diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml index 97c41f590c..9910049f6f 100644 --- a/.github/actionlint.yaml +++ b/.github/actionlint.yaml @@ -1,12 +1,7 @@ -# actionlint's runner-label check works off a built-in list of GitHub-HOSTED labels. `busbar-xl` is -# ours — the label the EC2 runner fleet (busbar-release-autoscaler) gives every agent — so without -# this file actionlint reports every `runs-on: [self-hosted, linux, x64, busbar-xl]` in the repo as -# an unknown label, and a lint that cries wolf on 32 correct lines is a lint nobody reads. -# # `latchkey-small|medium|large|xlarge` are Latchkey's runner-size labels (latchkey.dev), used by # `runs-on:` lines of the Latchkey-hosted jobs. Without declaring them here actionlint reports each one as an unknown -# label — 37 findings measured on this migration (LK-4) — for the same reason `busbar-xl` needed -# declaring: they are real, fleet-issued (Latchkey-issued) labels, not typos. +# label — 37 findings measured on this migration (LK-4): they are real, fleet-issued +# (Latchkey-issued) labels, not typos. (`busbar-xl`, the EC2 fleet's label, left with that fleet.) # # Declaring it here is not a way of silencing the check; it is the check working as designed. The # list below is the ONLY custom labels the fleets issue, so a typo (`busbar-x1`, `latchkey-xlage`, a @@ -16,7 +11,6 @@ # is read only by a contributor who runs actionlint by hand. self-hosted-runner: labels: - - busbar-xl - latchkey-small - latchkey-medium - latchkey-large diff --git a/Dockerfile b/Dockerfile index b4fe5866a7..60a78065a5 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # busbar container image: FROM scratch, because the binary is the whole product. -# Static musl binaries are built by the release engine's container build (busbar-release) and copied -# in per-arch; CA roots are compiled into the binary (webpki-roots), so no /etc/ssl +# Static musl binaries are built by the release build of the `dev` -> `qa` move (ModernCI, .ci/dev.yaml) +# and copied in per-arch; CA roots are compiled into the binary (webpki-roots), so no /etc/ssl # is needed. The vetted provider catalog ships inside the image as the default. # # /lib/lib{c.musl-*,gcc_s,stdc++}.* are ALSO in this image, and are NOT busbar's own runtime deps — diff --git a/conformance/README.md b/conformance/README.md index 131f35b689..c80772ea42 100644 --- a/conformance/README.md +++ b/conformance/README.md @@ -10,9 +10,8 @@ The conformance-claim manifest home (`CONFORMANCE-SYNC-DESIGN.md` §3.1). - `manifest.json` — NOT YET GENERATED. Written only by `cargo xtask conformance-manifest --write` (§3.2), which is NOT YET BUILT. Until that xtask subcommand and its `xtask conformance check --suite ` - companion land, the busbar-release `conformance::conformance_checks` - `CommandCheck`s that shell to `cargo xtask conformance check --suite ` - will fail closed (non-zero exit / could-not-spawn) — the correct deny-safe + companion land, the checks that run `cargo xtask conformance check` + (ModernCI's `conformance` check in `.ci/predev.yaml`) will fail closed (non-zero exit / could-not-spawn) — the correct deny-safe default for an unimplemented check, not a silent pass. ## What still needs building (tracked, not done here) @@ -34,8 +33,8 @@ The conformance-claim manifest home (`CONFORMANCE-SYNC-DESIGN.md` §3.1). (`CONFORMANCE-GATES-PLAN.md` §5). See `CONFORMANCE-GATES-PLAN.md`, `CONFORMANCE-SYNC-DESIGN.md`, and -`CONFORMANCE-MATRIX-RULING.md` for the full grounding. The turnstile/train -gate wiring that CONSUMES this manifest is landed in the `busbar-release` -repo (`crates/busbar-release-turnstile/src/conformance.rs`, -`crates/busbar-release-turnstile/src/auto_apply.rs`, -`crates/busbar-release-train/src/conformance.rs`). +`CONFORMANCE-MATRIX-RULING.md` for the full grounding. What CONSUMES this +manifest is ModernCI's `conformance` check