@raishin/vanguard-frontier-agentic 1.9.0 → 2.0.0

package/tests/integration/rbac-pre-flight/run-all.sh

@@ -0,0 +1,229 @@
+#!/usr/bin/env bash
+# tests/integration/rbac-pre-flight/run-all.sh
+#
+# Regression harness for all 7 live-guard least-privilege RBAC manifests.
+# Creates a kind cluster, applies all RBAC manifests, runs every guard's
+# pre-flight assertion matrix, tears down the cluster, and reports totals.
+#
+# Usage:
+#   ./run-all.sh                         # full run (creates + destroys cluster)
+#   ./run-all.sh --skip-cluster-create   # use an existing cluster
+#   ./run-all.sh --guard=network-arch    # run one guard only
+#   ./run-all.sh --skip-cluster-create --guard=rbac-mutation
+#
+# Environment variables:
+#   KIND_K8S_VERSION   kind node image tag (default: v1.30.6)
+#
+# Exit codes:
+#   0  all guards passed (skips do not count as failures)
+#   1  one or more assertions failed
+
+set -euo pipefail
+
+# ---------------------------------------------------------------------------
+# Resolve paths relative to this script regardless of caller's cwd
+# ---------------------------------------------------------------------------
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="$(cd "$SCRIPT_DIR/../../.." && pwd)"
+LOG_FILE="/tmp/rbac-preflight-$(date +%Y%m%d-%H%M%S).log"
+
+# ---------------------------------------------------------------------------
+# Defaults
+# ---------------------------------------------------------------------------
+SKIP_CLUSTER_CREATE=false
+ONLY_GUARD=""
+CLUSTER_NAME="vanguard-rbac-test"
+KIND_IMAGE="kindest/node:${KIND_K8S_VERSION:-v1.30.6}"
+
+# ---------------------------------------------------------------------------
+# Parse arguments
+# ---------------------------------------------------------------------------
+for arg in "$@"; do
+  case "$arg" in
+    --skip-cluster-create)
+      SKIP_CLUSTER_CREATE=true
+      ;;
+    --guard=*)
+      ONLY_GUARD="${arg#--guard=}"
+      ;;
+    --help|-h)
+      grep '^#' "$0" | sed 's/^# \?//'
+      exit 0
+      ;;
+    *)
+      printf 'Unknown argument: %s\n' "$arg" >&2
+      exit 1
+      ;;
+  esac
+done
+
+# ---------------------------------------------------------------------------
+# Source the shared library
+# ---------------------------------------------------------------------------
+# shellcheck source=lib/common.sh
+source "$SCRIPT_DIR/lib/common.sh"
+
+require_kubectl
+
+# ---------------------------------------------------------------------------
+# Cluster lifecycle
+# ---------------------------------------------------------------------------
+create_cluster() {
+  if ! command -v kind &>/dev/null; then
+    printf '%bFATAL: kind not found in PATH. Install kind >= 0.22 and retry.%b\n' \
+      "$_RED" "$_RESET" >&2
+    exit 1
+  fi
+
+  printf '%bCreating kind cluster %s (%s)...%b\n' \
+    "$_CYAN" "$CLUSTER_NAME" "$KIND_IMAGE" "$_RESET"
+
+  kind create cluster \
+    --name "$CLUSTER_NAME" \
+    --image "$KIND_IMAGE" \
+    --config - <<'EOF'
+kind: Cluster
+apiVersion: kind.x-k8s.io/v1alpha4
+nodes:
+  - role: control-plane
+EOF
+
+  printf '%bCluster ready.%b\n' "$_GREEN" "$_RESET"
+}
+
+delete_cluster() {
+  if command -v kind &>/dev/null; then
+    printf '\n%bDeleting kind cluster %s...%b\n' "$_CYAN" "$CLUSTER_NAME" "$_RESET"
+    kind delete cluster --name "$CLUSTER_NAME" 2>/dev/null || true
+  fi
+}
+
+# ---------------------------------------------------------------------------
+# Cleanup trap — always remove the cluster on exit unless skipped
+# ---------------------------------------------------------------------------
+cleanup() {
+  local exit_code=$?
