56eed6250e
drill/multiuser.sh: two throwaway users, real grants, real boxes, and the contract measured from INSIDE them — #74's criteria (a)-(f) plus what the findings added: the cross-user sibling drop, the closed private-bridge escape hatches, incus-user re-sync survival, scoped revoke --purge. Its own first runs are in RUNS.md (MU-1..3): both false FAILs were the instrument, and both lessons (keep the mint's narration; probe a SIBLING's name, never your own — /etc/hosts answers for you) are now comments in the script. test/cli.sh: box_tier() driven against a shim id for all five cases (including both-groups → admin: membership wins at the socket), the two copies diffed byte-identical, the tier scripts' usage contracts driven for real, and grep-guards on every load-bearing line a daemon-free run cannot exercise — the expose guard's position, the boxnet-and-only-boxnet narrowing, the snapshot allow, 'incus:snapshot restore'. ci.yml: a second job stands up the real stack on the runner (setup-host, doctor, then the rehearsal in container mode) — every PR now proves the tier's semantics against a live daemon. The tier's mechanics are instance-type-independent (the drop, the ACL, dns.mode and port_isolation bind to boxnet, not the instance); the VM trust boundary itself stays a real-hardware ritual, like the full drill. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
62 lines
2.8 KiB
YAML
62 lines
2.8 KiB
YAML
name: ci
|
|
on:
|
|
push:
|
|
branches: [main]
|
|
pull_request:
|
|
jobs:
|
|
check:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: shellcheck
|
|
# -x follows `source`/`.` directives; box has no lib split today, but the
|
|
# flag costs nothing and keeps the invocation identical to rig's.
|
|
# globstar so a script in a new subdirectory is linted without anyone
|
|
# remembering to edit this list; bin/* covers the extensionless entrypoint
|
|
# (bin/box). The file list is printed so under-coverage shows up in the log.
|
|
run: |
|
|
shopt -s globstar
|
|
files=(bin/* **/*.sh)
|
|
printf 'shellcheck: %s\n' "${files[@]}"
|
|
shellcheck -x "${files[@]}"
|
|
- name: cli tests
|
|
run: bash test/cli.sh
|
|
|
|
# The multi-user rehearsal, on a REAL incus — a GitHub runner is root on a
|
|
# disposable VM, which is exactly the substrate the rehearsal needs. It runs
|
|
# in container mode: the tier's mechanics (grant, confinement, the network
|
|
# contract, revoke) are identical for containers and VMs — the nft bridge
|
|
# drop, the ACL, dns.mode=none and port_isolation all bind to boxnet, not
|
|
# to the instance type. What container mode canNOT validate is the VM trust
|
|
# boundary itself; that stays a real-hardware ritual (drill/RUNS.md), same
|
|
# as the full drill. So: every PR proves the tier's semantics, and a
|
|
# release still proves the boundary.
|
|
rehearsal:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: install incus
|
|
run: |
|
|
sudo apt-get update
|
|
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y incus
|
|
- name: global install, from this checkout (the #71 layout)
|
|
# Not install.sh: it installs a RELEASE (REPO@REF), and CI must prove
|
|
# the code under review. Same tree, same layout, same a+rX.
|
|
run: |
|
|
sudo cp -r . /opt/box
|
|
sudo rm -rf /opt/box/.git
|
|
sudo chmod -R a+rX /opt/box
|
|
sudo ln -sf /opt/box/bin/box /usr/local/bin/box
|
|
- name: setup-host
|
|
run: sudo bash /opt/box/host/setup-host.sh
|
|
- name: doctor — the baseline is provable before anything is judged
|
|
run: sudo BOX_TIER=admin bash /opt/box/drill/doctor.sh
|
|
- name: multi-user rehearsal (criteria a-l, container mode)
|
|
run: sudo BOX_MULTIUSER_REHEARSAL=1 bash /opt/box/drill/multiuser.sh --yes --container
|
|
|
|
# NOT run here: the full drill (drill/drill.sh). It rehearses the whole
|
|
# surface — cold template mints, expose, migration — and wants a real host
|
|
# and the better part of an hour. The rehearsal job above is the CI-shaped
|
|
# slice of the same discipline: isolation claims are still tested on a real
|
|
# daemon, never reasoned about (docs/box-design.md).
|