feat(ci): Phase 0 D1 — publish shape schema + portable validator - #274
Merged
Conversation
…-0008) Publishes the shape contract and a portable validator so standalone Homelab.Stacks.* repos can validate their own shapes in CI — the first Phase 0 deliverable that unlocks stack extraction (#272). - build: new Fallout PublishValidator target — publishes the C# engine as a self-contained linux-x64 single-file binary with shape.schema.json beside it (mirrors PublishPowerOrchestrator). Same engine, ADR-0001's one validator, made portable: runs with no .NET SDK / private feeds / self-hosted runner. - ci: publish-schema.yml — builds the validator on the self-hosted runner (needs the cross-org package feeds, like validate-shapes.yml), then releases shape.schema.json + homelab-validate-linux-x64.tar.gz on ubuntu. Versioning tracks apiVersion homelab/v1: a moving `schema-v1` channel (consumers pin @schema-v1) refreshed on relevant main pushes, plus an optional immutable point release via workflow_dispatch. - gitignore: publish/ + dist/ (self-contained output + packaged assets). Refs #272. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This was referenced Jul 20, 2026
ChrisonSimtian
added a commit
that referenced
this pull request
Jul 20, 2026
**Phase 0, Deliverable 2** of the stack-extraction epic (#272), per [ADR-0008](docs/adr/ADR-0008-stack-extraction-meta-repo.md). Builds on D1 (#274), whose `schema-v1` release is now live. ## What `.github/workflows/_validate-shapes.yml` — a **reusable, opt-in** workflow a standalone `Homelab.Stacks.*` repo calls from its own PR pipeline. It downloads the pinned **portable validator** from the Homelab `schema-v1` release and runs the **same C# engine `validate`** over the repo's shapes on `ubuntu-latest` — no .NET SDK, no private feeds, no self-hosted runner. Caller example (added to each stack repo during Phase 1 extraction): ```yaml jobs: shapes: uses: Chrison-dev/Homelab/.github/workflows/_validate-shapes.yml@main secrets: schema-token: ${{ secrets.SCHEMA_RO_PAT }} # contents:read on Chrison-dev/Homelab ``` ## Correctness notes - The engine's `validate` has an **`apiVersion: homelab/v1` gate** (`ShapeValidator.IsHomelabShape`), so it skips `.github/workflows/*.yml`, `compose.yml`, `.env`, etc. — pointing it at the repo root is safe. - `validate <dir>` recurses (as proven by the superproject's `validate stacks/`), so shapes at the repo root **and** in service subdirs are all covered. - The tarball ships `homelab-infra` + `schema/shape.schema.json`; the engine resolves the schema from `AppContext.BaseDirectory` (verified with a `test -f`). ## Design This is the **lightweight, early-feedback mirror**; the superproject's `validate-shapes.yml` (`./build.sh ValidateShapes`) remains the full-fidelity gate. One validator (ADR-0001), made portable — not a second implementation. Also adds a `#275` breadcrumb to `publish-schema.yml` (the hand-rolled release steps are interim pending native Fallout publish). ## Note No stack repo consumes this yet — the first caller lands with the SmartHome extraction (Phase 1). Requires an org/repo secret `SCHEMA_RO_PAT` on consumers. Refs #272. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ChrisonSimtian
added a commit
that referenced
this pull request
Jul 20, 2026
**Phase 0, Deliverable 3** (final) of the stack-extraction epic (#272), per [ADR-0008](docs/adr/ADR-0008-stack-extraction-meta-repo.md). ## What `.github/workflows/bump-stack-submodules.yml` — a weekly (+ `workflow_dispatch`) bot that advances every `stacks/*` submodule pointer to its remote default-branch HEAD and opens **one** PR with the bumps. - Turns **submodule drift into a reviewable PR** — the exact stale-pointer trap we hit by hand this session. - Removes the manual **"second PR"** after a stack repo merges its own change. - The bump PR touches `stacks/**`, so **`validate-shapes.yml` gates** the newly-pinned shapes in the superproject before merge. ## Tokens & idempotency - `SUBMODULES_RO_PAT` fetches the private `Homelab.Stacks.*` repos (`--remote`); the default `GITHUB_TOKEN` (contents + pull-requests write) pushes the branch + opens the PR. - Fixed `automation/bump-stack-submodules` branch → one open PR, force-updated each run. ## Phase 0 status — complete | | Deliverable | PR | |---|---|---| | D1 | Schema + portable validator | #274 ✅ merged | | D2 | Opt-in reusable validate action | #276 | | D3 | Submodule auto-bump bot | this | With these merged, Phase 0 is done and stack extraction (SmartHome, BuildLab — Phase 1) is unblocked. Also filed #275 (move the interim hand-rolled release to native Fallout publish). Refs #272. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase 0, Deliverable 1 of the stack-extraction epic (#272) — per ADR-0008. This is the foundation everything else depends on.
What
Publishes the shape contract and a portable validator so standalone
Homelab.Stacks.*repos can validate their shapes in CI without the full engine build.build/Build.cs—PublishValidatortarget. Publishes the C# engine as a self-containedlinux-x64single-file binary withshape.schema.jsonbeside it (mirrors the existingPublishPowerOrchestrator). Same engine → ADR-0001's one validator, made portable: no .NET SDK, no private feeds, no self-hosted runner needed to run it..github/workflows/publish-schema.yml. Builds the validator on the self-hosted runner (needs the cross-org package feeds, exactly likevalidate-shapes.yml), then publishes two release assets onubuntu-latest:shape.schema.json(the contract, for humans/tools)homelab-validate-linux-x64.tar.gz(the portable validator).gitignore—publish/+dist/.Versioning
Tracks the shapes'
apiVersion: homelab/v1:schema-v1— a moving channel refreshed on every relevantmainpush. Consumers pin@schema-v1(breaking contract change →schema-v2).version— optional immutable point release (e.g.schema-v1.0.0).Why this shape
The engine's
validateis a pure, offline command (onlyconvergetouches the cluster) and the csproj already copies the schema beside the binary, resolved fromAppContext.BaseDirectory— so a self-contained publish is self-sufficient. Reusing the engine (rather than a second JSON-Schema checker) keeps the one-validator principle from ADR-0001.Validation
Build.cstarget verified locally; the self-contained publish + release runs in CI on merge (can't exercise GH Actions locally).@schema-v1), then D3 (submodule auto-bump PR bot).Refs #272.
🤖 Generated with Claude Code