on the `predev` → `dev` move +(`.ci/predev.yaml`: `cargo xtask conformance record --all`, then +`cargo xtask conformance check --musts`). The busbar-release turnstile and +train that consumed it before are deleted. diff --git a/deny.toml b/deny.toml index b12a84ccff..aff83c2ff0 100644 --- a/deny.toml +++ b/deny.toml @@ -1,5 +1,5 @@ -# cargo-deny policy for busbar. Run locally with `cargo deny check`; in CI the predev hop -# (busbar-release) runs it as a build-test row. This file mechanically enforces the +# cargo-deny policy for busbar. Run locally with `cargo deny check`; in CI ModernCI runs it on every +# move into predev (the `deny` check of .ci/default.yaml). This file mechanically enforces the # supply-chain discipline that Cargo.toml already applies by hand (single TLS/HTTP # stack, no unmaintained/unsafe deps, license hygiene) so a future PR cannot # silently regress it. diff --git a/docs/ci/gate-integrity.md b/docs/ci/gate-integrity.md index 69fc2f4d8d..570734fba8 100644 --- a/docs/ci/gate-integrity.md +++ b/docs/ci/gate-integrity.md @@ -36,18 +36,18 @@ be promoted. ## What the pipeline holds mechanically -Pull requests into `predev` are judged by ModernCI (required check `ci`). The promotion up the -branch ladder runs `.github/workflows/promote.yml`, where the pinned release engine in busbar-release -plans the hop from the PR's base branch. +ModernCI judges every move up the branch ladder from this repository's branch files and posts one +check, `ci` (OWNER 2026-10-12, "ModernCI only"; `docs/design/BUSBAR-1.6.0.md` Part 6). The +busbar-release hop (`promote.yml`) is deleted. -| check | what it is | required on | +| move | branch file | what it runs | | --- | --- | --- | -| `preflight` | formatting, `Cargo.lock` current, the generated C header current, on a free runner | dev (promote.yml) | -| `hop` | the engine admits the candidate: EVERY registered `cargo xtask gate`, plus the oracle and conformance where the rung asks, then the fast-forward of the base | dev (promote.yml) | +| a lane into `predev` | `.ci/default.yaml` | preflight (formatting, `Cargo.lock` current, the generated C header current), EVERY registered `cargo xtask gate`, clippy, compile, test, doctest, deletion matrix, `cargo deny`; no worse than predev | +| `predev` into `dev` | `.ci/predev.yaml` | the gates, the oracle against the 1.5.5 golden, conformance, the done-oracle, the Q128 audit | -`ship-ready` is a registered gate like the rest: it runs on every hop, with `XTASK_SHIP_TARGET` set to -the hop's base branch, so it is strict for `qa` and `main` and carries the dev line's standing reds -for `predev` and `dev`. +`ship-ready` is a registered gate like the rest: it runs on every move, with `XTASK_SHIP_TARGET` set +to the move's target branch, so it is strict for `qa` and `main` and carries the dev line's standing +reds for `predev` and `dev`. ### Which executable scenario runs on the dev push @@ -115,9 +115,8 @@ green-with-the-list-printed on the dev line and red for `qa`/`main` while anythi ## The landing runner -Promotion is `promote.yml`'s hop (busbar-release `ci/promote/`): a pull request into `qa` or `main` -is admitted by the engine or not at all, and the hop has no override flag. A lane lands on -`predev` when ModernCI's `ci` check is green; CI is the proof. +Every move is ModernCI's: a lane lands on `predev`, and a branch is promoted, only when ModernCI's +`ci` check is green on the move's branch file, and there is no override flag. CI is the proof. ## The sentence this all exists for diff --git a/docs/proof/README.md b/docs/proof/README.md index 894bf21eef..adbc0a69ea 100644 --- a/docs/proof/README.md +++ b/docs/proof/README.md @@ -2,9 +2,9 @@ The Build Proof Dashboard manifest is collated by `cargo xtask proof-manifest`. The `proof-manifest` job that ran it (in the removed `ci.yml`, on a push to `dev`, `qa` or `main`) is