chore: prepare the repository for the public v1.0.0 release

scripts/ci-changed-exercises.sh → .github/scripts/ci-changed-exercises.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # ci-changed-exercises.sh prints the ids of the exercises CI must validate,
-# one per line (spec section 14):
+# one per line (ARCHITECTURE.md section 14):
 #
 #   all          every exercise
 #   <base> <head>  the exercises with a file changed between the two commits.
@@ -9,11 +9,11 @@
 #
 # Exercises deleted in the change are left out.
 #
-# Usage: scripts/ci-changed-exercises.sh all
-#        scripts/ci-changed-exercises.sh <base> <head>
+# Usage: .github/scripts/ci-changed-exercises.sh all
+#        .github/scripts/ci-changed-exercises.sh <base> <head>
 set -euo pipefail
 
-root="$(cd "$(dirname "$0")/.." && pwd)"
+root="$(cd "$(dirname "$0")/../.." && pwd)"
 cd "$root"
 
 all() {
@@ -29,7 +29,7 @@ case "$#" in
         ;;
     2)
         changed="$(git diff --name-only "$1" "$2")"
-        if grep -qxE 'scripts/ci-changed-exercises\.sh|scripts/validate-exercise\.sh|\.github/workflows/exercises\.yml' <<<"$changed"; then
+        if grep -qxE '\.github/scripts/ci-changed-exercises\.sh|scripts/validate-exercise\.sh|\.github/workflows/exercises\.yml' <<<"$changed"; then
             all
             exit 0
         fi

scripts/ci-check-admission.sh → .github/scripts/ci-check-admission.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 # Checks that deploy/k8s, as Argo CD renders it, holds the admission policy
-# for sandbox pods in full (spec section 13.2): every rule's message from a
+# for sandbox pods in full (ARCHITECTURE.md section 13.2): every rule's message from a
 # to l, failurePolicy Fail, and a binding with validationActions exactly
 # [Deny], scoped to sandboxes, with no matchConditions that could exempt a
 # requester. ci.yml runs it with the pinned kubectl from
@@ -11,10 +11,10 @@
 # contacting a server (the label it adds stays in this pipe), and Python's
 # standard json module reads the result.
 #
-# Usage: scripts/ci-check-admission.sh [kubectl]   (default: kubectl on PATH)
+# Usage: .github/scripts/ci-check-admission.sh [kubectl]   (default: kubectl on PATH)
 set -euo pipefail
 
-root="$(cd "$(dirname "$0")/.." && pwd)"
+root="$(cd "$(dirname "$0")/../.." && pwd)"
 cd "$root"
 kubectl="${1:-kubectl}"
 

scripts/ci-check-credential-args.sh → .github/scripts/ci-check-credential-args.sh

@@ -9,11 +9,11 @@
 #
 # Pass such values on stdin instead (curl --config -).
 #
-# Usage: scripts/ci-check-credential-args.sh [file...]   (default: the other scripts/*.sh)
-#        scripts/ci-check-credential-args.sh --self-test
+# Usage: .github/scripts/ci-check-credential-args.sh [file...]   (default: the other scripts/*.sh)
+#        .github/scripts/ci-check-credential-args.sh --self-test
 set -euo pipefail
 
-root="$(cd "$(dirname "$0")/.." && pwd)"
+root="$(cd "$(dirname "$0")/../.." && pwd)"
 cd "$root"
 
 pattern='(^|[[:space:]])(-u|--user|-H|--header)[[:space:]]+"([^"]*\$\(|[^"]*\$\{?[A-Za-z_]*([Tt][Oo][Kk][Ee][Nn]|[Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd])|[Aa]uthorization:)'
@@ -48,8 +48,8 @@ files=("$@")
 if [[ ${#files[@]} -eq 0 ]]; then
 	# Every script but this one, whose comments and self-test hold the
 	# patterns on purpose.
-	for f in scripts/*.sh; do
-		[[ "$f" == scripts/ci-check-credential-args.sh ]] || files+=("$f")
+	for f in scripts/*.sh .github/scripts/*.sh; do
+		[[ "$f" == .github/scripts/ci-check-credential-args.sh ]] || files+=("$f")
 	done
 fi
 if hits="$(grep -nHE -- "$pattern" "${files[@]}")"; then

scripts/ci-enable-userns.sh → .github/scripts/ci-enable-userns.sh

@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
 # ci-enable-userns.sh turns on Docker's user namespace remapping on a CI
-# runner, the isolation the engine requires for sandboxes (spec section 13.1,
-# OQ-3). It merges "userns-remap": "default" into /etc/docker/daemon.json,
+# runner, the isolation the engine requires for sandboxes (ARCHITECTURE.md section
+# 13.1). It merges "userns-remap": "default" into /etc/docker/daemon.json,
 # restarts Docker, and waits until `docker info` reports name=userns.
 #
 # Restarting Docker with userns-remap switches its storage root, so start
 # containers (Postgres, sandboxes) only after this script.
 #
-# Usage (as root): scripts/ci-enable-userns.sh
+# Usage (as root): .github/scripts/ci-enable-userns.sh
 set -euo pipefail
 