+  if [ "$SKIP_CLUSTER_CREATE" = "false" ]; then
+    delete_cluster
+  fi
+  if [ -f "$LOG_FILE" ]; then
+    printf '\nTest output saved to: %s\n' "$LOG_FILE"
+  fi
+  exit $exit_code
+}
+trap cleanup EXIT
+
+# ---------------------------------------------------------------------------
+# Apply RBAC manifests
+# ---------------------------------------------------------------------------
+apply_rbac_manifests() {
+  printf '\n%bApplying RBAC manifests...%b\n' "$_CYAN" "$_RESET"
+
+  # Ensure the vanguard-system namespace exists
+  kubectl create namespace vanguard-system --dry-run=client -o yaml \
+    | kubectl apply -f -
+
+  local manifests=(
+    "skills/kubernetes/kubernetes-live-network-architecture-mutation-guard/references/least-privilege-rbac.yaml"
+    "agents/kubernetes/kubernetes-live-network-policy-guard-agent/references/least-privilege-rbac.yaml"
+    "agents/kubernetes/kubernetes-live-mesh-policy-guard-agent/references/least-privilege-rbac.yaml"
+    "agents/kubernetes/kubernetes-live-admission-policy-guard-agent/references/least-privilege-rbac.yaml"
+    "agents/kubernetes/kubernetes-live-argocd-sync-guard-agent/references/least-privilege-rbac.yaml"
+    "agents/kubernetes/kubernetes-live-rbac-mutation-guard-agent/references/least-privilege-rbac.yaml"
+    "agents/kubernetes/kubernetes-live-velero-restore-guard-agent/references/least-privilege-rbac.yaml"
+  )
+
+  for manifest in "${manifests[@]}"; do
+    local full_path="$REPO_ROOT/$manifest"
+    if [ ! -f "$full_path" ]; then
+      printf '%bWARN: manifest not found, skipping: %s%b\n' \
+        "$_YELLOW" "$full_path" "$_RESET" >&2
+      continue
+    fi
+    printf '  Applying %s\n' "$manifest"
+    kubectl apply -f "$full_path"
+  done
+
+  printf '%bManifests applied.%b\n' "$_GREEN" "$_RESET"
+}
+
+# ---------------------------------------------------------------------------
+# Source guard files and run them
+# ---------------------------------------------------------------------------
+# shellcheck source=guards/network-arch.sh
+source "$SCRIPT_DIR/guards/network-arch.sh"
+# shellcheck source=guards/network-policy.sh
+source "$SCRIPT_DIR/guards/network-policy.sh"
+# shellcheck source=guards/mesh-policy.sh
+source "$SCRIPT_DIR/guards/mesh-policy.sh"
+# shellcheck source=guards/admission-policy.sh
+source "$SCRIPT_DIR/guards/admission-policy.sh"
+# shellcheck source=guards/argocd-sync.sh
+source "$SCRIPT_DIR/guards/argocd-sync.sh"
+# shellcheck source=guards/rbac-mutation.sh
+source "$SCRIPT_DIR/guards/rbac-mutation.sh"
+# shellcheck source=guards/velero-restore.sh
+source "$SCRIPT_DIR/guards/velero-restore.sh"
+
+run_guards() {
+  # Map of guard names to their runner functions
+  declare -A GUARD_FN=(
+    [network-arch]=run_guard_network_arch
+    [network-policy]=run_guard_network_policy
+    [mesh-policy]=run_guard_mesh_policy
+    [admission-policy]=run_guard_admission_policy
+    [argocd-sync]=run_guard_argocd_sync
+    [rbac-mutation]=run_guard_rbac_mutation
+    [velero-restore]=run_guard_velero_restore
+  )
+
+  # Ordered list (bash 3 compat — no associative array ordering guarantee)
+  local GUARD_ORDER=(
+    network-arch
+    network-policy
+    mesh-policy
+    admission-policy
+    argocd-sync
+    rbac-mutation
+    velero-restore
+  )
+
+  if [ -n "$ONLY_GUARD" ]; then
+    if [ -z "${GUARD_FN[$ONLY_GUARD]+_}" ]; then
+      printf '%bUnknown guard: %s%b\n' "$_RED" "$ONLY_GUARD" "$_RESET" >&2
+      printf 'Available guards: %s\n' "${GUARD_ORDER[*]}" >&2
+      exit 1
+    fi
