From 7d601c4bce79eb69e7a5c439d12c3b13f6fe7530 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lukas=20Weberru=C3=9F?= Date: Wed, 21 Oct 2026 12:52:25 +0000 Subject: [PATCH] fix(ci): qualify governance against the current Runner source Review source hashes for the immutable platform Runner pin, retain the existing governance assertions, and verify non-empty folder descriptions are rejected. Run the complete native Plan/Application/governance contract in PR validation before release packaging. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/validate-configurator.yml | 2 ++ .../fixtures/governance/governance.tftest.hcl | 10 ++++++++++ .../app/integration/fixtures/governance/source.json | 8 ++++---- landing-zone-configurator/docs/plan-execution.de.md | 12 +++++++++++- landing-zone-configurator/docs/plan-execution.md | 9 ++++++++- 5 files changed, 35 insertions(+), 6 deletions(-) diff --git a/.github/workflows/validate-configurator.yml b/.github/workflows/validate-configurator.yml index cbe96cc8..d3653d1d 100644 --- a/.github/workflows/validate-configurator.yml +++ b/.github/workflows/validate-configurator.yml @@ -109,6 +109,8 @@ jobs: tofu_wrapper: false - name: Check all template exports against native Accelerator variable contracts run: npm run test:common-contract + - name: Test native Plan, Application and governance contracts + run: LZC_TEST_TOFU_BIN="$(command -v tofu)" npm run test:plan - name: Test database migrations and tenant isolation run: npm run test:database -- --maxWorkers=2 --testTimeout=30000 env: diff --git a/landing-zone-configurator/app/integration/fixtures/governance/governance.tftest.hcl b/landing-zone-configurator/app/integration/fixtures/governance/governance.tftest.hcl index eb3f01f5..583208cb 100644 --- a/landing-zone-configurator/app/integration/fixtures/governance/governance.tftest.hcl +++ b/landing-zone-configurator/app/integration/fixtures/governance/governance.tftest.hcl @@ -72,3 +72,13 @@ run "empty_description" { error_message = "Empty description must remain harmless; populated descriptions remain blocked by the Configurator (#82)." } } + +run "non_empty_description_rejected" { + command = plan + variables { + rm_folders = { + platform = { name = "Platform", description = "Must not be silently discarded" } + } + } + expect_failures = [var.rm_folders] +} diff --git a/landing-zone-configurator/app/integration/fixtures/governance/source.json b/landing-zone-configurator/app/integration/fixtures/governance/source.json index 09d10939..ea4c784c 100644 --- a/landing-zone-configurator/app/integration/fixtures/governance/source.json +++ b/landing-zone-configurator/app/integration/fixtures/governance/source.json @@ -1,14 +1,14 @@ { - "acceleratorRevision": "c4b43c36af198985980b17626c48d357795e3fbd", + "acceleratorRevision": "9e7fb46c329aca32e878ce1f0ea3b944ea240354", "files": { - "src/main.tf": "8592367381556c5eb6ae376d4bfe58ff4afe8bb7c37e1b8d8052d7678834d4d9", - "src/variables.tf": "b77e59054c7d2c6dabcb9f9add22c1efb56d79735fd14eb5461e11d99c105f57", + "src/main.tf": "0b2f27c869b6afe2be5614fe8895966739f874f18d1fd8905224735703b249c6", + "src/variables.tf": "c650b337ee9e154b988927c9a129091b6c6627ff90e9d1661bb9c8ba7815bda5", "src/locals.tf": "7c4f7c2887755b8581b31982ada8d63c2c0796c963994e61da95c270db1c8d78", "src/modules/governance/1-rm-folders.tf": "f1ff318487c780914620a3b516f55b2f17f13af4dd38364937d9567c93cd865b", "src/modules/governance/2-custom-roles.tf": "5cf14fc37fb6ad76d0914d38177c0b9bf7600606f2110827f85fded466a1c3d0", "src/modules/governance/3-organization-roles.tf": "209a6456b0d627516c36c8cfcfe0cf8444840c8b62ac01d352cef8f0ba4391da", "src/modules/governance/outputs.tf": "f16f31960dd81166cc1372ef9f2e6cb9f58044d7772785d8a31193e83b1f5b85", "src/modules/governance/terraform.tf": "6407250ce406a1fe3085c8ca64e392f6116c2b13de96a468de031569e5a56220", - "src/modules/governance/variables.tf": "9dd60d5196c884c6957e21cf6e8c6d00e6b8e48a0d8c48abc0abbc428018b736" + "src/modules/governance/variables.tf": "ddd29245d3bd76cf621b2e89663c0571b61313781404b78bb89afc8e57565b23" } } diff --git a/landing-zone-configurator/docs/plan-execution.de.md b/landing-zone-configurator/docs/plan-execution.de.md index 