[nomad-step-0] S0.5 — Woodpecker CI validation for nomad/vault artifacts #825

New issue

Closed

opened 2026-04-16 05:34:37 +00:00 by dev-bot · 0 comments

dev-bot commented

2026-04-16 05:34:37 +00:00

Collaborator

Part of the Nomad+Vault migration. Step 0 — empty cluster. Blocked by: #824 (S0.4).

Goal

Add static Woodpecker CI validation for every Nomad/Vault artifact so broken HCL can't merge.

Scope

Add .woodpecker/nomad-validate.yml (or extend existing pipeline) with steps:

nomad config validate nomad/*.hcl — fails on any HCL error.
vault operator diagnose -config=nomad/vault.hcl -skip storage -skip listener — syntax-only check (real storage/listener only validatable at runtime).
shellcheck lib/init/nomad/*.sh bin/disinto — all new shell clean.
bats tests/disinto-init-nomad.bats — a small bats suite covering:
- disinto init --backend=nomad --dry-run exits 0 and prints expected step list.
- disinto init --backend=nomad --empty --dry-run same.
- disinto init --backend=docker unaffected (regression guard).

Trigger: pipeline runs on every PR touching nomad/, lib/init/nomad/, or bin/disinto.

Acceptance criteria

CI runs on a new PR that intentionally breaks nomad/server.hcl and fails with a clear error.
Same PR with fix passes.
Existing PRs not touching these paths are unaffected (pipeline skipped).
Docs reference in nomad/AGENTS.md (new short file): "what the nomad stack looks like, how to add a jobspec, how CI validates it."

Why

Locks in the no-ad-hoc-steps principle. Every Nomad artifact has static validation before it can land.

Labels / meta

[nomad-step-0] S0.5 — blocked by #824.

Part of the Nomad+Vault migration. **Step 0 — empty cluster.** **Blocked by: #824 (S0.4).** ## Goal Add static Woodpecker CI validation for every Nomad/Vault artifact so broken HCL can't merge. ## Scope Add `.woodpecker/nomad-validate.yml` (or extend existing pipeline) with steps: - `nomad config validate nomad/*.hcl` — fails on any HCL error. - `vault operator diagnose -config=nomad/vault.hcl -skip storage -skip listener` — syntax-only check (real storage/listener only validatable at runtime). - `shellcheck lib/init/nomad/*.sh bin/disinto` — all new shell clean. - `bats tests/disinto-init-nomad.bats` — a small bats suite covering: - `disinto init --backend=nomad --dry-run` exits 0 and prints expected step list. - `disinto init --backend=nomad --empty --dry-run` same. - `disinto init --backend=docker` unaffected (regression guard). Trigger: pipeline runs on every PR touching `nomad/`, `lib/init/nomad/`, or `bin/disinto`. ## Acceptance criteria - CI runs on a new PR that intentionally breaks `nomad/server.hcl` and fails with a clear error. - Same PR with fix passes. - Existing PRs not touching these paths are unaffected (pipeline skipped). - Docs reference in `nomad/AGENTS.md` (new short file): "what the nomad stack looks like, how to add a jobspec, how CI validates it." ## Why Locks in the no-ad-hoc-steps principle. Every Nomad artifact has static validation before it can land. ## Labels / meta - `[nomad-step-0] S0.5` — blocked by #824.