From 35341129722eae13d890b0d4f8b62fda3898090c Mon Sep 17 00:00:00 2001 From: Travis James Date: Mon, 21 Sep 2026 00:16:37 -0500 Subject: [PATCH] ci: keep product validation local --- .github/workflows/ci.yml | 67 ------------------- .../.openspec.yaml | 2 + .../enforce-local-only-validation/design.md | 44 ++++++++++++ .../enforce-local-only-validation/proposal.md | 28 ++++++++ .../specs/local-validation-policy/spec.md | 29 ++++++++ .../enforce-local-only-validation/tasks.md | 3 + 6 files changed, 106 insertions(+), 67 deletions(-) delete mode 100644 .github/workflows/ci.yml create mode 100644 openspec/changes/enforce-local-only-validation/.openspec.yaml create mode 100644 openspec/changes/enforce-local-only-validation/design.md create mode 100644 openspec/changes/enforce-local-only-validation/proposal.md create mode 100644 openspec/changes/enforce-local-only-validation/specs/local-validation-policy/spec.md create mode 100644 openspec/changes/enforce-local-only-validation/tasks.md diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml deleted file mode 100644 index 6b6389f..0000000 --- a/.github/workflows/ci.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: CI - -on: - push: - branches: [main, master] - pull_request: - branches: [main, master] - -env: - CARGO_TERM_COLOR: always - RUST_LOG: info - -jobs: - build-and-test: - name: Build, Clippy & Test - runs-on: ubuntu-latest - - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Install Rust toolchain - uses: dtolnay/rust-toolchain@stable - with: - components: clippy - - - name: Rust cache - uses: Swatinem/rust-cache@v2 - with: - workspaces: ". -> target" - - - name: cargo check - run: cargo check --workspace - - - name: cargo clippy - run: cargo clippy --workspace -- -D warnings - - - name: Start SurrealDB test dependency - run: | - docker run --detach --rm \ - --name surrealdb-ci \ - --publish 28000:8000 \ - surrealdb/surrealdb:v3.0.5@sha256:f703abfda71faa20572c9b0e99a1e2cb89494525ecc7a88345306c0fd3333845 \ - start \ - --log=warn \ - --user=root \ - --pass=root \ - --bind=0.0.0.0:8000 \ - memory - - for attempt in {1..30}; do - if curl --fail --silent http://127.0.0.1:28000/health >/dev/null; then - exit 0 - fi - sleep 1 - done - - docker logs surrealdb-ci - exit 1 - - - name: cargo test - run: cargo test --workspace - env: - RUST_BACKTRACE: 1 - TEST_SURREAL_ENDPOINT: ws://127.0.0.1:28000 - TEST_SURREAL_USERNAME: root - TEST_SURREAL_PASSWORD: root diff --git a/openspec/changes/enforce-local-only-validation/.openspec.yaml b/openspec/changes/enforce-local-only-validation/.openspec.yaml new file mode 100644 index 0000000..563fab5 --- /dev/null +++ b/openspec/changes/enforce-local-only-validation/.openspec.yaml @@ -0,0 +1,2 @@ +schema: spec-driven +created: 2026-09-21 diff --git a/openspec/changes/enforce-local-only-validation/design.md b/openspec/changes/enforce-local-only-validation/design.md new file mode 100644 index 0000000..27e555a --- /dev/null +++ b/openspec/changes/enforce-local-only-validation/design.md @@ -0,0 +1,44 @@ +## Context + +The repository already requires builds, tests, formatting, linting, and release +certification to run on the development machine. A legacy pull-request workflow +still ran those checks on GitHub Actions and was observed starting on PR #22. + +## Goals / Non-Goals + +**Goals:** + +- Remove the observed hosted product-validation path. +- Preserve documentation packaging and GitHub Pages deployment. + +**Non-Goals:** + +- Move product tests to another hosted runner. +- Change local Rust validation commands. +- Change documentation content or deployment behavior. + +## Decisions + +Delete the product CI workflow rather than disabling individual jobs. Every job +in that file performs prohibited product validation, so no deployment behavior +would remain after filtering it. + +The documentation workflow remains because its artifact build and publication +are the deployment mechanism. Its type check protects the deployable +documentation artifact and is not used as product certification. + +## Risks / Trade-offs + +- GitHub will no longer display Rust test checks on pull requests. Local command + evidence in the change record and PR description is authoritative. +- Existing in-flight runs must be canceled separately; deleting the workflow + prevents later pushes from starting new runs. + +## Migration Plan + +Cancel the observed PR #22 run, delete the CI workflow, validate the OpenSpec +change locally, and merge the removal through a dedicated pull request. + +## Open Questions + +None. diff --git a/openspec/changes/enforce-local-only-validation/proposal.md b/openspec/changes/enforce-local-only-validation/proposal.md new file mode 100644 index 0000000..028e8bf --- /dev/null +++ b/openspec/changes/enforce-local-only-validation/proposal.md @@ -0,0 +1,28 @@ +## Why + +Pushing PR #22 started a hosted `Build, Clippy & Test` job even though this +repository requires product validation to run locally. Leaving that workflow in +place wastes hosted capacity and can misrepresent GitHub results as release +evidence. + +## What Changes + +- Remove the hosted Rust build, Clippy, database-fixture, and test workflow. +- Keep the documentation deployment workflow, whose hosted work is limited to + packaging and publishing the documentation site. + +## Capabilities + +### New Capabilities + +- `local-validation-policy`: Defines where product validation and documentation deployment execute. + +### Modified Capabilities + +None. + +## Impact + +The change removes `.github/workflows/ci.yml`. Developers and release tooling +continue to run Rust validation locally; documentation deployment remains on +GitHub Pages. diff --git a/openspec/changes/enforce-local-only-validation/specs/local-validation-policy/spec.md b/openspec/changes/enforce-local-only-validation/specs/local-validation-policy/spec.md new file mode 100644 index 0000000..dcabc38 --- /dev/null +++ b/openspec/changes/enforce-local-only-validation/specs/local-validation-policy/spec.md @@ -0,0 +1,29 @@ +## Purpose + +Keep product verification on owned local machines while allowing hosted automation only for documentation deployment. + +## ADDED Requirements + +### Requirement: Product validation runs locally + +The project SHALL run builds, checks, linting, tests, database fixtures, and +release certification on a local development machine. GitHub Actions MUST NOT +run those product-validation commands. + +#### Scenario: A source pull request is pushed + +- **WHEN** a pull request changes Rust source, tests, or configuration +- **THEN** GitHub Actions does not start a product build, lint, or test job +- **AND** the pull request records the applicable local validation evidence + +### Requirement: Hosted automation is limited to documentation deployment + +GitHub Actions SHALL be limited to packaging and deploying the documentation +site. Checks that are intrinsic to producing the deployable documentation +artifact MAY run inside that deployment workflow. + +#### Scenario: Documentation deployment runs + +- **WHEN** a qualifying documentation change reaches the deployment workflow +- **THEN** the workflow may package and publish the documentation site +- **AND** it does not run Rust product validation or release certification diff --git a/openspec/changes/enforce-local-only-validation/tasks.md b/openspec/changes/enforce-local-only-validation/tasks.md new file mode 100644 index 0000000..0238145 --- /dev/null +++ b/openspec/changes/enforce-local-only-validation/tasks.md @@ -0,0 +1,3 @@ +## 1. Remove hosted product validation + +- [x] 1.1 Cancel the observed PR #22 product-test run, remove the legacy CI workflow, retain documentation deployment, and verify the strict OpenSpec change plus workflow inventory locally.