8899ac8c..ca7c18d5 100644 --- a/landing-zone-configurator/docs/plan-execution.de.md +++ b/landing-zone-configurator/docs/plan-execution.de.md @@ -582,9 +582,19 @@ verwendeten Governance-Modul geprüft: `npm run test:plan` ruft den separaten Accelerator-Pin. OpenTofu 1.12.6 plant mit Mock-Providern in bereinigter Umgebung, ohne Cloud-Credentials und ohne Apply. Geprüft werden Organisationsrollen `owner`/`organization.auditor`, Ordnerrollen `owner`/`auditor`, das Auslassen -doppelter Ordnerzuweisungen für Organisations-Owner sowie beide Elternvarianten. +doppelter Ordnerzuweisungen für Organisations-Owner, beide Elternvarianten sowie +die Ablehnung nicht leerer Ordnerbeschreibungen. Diese lokale Qualifikation ersetzt keinen Plan gegen die konkrete Kundenorganisation. +Der geprüfte Quellnachweis liegt unter +`app/integration/fixtures/governance/source.json`. Bei Änderungen am Plattform- +Runner-Pin die Root- und Governance-Dateihashes gegen genau diesen Commit prüfen +und alle vorhandenen Governance-Pläne erneut ausführen. Die strikten Revisions-/ +Hashprüfungen sowie Rollen- und Eigentümer-Assertions bleiben erhalten. Die +PR-Validierung führt den vollständigen Ablauf `npm run test:plan` einschließlich +dieser Qualifikation aus; Release-Builds wiederholen ihn vor der Paketierung des +isolierten Runners. + **Service-Account-Föderation für CI/CD** ist eine optionale Editor-Komponente. Sie regelt, welche OIDC-Tokens externer Pipelines den Management-Service-Account nutzen dürfen; sie ist keine Benutzeranmeldung am Configurator. diff --git a/landing-zone-configurator/docs/plan-execution.md b/landing-zone-configurator/docs/plan-execution.md index 298d55a7..a676cbb8 100644 --- a/landing-zone-configurator/docs/plan-execution.md +++ b/landing-zone-configurator/docs/plan-execution.md @@ -238,7 +238,14 @@ Commit `9aa3322`, [release 36849188406](https://github.com/stackitcloud/stackit- ## Governance qualification and service-account federation (2026-10-01) -Governance input approval is additionally checked with the actually used governance module: `npm run test:plan` calls separate `test-governance-contract.sh`. Source hashes bind checking to the Accelerator pin. OpenTofu 1.12.6 plans with mock providers in a cleaned environment, without cloud credentials or Apply. Checks cover organization roles `owner`/`organization.auditor`, folder roles `owner`/`auditor`, omission of duplicate folder assignments for organization owners and both parent variants. This local qualification does not replace a Plan against the specific customer organization. +Governance input approval is additionally checked with the actually used governance module: `npm run test:plan` calls separate `test-governance-contract.sh`. Source hashes bind checking to the Accelerator pin. OpenTofu 1.12.6 plans with mock providers in a cleaned environment, without cloud credentials or Apply. Checks cover organization roles `owner`/`organization.auditor`, folder roles `owner`/`auditor`, omission of duplicate folder assignments for organization owners, both parent variants and rejection of non-empty folder descriptions. This local qualification does not replace a Plan against the specific customer organization. + +The reviewed source receipt is `app/integration/fixtures/governance/source.json`. +When updating the platform Runner pin, review the root and governance file hashes +against that exact commit and rerun all existing governance plans. Preserve the +strict revision/hash checks and role/ownership assertions. PR validation runs the +complete `npm run test:plan` flow, including this qualification; release builds +repeat it before packaging the isolated Runner. **Service-account federation for CI/CD** is an optional editor component. It controls which external pipeline OIDC tokens may use the management service account; it is not user login to the Configurator. `issuer` is the trusted issuer, `aud` the token audience and `sub`, for example, the specific GitHub repository with branch. Conditions use comparison `equals` supported by the pinned provider; `aud` is required. The GitHub template limits `sub` to a specified branch and does not apply unchanged to jobs with GitHub environments.