From b3f006f7a482392189a46c324ad4f28c4c3a2d2a Mon Sep 17 00:00:00 2001 From: Jens Tirsvad Nielsen Date: Sat, 10 Oct 2026 13:32:29 +0800 Subject: [PATCH] Record that reusable workflows work on the instance Verified on 2026-10-10 with throwaway branches (deleted afterwards): workflow_call and uses run from the same repository, another repository of the organisation and a repository of another organisation, so MIL-003 needs no copied-template fallback. Not tested: a private provider, secrets passed to a called workflow, and a tag reference. Review it (RC-033) and update TM-001. Task: MIL-003#1 --- docs/artifact-registry.md | 2 +- docs/milestones/mil-003-quality-checks.md | 27 +++++++++-- .../rc-033-mil-003-reusable-workflows.md | 45 +++++++++++++++++++ docs/sqa/traceability-matrix.md | 11 ++--- 4 files changed, 75 insertions(+), 10 deletions(-) create mode 100644 docs/sqa/reviews/rc-033-mil-003-reusable-workflows.md diff --git a/docs/artifact-registry.md b/docs/artifact-registry.md index 489c564..d32aea3 100644 --- a/docs/artifact-registry.md +++ b/docs/artifact-registry.md @@ -11,7 +11,7 @@ each document lives in *this* project and the next version to use. | SA | Stakeholder Analysis | docs/stakeholder-analysis.md | 002 | | PP | Project Plan | docs/project-plan.md | 002 | | MIL | Milestone / Gateway | docs/milestones/*.md | 007 | -| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 033 | +| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 034 | | TM | Traceability Matrix | docs/sqa/traceability-matrix.md | 002 | | ADR | Architecture Decision Record | docs/adr/adr-NNNN-*.md | 0005 | | UCD | Use Case Diagram | docs/use-case-diagram.md | 002 | diff --git a/docs/milestones/mil-003-quality-checks.md b/docs/milestones/mil-003-quality-checks.md index 8f086b1..053ced8 100644 --- a/docs/milestones/mil-003-quality-checks.md +++ b/docs/milestones/mil-003-quality-checks.md @@ -9,8 +9,8 @@ ## Version History | Date | Status | Author | Reviewer | Change | Commit | | --- | --- | --- | --- | --- | --- | -| 2026-10-03 | Deprecated | Jens Tirsvad Nielsen | S01 | Owner is S05 (security authority); S01 remains approving reviewer | [4de5438] | -| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Target date 2026-11-14 confirmed on 2026-10-10 by S01 (stand-in for S05) | [ea06eaa] | +| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | Target date 2026-11-14 confirmed on 2026-10-10 by S01 (stand-in for S05) | [ea06eaa] | +| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Task 1 verified: workflow_call and uses work from the same repository, the same organization and another organization (RC-033) | pending | --- @@ -60,15 +60,34 @@ other repository, and a guide for reading its results. | # | Task | Summary | Needs its own Use Case/User Story? | Reference | | --- | --- | --- | --- | --- | -| 1 | Verify reusable workflow support | Check whether this Gitea version supports `workflow_call` and cross-repository `uses`; if not, choose a copied template instead. | No | | +| 1 | Verify reusable workflow support | Check whether this Gitea version supports `workflow_call` and cross-repository `uses`; if not, choose a copied template instead. Verified on 2026-10-10: supported, so no copied template is needed (see Verification results). | No | Verification results | | 2 | Define the quality-check contract | Decide the inputs (language, tool versions, working directory) and what a pass and a fail mean. Start with Python and shell. This is something an engineer does, so it needs a use case first. | Yes | Use case candidate: run project quality checks | | 3 | Implement the reusable quality workflow | Create the workflow in the canonical location with pinned tool