Rcx hardening #62

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open

Agaslez wants to merge 103 commits into main from rcx-hardening

.cerber/contract.yml

-Original file line number
+Diff line change
@@ -1,71 +1,223 @@
-    # Node.js CI Contract
-    # Base contract for Node.js projects with npm/yarn
+    # Cerber Core: One Truth CI/CD Architecture
+    # Source of truth for gates, protected files, and test organization
+    # This contract drives automatic generation of CERBER.md and workflows
+    # DO NOT EDIT GENERATED FILES - edit this contract instead, then run: npm run cerber:generate
     contractVersion: 1
     name: nodejs-ci-contract
     version: 1.0.0
     metadata:
-      description: 'Base contract for Node.js CI/CD workflows'
+      description: 'One Truth: CI gates, test tags, protected files'
       author: 'Cerber Core'
       tags:
         - nodejs
         - npm
-        - ci
-    # Extend base nodejs contract
-    extends: '@cerber-core/contracts/nodejs-base'
-    defaults:
-      permissionsPolicy:
-        maxLevel: read
-        allowedScopes:
-          - contents
-          - pull-requests
-      actionPinning: required
-      secretsPolicy: no-hardcoded
-      nodeVersion:
-        required: true
-        minVersion: '18.0.0'
+        - ci-gates
+        - test-organization
+      generatedFilesHeader: 'AUTO-GENERATED BY CERBER — DO NOT EDIT'
+    # ============================================
+    # Rule Configuration
+    # ============================================
     rules:
-      # Security rules
-      security/no-hardcoded-secrets:
+      'security/no-hardcoded-secrets':
         severity: error
-        gate: true  # Always block merge
-      security/require-action-pinning:
-        severity: error
-        gate: true
-      security/limit-permissions:
+        gate: true  # Always block
+      'security/limit-permissions':
         severity: error
         gate: false  # Warn but don't block
-      security/no-wildcard-triggers:
-        severity: warning
-      security/checkout-persist-credentials:
-        severity: warning
-      # Best practices
-      best-practices/cache-dependencies:
-        severity: warning
-      best-practices/setup-node-with-version:
-        severity: error
-      best-practices/parallelize-matrix:
+      'best-practices/cache-dependencies':
         severity: warning
+        # gate: undefined (falls back to profile.failOn)
+    # ============================================
+    # GOAL 1: CI Gate Separation (FAST vs HEAVY)
+    # ============================================
+    gates:
+      fast:
+        name: 'PR Fast Checks'
+        description: 'Fast gates for PR validation (< 5 min)'
+        requiredOn: pull_request
+        timeout: 300  # 5 minutes
+        jobs:
+          - name: lint_and_typecheck
+            description: 'ESLint + TypeScript type check'
+            command: 'npm run lint && npx tsc --noEmit'
+          - name: build_and_unit
+            description: 'Build + unit tests only'
+            command: 'npm run build && npm run test:fast'
+        commands:
+          - npm ci
+          - npm run build
+          - npm run lint
+          - npm run test:fast
+        testFilters:
+          - '@fast'
+        excludeTests:
+          - '**/cli-signals.test.ts'
+          - '**/npm-pack-install.test.ts'
+          - '**/e2e/**'
-      # Performance
-      performance/avoid-unnecessary-checkout:
-        severity: warning
-      performance/use-composite-actions:
-        severity: info
+      heavy:
+        name: 'Heavy Verification'
+        description: 'Heavy gates for main branch and nightly runs'
+        requiredOn:
+          - push  # main branch only
+        optionalOn:
+          - pull_request  # Available but not required for PR
+        timeout: 1800  # 30 minutes
+        jobs:
+          - name: integration_tests
+            description: 'Real git ops, file discovery, adapters'
+            command: 'npm run test:integration'
+          - name: e2e_tests
+            description: 'npm-pack, install-from-tarball, multi-mode'
+            command: 'npm run test:e2e'
+          - name: signals_tests
+            description: 'Process signal handling'
+            command: 'npm run test:signals'
+        testTags:
+          - '@integration'
+          - '@e2e'
+          - '@signals'
+        retries: 1
+        retryTimeoutIncrement: 5000
+    # ============================================
+    # GOAL 2: Test Organization with Tags
+    # ============================================
+    testTags:
+      fast:
+        name: 'Fast Unit Tests'
+        description: 'Unit tests, deterministic, <1s each'
+        command: 'npm run test:fast'
+        timeout: 1000
+        maxRetries: 0
+        jestArgs: '--testNamePattern="@fast"'
+        examples:
+          - 'schema validation'
+          - 'parser unit tests'
+          - 'utility functions'
+      integration:
+        name: 'Integration Tests'
+        description: 'Real git ops, file discovery, real adapters'
+        command: 'npm run test:integration'
+        timeout: 5000
+        maxRetries: 0
+        jestArgs: '--testNamePattern="@integration"'
+        includes:
+          - 'orchestrator real git'
+          - 'file discovery with globs'
+          - 'adapter real tool execution'
+        exclusions:
+          - 'mocked dependencies'
+      e2e:
+        name: 'End-to-End Tests'
+        description: 'npm-pack, install-from-tarball, multi-mode'
+        command: 'npm run test:e2e'
+        timeout: 30000
+        maxRetries: 1
+        jestArgs: '--testNamePattern="@e2e"'
+        examples:
+          - 'npm pack integration'
+          - 'install from tarball'
+          - 'multi-mode validation'
+      signals:
+        name: 'Signal Handling Tests'
