test: guard CEL balance and the immutable Job template before merge #168

Merged

binjovi-bot merged 1 commit from test/admission-cel-and-job-template-guards into trunk

2026-09-02 03:11:40 +00:00

sean commented

2026-09-02 02:58:52 +00:00

Owner

Problem

Trunk 18db1c1f failed to deploy twice (flux_deployment_failed, both rolled back to 0a1d98a0) and blocked every seanfarm release until 96d9dd02 repaired it. Two defects, both invisible to every guard in tests/check.sh:

one ) short in binjovi-untrusted-credential-guard variables[3]. The apiserver compiles CEL at apply time only, so the error surfaced as a failed kyverno-policies Kustomization after the release had started.
the binjovi-forgejo-integration-v14 Job template changed under the same name. A Job template is immutable, so the binjovi Kustomization failed.

Change

tests/vap-cel-balance.sh (wired into tests/check.sh): yq lists every CEL expression (matchConditions, variables, validations and their messageExpression, auditAnnotations, mutations) of every ValidatingAdmissionPolicy and MutatingAdmissionPolicy under kubernetes/; a stdlib-only python lexer (the admission image has no PyYAML) checks that ( [ { close in order and that strings terminate ('…', "…", triple quotes, r'…' raw). It checks itself against a broken and a whole fixture before it judges the repository, and zero policies or zero expressions is a failure. 64 expressions in 6 policies today, 0.7 s.

Against the trunk defect it says:
```
FAIL: kubernetes/flux/infrastructure/kyverno-policies/binjovi-untrusted-credential-guard.yaml: binjovi-untrusted-credential-guard variables[3] (publisherCredential): 1 unclosed: (
```
tests/binjovi.sh pins a cksum fingerprint of the current Job template (yq -o=json -I=0 'select(.kind == "Job") | .spec.template'). When the template changes, the guard fails and tells the editor to bump the generation in the four places and record the new fingerprint. The fingerprint is identical under the gate image's yq v4.53.2 and local v4.53.3. The retired-generation loop now covers v1–v13.

This is not a CEL compiler; it catches the unbalanced-bracket and open-string class, which is what a hand-edited multi-line expression gets wrong. tests/check.sh is green locally (47 s) and inside binjovi-gitops-validator:v5 (2 m 30 s); both new checks were run red against the exact trunk defects first.

https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5

## Problem Trunk 18db1c1f failed to deploy twice (`flux_deployment_failed`, both rolled back to 0a1d98a0) and blocked every seanfarm release until 96d9dd02 repaired it. Two defects, both invisible to every guard in `tests/check.sh`: - one `)` short in `binjovi-untrusted-credential-guard` `variables[3]`. The apiserver compiles CEL at apply time only, so the error surfaced as a failed `kyverno-policies` Kustomization after the release had started. - the `binjovi-forgejo-integration-v14` Job template changed under the same name. A Job template is immutable, so the `binjovi` Kustomization failed. ## Change - **`tests/vap-cel-balance.sh`** (wired into `tests/check.sh`): yq lists every CEL expression (`matchConditions`, `variables`, `validations` and their `messageExpression`, `auditAnnotations`, `mutations`) of every `ValidatingAdmissionPolicy` and `MutatingAdmissionPolicy` under `kubernetes/`; a stdlib-only python lexer (the admission image has no PyYAML) checks that `( [ {` close in order and that strings terminate (`'…'`, `"…"`, triple quotes, `r'…'` raw). It checks itself against a broken and a whole fixture before it judges the repository, and zero policies or zero expressions is a failure. 64 expressions in 6 policies today, 0.7 s. Against the trunk defect it says: ``` FAIL: kubernetes/flux/infrastructure/kyverno-policies/binjovi-untrusted-credential-guard.yaml: binjovi-untrusted-credential-guard variables[3] (publisherCredential): 1 unclosed: ( ``` - **`tests/binjovi.sh`** pins a `cksum` fingerprint of the current Job template (`yq -o=json -I=0 'select(.kind == "Job") | .spec.template'`). When the template changes, the guard fails and tells the editor to bump the generation in the four places and record the new fingerprint. The fingerprint is identical under the gate image's yq v4.53.2 and local v4.53.3. The retired-generation loop now covers v1–v13. This is not a CEL compiler; it catches the unbalanced-bracket and open-string class, which is what a hand-edited multi-line expression gets wrong. `tests/check.sh` is green locally (47 s) and inside `binjovi-gitops-validator:v5` (2 m 30 s); both new checks were run red against the exact trunk defects first. https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5

sean added 1 commit

2026-09-02 02:58:52 +00:00

test: guard CEL balance and the immutable Job template before merge

binjovi/ci Binjovi completed the frozen plan

Details

bf4483fbc9

Trunk 18db1c1f failed to deploy twice and rolled back. Two defects, both
invisible to every guard in tests/check.sh:

- one ')' short in binjovi-untrusted-credential-guard variables[3]. The
  apiserver compiles CEL at apply time only, so the error surfaced as a
  failed kyverno-policies Kustomization after the release had started.
- the binjovi-forgejo-integration-v14 Job template changed under the same
  name. A Job template is immutable, so the binjovi Kustomization failed.

96d9dd02 repaired both. This change makes the gate catch them next time:

- tests/vap-cel-balance.sh lists every CEL expression of every Validating
  and MutatingAdmissionPolicy under kubernetes/ with yq and checks, with
  a small stdlib-only python lexer, that brackets close in order and
  strings terminate. It checks itself against a broken and a whole
  fixture first. Red on the trunk defect, naming the file, policy,
  variables[3] and the missing '('.
- tests/binjovi.sh pins a fingerprint of the current Job template. When
  the template changes, the guard fails and tells the editor to bump the
  generation and record the new fingerprint.

Claude-Session: https://claude.ai/code/session_01LeVatedQ4sCA1u6LHjo7B5