deleted with the rest of busbar's -workflows: `promote.yml` does not publish a manifest, so nothing refreshes the published copies until -the collator is wired into the release engine in busbar-release. The last published manifests are on -the `proof-manifests` branch. +workflows, and `promote.yml` (the busbar-release hop) is deleted too: nothing refreshes the published +copies until a ModernCI branch file runs the collator on a landing (`on.landed`). The last published +manifests are on the `proof-manifests` branch. Usage: diff --git a/docs/security/openssf-best-practices.md b/docs/security/openssf-best-practices.md index 114177798e..24bede5ad2 100644 --- a/docs/security/openssf-best-practices.md +++ b/docs/security/openssf-best-practices.md @@ -74,7 +74,7 @@ The badge criteria are grouped as the bestpractices.dev form groups them. Answer | `crypto_published` + `crypto_call` + `crypto_floss` | Met | No home-grown crypto; standard vetted crates. Constant-time secret comparison (`crates/api/src/auth.rs`), SHA-256 digests. | | `crypto_keylength` + `crypto_working` + `crypto_weaknesses` | Met | SHA-256, ed25519 plugin signing key, TLS/mTLS. See posture doc §2.6, §2.3. | | `crypto_pfs` + `crypto_password_storage` + `crypto_random` | Met | TLS; secrets stored via `Redacted` / `SecretRef` (posture doc §2.2), never plaintext at rest by design. | -| `delivery_mitm` — signed/hash-verified delivery | Unmet | The release build, SBOM, build-provenance attestation and cosign signing lived in the deleted release workflows; the release engine in busbar-release does not build or publish yet (`promote.yml` fails a hop that plans a build). Verify recipes for past releases: . | +| `delivery_mitm` — signed/hash-verified delivery | Unmet | The release build, SBOM, build-provenance attestation and cosign signing lived in the deleted release workflows; nothing builds or publishes until ModernCI's `qa` → `main` branch file (`.ci/qa.yaml`) signs and publishes the judged build on landing (`docs/design/BUSBAR-1.6.0.md` Part 6). Verify recipes for past releases: . | | `delivery_unsigned` — no unsigned critical delivery | Unmet | Nothing is published until the engine ports the builds; see `RELEASE.md`. | | `vulnerabilities_fixed_60_days` | Met | `SECURITY.md` backport policy: fix on `dev` first, severity-driven backport window. | | `vulnerabilities_critical_fixed` | Met | Critical/High cherry-picked to the latest two minor lines with a GitHub Security Advisory + CVE (`SECURITY.md`). | diff --git a/scripts/mcp-conformance.sh b/scripts/mcp-conformance.sh index 8a1e2d6748..5b9b1d001a 100755 --- a/scripts/mcp-conformance.sh +++ b/scripts/mcp-conformance.sh @@ -100,7 +100,7 @@ die() { printf 'FAIL: %s\n' "$*" >&2; exit 1; } # THE SUITE'S NODE. @modelcontextprotocol/conformance imports fs.globSync, which exists from Node 22; # on Node 20 the suite dies at import, enumerates zero scenarios, and every row it owes reads as a -# failure. promote.yml runs Node 22, so this script provisions the same major itself rather than +# failure. The suite needs Node 22, so this script provisions the same major itself rather than # relying on whatever the runner image ships: a pinned release from nodejs.org, checked against a # sha256 this file commits, unpacked under target/ and put first on PATH. A runner that already has # Node >= 22 is left alone. The hash is checked BEFORE the archive is unpacked, and a mismatch, a diff --git a/xtask/src/conformance_check/mod.rs b/xtask/src/conformance_check/mod.rs index 171537a858..712f3c0d9e 100644 --- a/xtask/src/conformance_check/mod.rs +++ b/xtask/src/conformance_check/mod.rs @@ -1,8 +1,9 @@ //! `cargo xtask conformance check` — the TURNSTILE-FACING per-suite conformance admission command. //! -//! This is the one command the release pipeline's `busbar-release-turnstile` shells to as a -//! `CommandCheck` (`CONFORMANCE-GATES-PLAN.md` §1.3: turnstile drives everything as local -//! subprocesses over a busbar checkout, never GitHub check-runs). It answers exactly one question +//! This is the one command the pipeline shells to: ModernCI's `conformance` check on the +//! `predev` -> `dev` move (`.ci/predev.yaml`) runs it over a busbar checkout, as a local subprocess, +//! never a GitHub check-run (`CONFORMANCE-GATES-PLAN.md` §1.3; the busbar-release turnstile that ran +//! it before is deleted). It answers exactly one question //! per invocation — "is this suite a fresh green, right now, on this commit" — and answers it //! deny-safe: every error path (missing manifest, unparseable manifest, unregistered suite id, //! missing/absent verdict commit, a non-pass status, a stale pass) is a REFUSAL, never a silent 0. diff --git a/xtask/src/gates/design_bindings/verify.rs b/xtask/src/gates/design_bindings/verify.rs index 73f7b31f88..7f5ae6747a 100644 --- a/xtask/src/gates/design_bindings/verify.rs +++ b/xtask/src/gates/design_bindings/verify.rs @@ -256,11 +256,10 @@ pub fn ci_invoked_refs(root: &Path) -> Result, String> { let gate_call = Regex::new(r"cargo[ \t]+xtask[ \t]+gate[ \t]+([a-z0-9][a-z0-9-]*)")?; let mut gate_modules: BTreeSet = BTreeSet::new(); - // THE PIPELINE'S TURNSTILE RUNS EVERY REGISTERED GATE. It discovers them with `cargo xtask gate - // --list` (busbar-release's `discover_gates`) and runs each by name on every hop, so no - // workflow in this tree names them one by one any more. The registry IS that list, so a gate - // module is invoked exactly when it is registered; a module that is not registered is run by - // nothing and is still refused. + // THE PIPELINE RUNS EVERY REGISTERED GATE. ModernCI's `gates` check runs `cargo xtask gate + // --all` on every move (`.ci/*.yaml`), so no workflow in this tree names them one by one. The + // registry IS that list, so a gate module is invoked exactly when it is registered; a module + // that is not registered is run by nothing and is still refused. for name in crate::gates::names() { gate_modules.insert(xtask_gate_module(name, root)); } @@ -403,7 +402,7 @@ pub fn check_verdict(c: &J, ctx: &Ctx) -> (bool, String) { format!( "{k}:{r} (exists on disk, but nothing under .github/workflows invokes it, \ directly or through a script one runs, and it is no registered \ - gate the turnstile runs -- a gate nobody runs compares nothing)" + gate the pipeline runs -- a gate nobody runs compares nothing)" ), ); } diff --git a/xtask/src/gates/mod.rs b/xtask/src/gates/mod.rs index 4da590f30b..28de35c882 100644 --- a/xtask/src/gates/mod.rs +++ b/xtask/src/gates/mod.rs @@ -3356,7 +3356,7 @@ pub static REGISTRY: &[Registration] = &[ }, // THE ONE-MEMORY-ABI GATES (M0 ABI-SPEC; the design's locked plugin ABI). REPORT-ONLY: each is // armed at today's count as a drain-only ledger qa/.toml whose rows are the M2 work - // list, and the pipeline's turnstile runs them like every registered gate. + // list, and the pipeline (ModernCI's `gates` check) runs them like every registered gate. Registration { name: "one-memory-abi", batch: 1, diff --git a/xtask/tests/hot_path_gates.rs b/xtask/tests/hot_path_gates.rs index 0c977d848c..88cb2f73fa 100644 --- a/xtask/tests/hot_path_gates.rs +++ b/xtask/tests/hot_path_gates.rs @@ -2,7 +2,7 @@ //! //! `docs/design/BUSBAR-1.6.0.md` Part 3 §8 owes a perf gate and an alloc gate; §11b counts //! their criterion benches toward the core-engine tests/benches 8→9 rise. Both are registered, so -//! the pipeline's turnstile runs them by name on every hop; this file is the second route, driving +//! the pipeline runs them on every move (`cargo xtask gate --all`); this file is the second route, driving //! each through the dispatcher under `cargo test --workspace --locked`. //! //! Driven through `cli::main` directly, like `xtask/tests/cli.rs`: exit 0 is green, and a gate that