+        description: 'Process signal handling (SIGINT, SIGTERM)'
+        command: 'npm run test:signals'
+        timeout: 10000
+        maxRetries: 1
+        jestArgs: '--testNamePattern="@signals"'
+        includes:
+          - 'SIGINT graceful shutdown'
+          - 'SIGTERM cleanup'
+          - 'zombie process prevention'
+    # ============================================
+    # GOAL 3: Protected Files Policy
+    # ============================================
+    protectedFiles:
+      enabled: true
+      requireOwnerAck: true
+      description: 'Prevent drift between contract and actual files'
+      autoGeneratedPatterns:
+        - path: CERBER.md
+          source: '.cerber/contract.yml'
+          command: 'npm run cerber:generate'
+          protected: true
+        - path: .github/workflows/cerber-pr-fast.yml
+          source: '.cerber/contract.yml'
+          command: 'npm run cerber:generate'
+          protected: true
+        - path: .github/workflows/cerber-main-heavy.yml
+          source: '.cerber/contract.yml'
+          command: 'npm run cerber:generate'
+          protected: true
+        - path: .github/CODEOWNERS
+          source: '.cerber/contract.yml'
+          command: 'npm run cerber:generate'
+          protected: true
+          onlyIfTeamMode: true
+      manualEditPatterns:
+        - path: '.cerber/contract.yml'
+          description: 'Source of truth - edit directly'
+          protected: false
+        - path: 'src/cli/generator.ts'
+          description: 'CLI command for generation'
+          protected: false
+        - path: 'src/cli/drift-checker.ts'
+          description: 'CLI command for drift detection'
+          protected: false
+        - path: 'src/cli/guardian.ts'
+          description: 'Pre-commit guardian'
+          protected: false
+        - path: 'src/cli/doctor.ts'
+          description: 'Health check command'
+          protected: false
+      criticalPatterns:
+        - CERBER.md
+        - .cerber/contract.yml
+        - .cerber/contracts/**
+        - bin/cerber-guardian
+        - src/guardian/**
+        - src/core/Orchestrator.ts
+        - package.json
+        - tsconfig.json
+    # ============================================
+    # CI Profiles
+    # ============================================
     profiles:
       dev-fast:
+        gates:
+          - fast
         tools:
           - actionlint
         failOn:
           - error
         description: 'Fast pre-commit check (<2s)'
       dev:
+        gates:
+          - fast
+          - heavy
         tools:
           - actionlint
           - zizmor
@@ Expand All / @@ -75,6 +227,9 @@ profiles: @@
         description: 'Full development check'
       team:
+        gates:
+          - fast
+          - heavy
         tools:
           - actionlint
           - zizmor
@@ Expand All / @@ -83,20 +238,51 @@ profiles: @@
           - error
           - warning
         description: 'Team CI with secrets scanning'
+        codeowners: true
+        protectedBranch: true
-    requiredActions:
-      - action: actions/checkout@v4
-        minVersion: '4'
-      - action: actions/setup-node@v4
-        minVersion: '4'
+    # ============================================
+    # Drift Detection Settings
+    # ============================================
+    driftDetection:
+      enabled: true
+      checkOnCI: true
+      failOnDrift: true
+      reportFormat: markdown
+      diffTool: git
+      ignoreWhitespace: false
-    requiredSteps:
-      - name: Install dependencies
-        command: npm ci
-      - name: Run tests
-        command: npm test
+    # ============================================
+    # Branch Protection Requirements
+    # ============================================
+    branchProtection:
+      mainBranch: main
+      requiredChecks:
+        - 'lint_and_typecheck'
+        - 'build_and_unit'
+      optionalChecks:
+        - 'cerber_e2e_all_modes'
+        - 'npm_package_validation'
+      requireUpToDate: true
+      requireCodeOwnerReview: true
+      allowForcePush: false
-    allowedTriggers:
-      - push
-      - pull_request
-      - workflow_dispatch
+    # ============================================
+    # Generation Rules
+    # ============================================
+    generation:
+      outputDirectory: .
+      workflows:
+        outputDirectory: .github/workflows
+        format: yaml
+        includeComments: true
+      documentation:
+        outputDirectory: .
+        format: markdown
+        toc: true
+      codeowners:
+        enabled: true
+        outputPath: .github/CODEOWNERS
+        onlyTeamMode: true
+      autoCommit: false
+      autoGeneratedHeader: '<!-- AUTO-GENERATED BY CERBER — DO NOT EDIT -->'

.github/CODEOWNERS

-Original file line number
+Diff line change
@@ -0,0 +1,27 @@
+    # Code owners for Cerber One Truth infrastructure
+    # Changes to protected files require approval from codeowners
+    # One Truth contract and policy
+    CERBER.md @owner
+    .cerber/ @owner
+    .github/workflows/ @owner
+    # Critical dependencies
+    package.json @owner
+    package-lock.json @owner
+    # CLI entry points
+    bin/ @owner
+    # Guardian system (enforcement)
+    src/guardian/ @owner
+    # Core infrastructure
+    src/core/Orchestrator.ts @owner
+    src/cli/generator.ts @owner
+    src/cli/drift-checker.ts @owner
+    src/cli/guardian.ts @owner
+    src/cli/doctor.ts @owner
+    # Branch protection documentation
+    docs/BRANCH_PROTECTION.md @owner

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Rcx hardening #62

Uh oh!

Diff view

Diff view

There are no files selected for viewing

Uh oh!

Uh oh!

Uh oh!

Rcx hardening #62

Are you sure you want to change the base?

Uh oh!

Rcx hardening #62

Uh oh!

Uh oh!

Diff view

Diff view

There are no files selected for viewing

Uh oh!

Uh oh!