+    "${GUARD_FN[$ONLY_GUARD]}"
+  else
+    for guard in "${GUARD_ORDER[@]}"; do
+      "${GUARD_FN[$guard]}" || true  # failures tracked in counters; don't abort
+    done
+  fi
+}
+
+# ---------------------------------------------------------------------------
+# Main
+# ---------------------------------------------------------------------------
+{
+  printf '%b=== Vanguard RBAC Pre-flight Integration Test ===%b\n' "$_CYAN" "$_RESET"
+  printf 'Cluster: %s | Image: %s\n' "$CLUSTER_NAME" "$KIND_IMAGE"
+  printf 'Log: %s\n' "$LOG_FILE"
+
+  if [ "$SKIP_CLUSTER_CREATE" = "false" ]; then
+    create_cluster
+  else
+    printf '%b(--skip-cluster-create: using current kubeconfig context)%b\n' \
+      "$_YELLOW" "$_RESET"
+  fi
+
+  apply_rbac_manifests
+  run_guards
+
+  # report_total exits 1 if any failures
+  if report_total; then
+    exit 0
+  else
+    exit 1
+  fi
+} 2>&1 | tee "$LOG_FILE"

package/tests/test-copilot-skill-bundling.py

@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""Test: --platform copilot bundles companion skills into .github/skills/.
+
+TDD RED/GREEN test for GitHub Copilot skill bundling in the exporter.
+
+Run:
+    python3 tests/test-copilot-skill-bundling.py
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+EXPORTER = ROOT / "scripts" / "export-marketplace-agents.mjs"
+
+# aws-agentcore-agent has a companion skill (aws-agentcore) via name-stripping
+AGENT_ID = "aws-agentcore-agent"
+SKILL_ID = "aws-agentcore"
+
+
+def run_export(repo: Path, platform: str, agents: str) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        [
+            "node",
+            str(EXPORTER),
+            "--platform",
+            platform,
+            "--agents",
+            agents,
+            "--repo",
+            str(repo),
+        ],
+        capture_output=True,
+        text=True,
+        cwd=str(ROOT),
+    )
+
+
+def test_copilot_skill_bundled_to_github_skills() -> None:
+    """Companion skill must land in .github/skills/<skill-id>/SKILL.md."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        repo = Path(tmpdir)
+        result = run_export(repo, "copilot", AGENT_ID)
+
+        if result.returncode != 0:
+            print("STDOUT:", result.stdout)
+            print("STDERR:", result.stderr)
+            raise AssertionError(
+                f"Exporter exited with code {result.returncode}"
+            )
+
+        skill_md = repo / ".github" / "skills" / SKILL_ID / "SKILL.md"
+        if not skill_md.exists():
+            print("STDOUT:", result.stdout)
+            print("STDERR:", result.stderr)
+            raise AssertionError(
+                f"Expected skill file not found: {skill_md}\n"
+                f"Directory tree under .github/skills: "
+                + str(list((repo / ".github" / "skills").rglob("*")) if (repo / ".github" / "skills").exists() else [])
+            )
+
+        # Also verify the agent itself was installed to .github/agents/
+        agent_files = list((repo / ".github" / "agents").rglob("*.agent.md")) if (repo / ".github" / "agents").exists() else []
+        if not agent_files:
+            raise AssertionError(
+                f"Expected agent file in .github/agents/ but found none"
+            )
+
+        print(f"PASS: skill bundled to {skill_md.relative_to(repo)}")
+        print(f"PASS: agent installed to {agent_files[0].relative_to(repo)}")
+
+
+def test_copilot_no_skills_flag_suppresses_bundling() -> None:
+    """--no-skills must suppress companion skill bundling."""
