# modgunn CI/build pipeline — driven by the dwarves forge (brokkr descriptor +
# sindri scheduler). `dwarves validate` / `dwarves plan` / `dwarves run [--real]`.
#
# WHY THIS FILE EXISTS (MEASURED 2026-08-25): modgunn had none. Across the whole
# constellation — 38 repos under ~/git — `nornir/brokkr.toml` was the ONLY pipeline
# declaration until Skidbladnir got one the same morning. modgunn is the verdict
# core that BOTH holger and nornir link to break their dependency cycle, and the
# forge had no job for it at all: the one artifact this repo ships was built only
# when a human typed cargo.
#
# WHICH STEPS BUILD AND WHICH RUN — say it once, plainly.
#
# `run = { variant = … }` BUILDS. It is `nornir_build_thing::build_variant`, a
# real cargo build under `--real`
# (`dwarves/crates/dwarves/src/runner.rs`), and it
# produces the shipping artifact.
# `run = { tests = … }` RUNS. `RunKind::Tests` (dwarves `abe10d4`) takes the
# SAME variant's `cargo_args()` with `build` swapped for
# `test` — same package, same features, same
# `--no-default-features`, same profile — through
# `buildgate::run_cargo`. It names a variant rather than
# carrying its own feature list on purpose: a test run
# whose features can drift from the build's tests
# something the forge does not ship.
#
# `RunKind::Container` and `RunKind::Vm` still fall through to `UnwiredRunner`, so
# nothing here declares one. Until `abe10d4` there was no word for a test run at
# all and every pipeline in the constellation declared compile coverage only.
#
# ⚠ VALIDATED AGAINST dwarves 0.1.5 (abe10d4173d0), built from source. The binary
# INSTALLED on this box is 0.1.2 (2026-07-17), which predates `RunKind::Tests` and
# REJECTS this file outright — `dwarves validate` prints "invalid: parse …" with no
# further detail. That is a stale validator, not a bad declaration; the file is
# deliberately ahead of the installed forge. Rebuild/reinstall dwarves before
# reading a red from it.
#
# Every `run = { variant = … }` names a row in `.nornir/build-variants.toml`. There
# is exactly one, because modgunn ships exactly one artifact; the four sibling-shaped
# "atoms" (`modgunn-server`, `-cli`, `-ui`, `-solo`) are named as FICTION in that
# file and asserted as fiction by `tests/build_variants.rs`, so nothing is missing
# here.
#
# ⚠ WHAT THIS PIPELINE DOES NOT COVER, said out loud rather than left implied.
# `.nornir/build-variants.toml` offers eleven features and the single ⭐ variant
# enables five. Six — `warehouse-sql`, `manifests`, `framework`, `framework-oci`,
# `testmatrix`, `test-support` — are enabled by NO variant, so no step below can
# compile them. That is not a gap this file may close on its own: closing it means
# adding `[[build.variant]]` rows, which is a claim about what modgunn SHIPS. It is
# also not theoretical — measured 2026-08-01, two of those six (`warehouse-sql`,
# `test-support`) were outright broken, both on the same
# `Warehouse::reachable_vuln_findings` cfg hole.
#
# Three of the six gate TESTS, counted on this checkout 2026-08-25 — 49 of them:
#
# framework 13 = tests/cli_framework.rs 4 + src/tools.rs 3 + src/service.rs 6
# manifests 35 = tests/manifests_ingest.rs 1 + tests/cli_ingest.rs 4
# + src/manifests.rs 28 + src/capec.rs 2
# testmatrix 1 = tests/testmatrix_wiring.rs
#
# The `src/*.rs` half of that is the shape `nornir_testmatrix::audit_repo` cannot
# see at all, because it walks test TARGETS and these are unit tests inside the
# LIBRARY, hidden behind `#[cfg(feature = …)] pub mod` in `src/lib.rs`. All 49 are
# dark today: compiled by nobody, run by nobody. Fixing that is a variant decision
# for a human, and is recorded here so it stops being invisible.
[pipeline]
name = "modgunn-ci"
[[pipeline.trigger]] # fire when the poll sweep sees HEAD move
kind = "poll"
events = ["push"]
[[pipeline.trigger]] # …and nightly at 03:40 (off nornir 03:00 / skidbladnir 03:20)
kind = "cron"
cron = "40 3 * * *"
# ── the shipping artifact ────────────────────────────────────────────────────
[[pipeline.stage]]
name = "build"
[[pipeline.stage.step]]
name = "gatekeeper"
# The ⭐ fat client: bin `modgunn`, `no_default_features` + the explicit
# scan/scip/warehouse/rustsec/provenance-verify list, i.e. Engine A + Engine B +
# the skade Iceberg seam in one artifact. This is the whole declared build space.
run = { variant = "modgunn" }
# ── the suite that artifact's own feature set lights up ──────────────────────
[[pipeline.stage]]
name = "test"
[[pipeline.stage.step]]
name = "gatekeeper-tests"
needs = ["gatekeeper"]
# `cargo test -p modgunn --no-default-features --features scan,scip,warehouse,
# rustsec,provenance-verify --release` — the ⭐ variant's exact configuration, so
# what is tested is what is shipped. In that configuration the crate-level
# `#![cfg(feature = …)]` opens six integration targets that a plain `cargo test`
# compiles to empty binaries: cli_behavior 12, cli_warehouse 5, cli_provenance 5,
# cli_zone 3, cli_scorecard 3, engine_ab_equivalence 2 — 30 integration tests plus
# the library's own, none of which the forge could ask for before dwarves `abe10d4`.
run = { tests = "modgunn" }