/casan-devkit/templates/gitea-workflow/ci.yml .gitea/workflows/casan-ci.yml
|
|
```
|
|
|
|
## 2. What it runs
|
|
```yaml
|
|
- bash packages/casan-harness/scripts/bash/ci-harness-gate.sh # all governance suites
|
|
- bash packages/casan-harness/scripts/bash/verify-audit-chain.sh
|
|
- bash packages/casan-harness/scripts/bash/sign-policy-bundle.sh verify
|
|
```
|
|
|
|
## 3. Environment knobs
|
|
| Var | Default | Use |
|
|
|---|---|---|
|
|
| `CASAN_CI_RUN_FRONTEND` | 0 | 1 if you have a frontend workspace |
|
|
| `CASAN_CI_RUN_BACKEND` | 0 | 1 to run backend tests |
|
|
| `CASAN_CI_RUN_INFRA_LAB` | 0 | 1 to run the Docker infra lab |
|
|
| `CASAN_CI_STEP_TIMEOUT_SEC` | 600 | raise to 1200 — some suites are model-backed and run ~450s; 600 flakes under load |
|
|
| `CASAN_CI_SUITE_FILTER` | — | regex to run a subset of suites |
|
|
| `CASAN_DOMAIN_ROOT` | apps/okr/domain | point at your project's domain |
|
|
|
|
## 4. Runner
|
|
Uses `runs-on: ci-runner` (a self-hosted Gitea Actions runner). To set one up on your host,
|
|
see `.gitea/vps-setup-runbook.md` and `scripts/setup-ci-runner.sh`. The runner needs
|
|
`bash`, `python3`, `openssl` (and `node`/`npm` only if you enable frontend/backend tests).
|
|
|
|
## 5. Expected result
|
|
`CI_GATE_SUMMARY PASS=<n> FAIL=0 SKIP=<k>`. Any FAIL fails the job (exit 1). The gate is
|
|
**fail-closed**: missing signatures/policy in enforced mode (`CASAN_PROFILE=prod` or
|
|
`CASAN_VERIFY_STRICT=1`) also fail.
|
|
|
|
## 6. This repo's own CI
|
|
The source hub's active pipeline is `.gitea/workflows/ci.yml` (frontend tests → security
|
|
gate → deploy). It already runs the gate from the promoted root layout
|
|
(`packages/casan-harness/...`). Use it as a worked example.
|
|
|
|
## Tips
|
|
- Keep the gate green as an invariant; every new control must ship a fail-able adversarial test.
|
|
- Do not stage runtime log artifacts (`.specify/logs`, evidence) produced by gate runs.
|
|
- For a quick local pre-push check: `bin/casan gate` (or a filtered subset).
|