versions and least-privilege permissions. | No | | | 4 | Adopt it in one other repository | Onboard a real project and fix the gaps in the guide that appear. | No | | | 5 | Write the guide for reading results | Explain status checks, logs and typical fixes so an engineer can make a failing check pass. | No | | +## Verification results + +Task 1 was run on 2026-10-10 on the instance (Gitea 1.27.3) with a throwaway +branch, `verify-reusable-workflows`, in `TirSystem/github-action`. The called +workflow declared `on: workflow_call` with one input and printed it; the +callers used `jobs..uses`. All branches were deleted afterwards. + +| Call | Caller | Result | +| --- | --- | --- | +| `uses: ./.gitea/workflows/reuse-callee.yml` | `TirSystem/github-action` (same repository) | Called job ran; input received | +| `uses: TirSystem/github-action/.gitea/workflows/reuse-callee.yml@` | `TirSystem/github-action` | Called job ran; input received | +| the same, from another repository of the organization | `TirSystem/sqa-qc-checklists` | Called job ran; `gitea.repository` was the caller | +| the same, from a repository of another organization | `TirSystem-BashScript/RepoFoundry` | Called job ran; `gitea.repository` was the caller | + +What the test did not cover: a provider repository that is private (the +provider here is public), passing secrets to a called workflow +(`secrets:` or `secrets: inherit`), and a reference by tag instead of a +branch. The quality checks of this milestone need none of the secrets; a +private provider and tag references are for the release milestone (MIL-004). + --- [BC-001]: ../business-case.md -[4de5438]: https://git.tirsystem.com/TirSystem/github-action/commit/4de5438a88b4bbf18b165f52f797d1a52af89f6d [ADR-0002]: ../adr/adr-0002-s01-approves-as-stand-in.md [ea06eaa]: https://git.tirsystem.com/TirSystem/github-action/commit/ea06eaaa698247d20e4a8e2694d7acbb1de58b63 diff --git a/docs/sqa/reviews/rc-033-mil-003-reusable-workflows.md b/docs/sqa/reviews/rc-033-mil-003-reusable-workflows.md new file mode 100644 index 0000000..c7340c4 --- /dev/null +++ b/docs/sqa/reviews/rc-033-mil-003-reusable-workflows.md @@ -0,0 +1,45 @@ +# Review Record: MIL-003 (reusable workflow support verified) + +## Metadata +| Key | Value | +| --- | --- | +| ID | RC-033 | +| CrossReference | [MIL-003], [QC-MIL-001] | + +## Version History +| Date | Status | Author | Reviewer | Change | Commit | +| --- | --- | --- | --- | --- | --- | +| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Initial version | pending | + +--- + +## Artifact Under Review + +- Instance reviewed: [MIL-003] +- Checklist used: [QC-MIL-001] + +## Checklist Results + +| # | Criterion | Status | Evidence/Notes | +| --- | --- | --- | --- | +| 1 | A concrete deliverable is defined for every gate | Pass | Unchanged. | +| 2 | Explicit Go/No-Go criteria are stated for each gate | Pass | Unchanged; criterion 1 (reusable workflows verified and recorded) is now evidenced by the Verification results. | +| 3 | Dependencies on other milestones are explicitly mapped | Pass | Unchanged. | +| 4 | Each milestone is traceable to a Business Case objective or KPI | Pass | Unchanged. | +| 5 | Milestone owner and approving reviewer are identified | Pass | Unchanged. | +| 6 | Milestone has a defined target date consistent with project constraints | Pass | Unchanged. | + +## Overall Verdict + +Go - all six criteria pass; the reviewed change records the result of task 1 and its limits (private provider, secrets, tag references not tested). S01 gave the Go in chat on 2026-10-10, standing in for the other reviewers as ADR-0002 records; there is no independent reader. + +## Action Items + +| Action | Owner | Due | +| --- | --- | --- | +| Test a private provider repository, `secrets: inherit` and a tag reference before MIL-004 relies on them | S05 | 2026-11-28 | + +--- + +[MIL-003]: ../../milestones/mil-003-quality-checks.md +[QC-MIL-001]: ../../../framework/qc/qc-milestones-gateways.md diff --git a/docs/sqa/traceability-matrix.md b/docs/sqa/traceability-matrix.md index e5a221c..273eae9 100644 --- a/docs/sqa/traceability-matrix.md +++ b/docs/sqa/traceability-matrix.md @@ -4,13 +4,13 @@ | Key | Value | | --- | --- | | ID | TM-001 | -| CrossReference | [BC-001], [SA-001], [PP-001], [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005], [MIL-006], [RC-001], [RC-002], [RC-003], [RC-004], [RC-005], [RC-006], [RC-007], [RC-008], [RC-009], [RC-010], [RC-011], [RC-012], [RC-013], [RC-014], [RC-015], [RC-016], [RC-017], [RC-018], [RC-019], [RC-020], [RC-021], [RC-022], [RC-023], [RC-024], [RC-025], [RC-026], [RC-027], [RC-028], [RC-029], [RC-030], [RC-031], [RC-032], [UCD-001], [US-001], [UC-001], [UC-002], [UC-003], [UC-004], [ADR-0001], [ADR-0002], [ADR-0003], [ADR-0004] | +| CrossReference | [BC-001], [SA-001], [PP-001], [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005], [MIL-006], [RC-001], [RC-002], [RC-003], [RC-004], [RC-005], [RC-006], [RC-007], [RC-008], [RC-009], [RC-010], [RC-011], [RC-012], [RC-013], [RC-014], [RC-015], [RC-016], [RC-017], [RC-018], [RC-019], [RC-020], [RC-021], [RC-022], [RC-023], [RC-024], [RC-025], [RC-026], [RC-027], [RC-028], [RC-029], [RC-030], [RC-031], [RC-032], [RC-033], [UCD-001], [US-001], [UC-001], [UC-002], [UC-003], [UC-004], [ADR-0001], [ADR-0002], [ADR-0003], [ADR-0004] | ## Version History | Date | Status | Author | Reviewer | Change | Commit | | --- | --- | --- | --- | --- | --- | -| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | Added UCD-001, US-001, UC-001 to UC-004 and RC-019 to RC-025 | [a2bf2d4] | -| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Added RC-026 to RC-032 (dates confirmed) | [ea06eaa] | +| 2026-10-10 | Deprecated | Jens Tirsvad Nielsen | S01 | Added RC-026 to RC-032 (dates confirmed) | [ea06eaa] | +| 2026-10-10 | Accepted | Jens Tirsvad Nielsen | S01 | Added RC-033 for MIL-003 | pending | --- @@ -29,7 +29,7 @@ updated whenever an artifact instance is created or reviewed. | [PP-001] | PP | [BC-001], [SA-001] | [MIL-001], [MIL-002], [MIL-003], [MIL-004], [MIL-005], [MIL-006], [US-001] | [RC-002], [RC-009], [RC-015], [RC-017], [RC-025], [RC-032] | | [MIL-001] | MIL | [BC-001], [PP-001] | [MIL-002] | [RC-003], [RC-026] | | [MIL-002] | MIL | [BC-001], [PP-001], [MIL-001] | [MIL-003], [MIL-005] | [RC-005], [RC-027] | -| [MIL-003] | MIL | [BC-001], [PP-001], [MIL-002] | [MIL-004] | [RC-006], [RC-028] | +| [MIL-003] | MIL | [BC-001], [PP-001], [MIL-002] | [MIL-004] | [RC-006], [RC-028], [RC-033] | | [MIL-004] | MIL | [BC-001], [PP-001], [MIL-003] | - | [RC-007], [RC-029] | | [RC-001] | RC | [BC-001] | - | - | | [RC-002] | RC | [PP-001] | - | - | @@ -75,6 +75,7 @@ updated whenever an artifact instance is created or reviewed. | [RC-030] | RC | [MIL-005] | - | - | | [RC-031] | RC | [MIL-006] | - | - | | [RC-032] | RC | [PP-001] | - | - | +| [RC-033] | RC | [MIL-003] | - | - | ## Coverage Notes @@ -136,5 +137,5 @@ updated whenever an artifact instance is created or reviewed. [RC-030]: ./reviews/rc-030-mil-005-date.md [RC-031]: ./reviews/rc-031-mil-006-date.md [RC-032]: ./reviews/rc-032-pp-001-dates.md -[a2bf2d4]: https://git.tirsystem.com/TirSystem/github-action/commit/a2bf2d420416f7aff2badc6fe32a7690e2e523fd +[RC-033]: ./reviews/rc-033-mil-003-reusable-workflows.md [ea06eaa]: https://git.tirsystem.com/TirSystem/github-action/commit/ea06eaaa698247d20e4a8e2694d7acbb1de58b63