 conf=/etc/docker/daemon.json

scripts/ci-go-test.sh → .github/scripts/ci-go-test.sh

@@ -9,8 +9,8 @@
 # Integration tests skip only when their database or Docker was never
 # configured, so in CI a skip means a broken setup, not a pass.
 #
-# Usage: scripts/ci-go-test.sh [--require TestName]... [go test args]...
-# Example: scripts/ci-go-test.sh --require TestScriptedSelection -tags webdist ./...
+# Usage: .github/scripts/ci-go-test.sh [--require TestName]... [go test args]...
+# Example: .github/scripts/ci-go-test.sh --require TestScriptedSelection -tags webdist ./...
 set -euo pipefail
 
 # Skipped unless asked for on purpose: RC_DBT_STRESS=1, or RC_CLUSTER_URL
@@ -25,7 +25,7 @@ while [ "${1:-}" = "--require" ]; do
 done
 [ "$#" -gt 0 ] || { echo "usage: ci-go-test.sh [--require TestName]... [go test args]..." >&2; exit 2; }
 
-root="$(cd "$(dirname "$0")/.." && pwd)"
+root="$(cd "$(dirname "$0")/../.." && pwd)"
 log="$(mktemp)"
 trap 'rm -f "$log"' EXIT
 

scripts/ci-release-image.sh → .github/scripts/ci-release-image.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# CI helpers for the API image on GHCR (spec section 14). release.yml and
+# CI helpers for the API image on GHCR (ARCHITECTURE.md section 14). release.yml and
 # ci.yml call them; they read GITHUB_TOKEN and GITHUB_ACTOR from the
 # workflow and never print the token.
 #
@@ -15,7 +15,7 @@ repo=dizamu/rootcause-api
 zero=sha256:0000000000000000000000000000000000000000000000000000000000000000
 accept="application/vnd.oci.image.index.v1+json,application/vnd.oci.image.manifest.v1+json,application/vnd.docker.distribution.manifest.list.v2+json,application/vnd.docker.distribution.manifest.v2+json"
 
-root="$(cd "$(dirname "$0")/.." && pwd)"
+root="$(cd "$(dirname "$0")/../.." && pwd)"
 cd "$root"
 
 die() { echo "ci-release-image: $*" >&2; exit 1; }

scripts/test-commit-msg.sh → .github/scripts/test-commit-msg.sh

@@ -3,7 +3,7 @@
 # and messages it must reject. Exit 0 when every case behaves as expected.
 set -uo pipefail
 
-root="$(cd "$(dirname "$0")/.." && pwd)"
+root="$(cd "$(dirname "$0")/../.." && pwd)"
 hook="$root/.githooks/commit-msg"
 tmp="$(mktemp)"
 trap 'rm -f "$tmp"' EXIT

.github/workflows/ci.yml

@@ -1,4 +1,4 @@
-# CI for every pull request and every push to main (spec section 14).
+# CI for every pull request and every push to main (ARCHITECTURE.md section 14).
 # A push to a PR branch already runs through pull_request, so pushes to other
 # branches are left out to save Actions minutes.
 name: ci
@@ -57,17 +57,17 @@ jobs:
       - name: shellcheck
         run: |
           shellcheck --version
-          shellcheck scripts/*.sh .githooks/commit-msg exercises/*/*.sh
+          shellcheck scripts/*.sh .github/scripts/*.sh .githooks/commit-msg exercises/*/*.sh
       - name: admission policy shape
         run: |
           scripts/install-k8s-tools.sh "$RUNNER_TEMP/k8s-bin"
-          scripts/ci-check-admission.sh "$RUNNER_TEMP/k8s-bin/kubectl"
+          .github/scripts/ci-check-admission.sh "$RUNNER_TEMP/k8s-bin/kubectl"
       - name: no credentials on command lines
         run: |
-          scripts/ci-check-credential-args.sh --self-test
-          scripts/ci-check-credential-args.sh
+          .github/scripts/ci-check-credential-args.sh --self-test
+          .github/scripts/ci-check-credential-args.sh
       - name: commit-msg hook cases
-        run: bash scripts/test-commit-msg.sh
+        run: bash .github/scripts/test-commit-msg.sh
       - name: i18n key parity
         run: |
           go test -count=1 -run 'TestLocaleParity' ./internal/i18n/
@@ -97,7 +97,7 @@ jobs:
         run: scripts/build-web.sh
       # Before any container starts: the restart switches Docker's storage.
       - name: enable Docker userns-remap
-        run: sudo scripts/ci-enable-userns.sh
+        run: sudo .github/scripts/ci-enable-userns.sh
       - name: start Postgres with rootcause init
         run: |
           pw="$(openssl rand -hex 24)"
@@ -110,13 +110,13 @@ jobs:
         env:
           RC_REQUIRE_DOCKER: "1"
         run: >-
-          scripts/ci-go-test.sh
+          .github/scripts/ci-go-test.sh
           --require TestScriptedSelection
           --require TestBuildRecoversFromKilledEngine
           --require TestPlaySvc01
           -tags webdist ./...
 
-  # The release deploy/k8s pins must be a pushed vX.Y.Z (spec section 14).
+  # The release deploy/k8s pins must be a pushed vX.Y.Z (ARCHITECTURE.md section 14).
   # GITHUB_TOKEN is the only credential, with packages: read on this job only.
   # A pull request from a fork gets no package access, so the job does not
   # run there.
@@ -135,4 +135,4 @@ jobs:
       - name: pinned digest is a release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: scripts/ci-release-image.sh check-kustomization
+        run: .github/scripts/ci-release-image.sh check-kustomization

.github/workflows/commit-policy.yml

@@ -1,4 +1,4 @@
-# Commit policy (spec sections 14 and 15): every commit in a pull request has
+# Commit policy (ARCHITECTURE.md sections 14 and 15): every commit in a pull request has
 # no Co-authored-by trailer or tool attribution line, the owner's author and
 # committer email, and a signature GitHub verifies.
 name: commit-policy

.github/workflows/dbt.yml

@@ -86,7 +86,7 @@ jobs:
           RC_DBT_HOST: postgres
           RC_REQUIRE_DOCKER: "1"
         run: >-
-          scripts/ci-go-test.sh
+          .github/scripts/ci-go-test.sh
           --require TestScriptedSelection
           --require TestBuildRecoversFromKilledEngine
           --require TestBuildFailureKeepsLog

.github/workflows/exercises.yml

@@ -1,4 +1,4 @@
-# Exercise validation (spec section 14): for each changed exercise and seeds
+# Exercise validation (ARCHITECTURE.md section 14): for each changed exercise and seeds
 # 1, 2 and 3, build the image; break then check must fail; break, solution,
 # check must pass. Pull requests and pushes to main validate only the changed
 # exercises; tags and manual runs validate all of them. Tags reach this
@@ -46,13 +46,13 @@ jobs:
           PUSH_AFTER: ${{ github.sha }}
         run: |
           if [ "$EVENT" = workflow_dispatch ] || [ "$REF_TYPE" = tag ]; then
-            ids="$(scripts/ci-changed-exercises.sh all)"
+            ids="$(.github/scripts/ci-changed-exercises.sh all)"
           elif [ "$EVENT" = pull_request ]; then
-            ids="$(scripts/ci-changed-exercises.sh "$PR_BASE" "$PR_HEAD")"
+            ids="$(.github/scripts/ci-changed-exercises.sh "$PR_BASE" "$PR_HEAD")"
           elif [ -z "$PUSH_BEFORE" ] || [ "$PUSH_BEFORE" = 0000000000000000000000000000000000000000 ]; then
-            ids="$(scripts/ci-changed-exercises.sh all)"
+            ids="$(.github/scripts/ci-changed-exercises.sh all)"
           else
-            ids="$(scripts/ci-changed-exercises.sh "$PUSH_BEFORE" "$PUSH_AFTER")"
+            ids="$(.github/scripts/ci-changed-exercises.sh "$PUSH_BEFORE" "$PUSH_AFTER")"
           fi
           echo "exercises to validate: ${ids:-none}"
           # One line, space-separated; empty when nothing changed.
@@ -64,7 +64,7 @@ jobs:
           go-version-file: go.mod
       - name: enable Docker userns-remap
         if: steps.list.outputs.ids != ''
-        run: sudo scripts/ci-enable-userns.sh
+        run: sudo .github/scripts/ci-enable-userns.sh
       - name: validate, seeds 1 2 3
         if: steps.list.outputs.ids != ''
         env:

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-# Release (spec section 14): on a vX.Y.Z tag on main, validate every exercise,
+# Release (ARCHITECTURE.md section 14): on a vX.Y.Z tag on main, validate every exercise,
 # then build the API image and push it to ghcr.io/dizamu/rootcause-api under
 # that tag only. The job summary has the digest; the owner pins it in
 # deploy/k8s/kustomization.yaml in a pull request, and Argo CD deploys it
@@ -35,7 +35,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ github.ref_name }}
-        run: scripts/ci-release-image.sh check-tag "$TAG" "$GITHUB_SHA"
+        run: .github/scripts/ci-release-image.sh check-tag "$TAG" "$GITHUB_SHA"
 
   validate:
     needs: check

.gitignore

@@ -1,4 +1,4 @@
-# Secrets: local env files are never committed (spec section 13.2).
+# Secrets: local env files are never committed (ARCHITECTURE.md section 13.2).
 .env
 # Compiled binary and build output.
 /rootcause