+    with tempfile.TemporaryDirectory() as tmpdir:
+        repo = Path(tmpdir)
+        result = subprocess.run(
+            [
+                "node",
+                str(EXPORTER),
+                "--platform",
+                "copilot",
+                "--agents",
+                AGENT_ID,
+                "--repo",
+                str(repo),
+                "--no-skills",
+            ],
+            capture_output=True,
+            text=True,
+            cwd=str(ROOT),
+        )
+
+        if result.returncode != 0:
+            raise AssertionError(
+                f"Exporter exited with code {result.returncode}\n"
+                f"STDERR: {result.stderr}"
+            )
+
+        skill_md = repo / ".github" / "skills" / SKILL_ID / "SKILL.md"
+        if skill_md.exists():
+            raise AssertionError(
+                f"Skill file should NOT exist with --no-skills: {skill_md}"
+            )
+
+        print("PASS: --no-skills suppresses skill bundling for copilot platform")
+
+
+if __name__ == "__main__":
+    failures = []
+    for test_fn in [
+        test_copilot_skill_bundled_to_github_skills,
+        test_copilot_no_skills_flag_suppresses_bundling,
+    ]:
+        try:
+            test_fn()
+        except AssertionError as exc:
+            failures.append(f"FAIL [{test_fn.__name__}]: {exc}")
+            print(f"FAIL [{test_fn.__name__}]: {exc}")
+
+    if failures:
+        sys.exit(1)
+    else:
+        print("All tests passed.")
+        sys.exit(0)

package/tests/test-gemini-skill-bundling.py

@@ -0,0 +1,102 @@
+#!/usr/bin/env python3
+"""TDD test: Gemini CLI skill bundling via export-marketplace-agents.mjs.
+
+Asserts that --platform gemini bundles companion skills into .gemini/skills/<skill>/SKILL.md.
+Agent under test: azure-cosmosdb-platform-operator-agent (companion: azure-cosmosdb-platform-operator).
+
+Run: python3 tests/test-gemini-skill-bundling.py
+Exit 0 = all assertions passed.
+Exit 1 = one or more assertions failed.
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+import tempfile
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+SCRIPT = ROOT / "scripts" / "export-marketplace-agents.mjs"
+
+AGENT_ID = "azure-cosmosdb-platform-operator-agent"
+SKILL_NAME = "azure-cosmosdb-platform-operator"
+EXPECTED_SKILL_REL = f".gemini/skills/{SKILL_NAME}/SKILL.md"
+
+PASS = 0
+FAIL = 0
+
+
+def pass_(msg: str) -> None:
+    global PASS
+    print(f"  PASS: {msg}")
+    PASS += 1
+
+
+def fail(msg: str) -> None:
+    global FAIL
+    print(f"  FAIL: {msg}")
+    FAIL += 1
+
+
+def run_export(tmpdir: Path) -> subprocess.CompletedProcess:
+    return subprocess.run(
+        [
+            "node",
+            str(SCRIPT),
+            "--platform", "gemini",
+            "--agents", AGENT_ID,
+            "--repo", str(tmpdir),
+            "--force",
+        ],
+        capture_output=True,
+        text=True,
+        cwd=str(ROOT),
+    )
+
+
+def test_skill_bundled_to_gemini_path() -> None:
+    print(f"\n[test] gemini skill bundling → {EXPECTED_SKILL_REL}")
+    with tempfile.TemporaryDirectory() as tmpdir:
+        result = run_export(Path(tmpdir))
+
+        if result.returncode != 0:
+            fail(f"exporter exited {result.returncode}: {result.stderr.strip()}")
+            return
+
+        skill_md = Path(tmpdir) / EXPECTED_SKILL_REL
+        if skill_md.is_file():
+            pass_(f"SKILL.md present at {EXPECTED_SKILL_REL}")
+        else:
+            fail(f"SKILL.md NOT found at {EXPECTED_SKILL_REL}")
+            print(f"    stdout: {result.stdout.strip()}")
+            print(f"    stderr: {result.stderr.strip()}")
+
+        # Also confirm the "not yet supported" notice is NOT emitted
+        if "not yet supported" in result.stderr:
+            fail("stderr still contains 'not yet supported' notice for gemini platform")
+        else:
+            pass_("no 'not yet supported' notice in stderr")
+
+        # Confirm bundled count in stderr
+        if "Bundled" in result.stderr and "companion skill" in result.stderr:
+            pass_("bundled summary line present in stderr")
+        else:
+            fail(f"bundled summary line missing from stderr: {result.stderr.strip()!r}")
+
+
+def main() -> None:
+    print(f"=== Gemini CLI skill bundling test ===")
+    print(f"Script : {SCRIPT}")
+    print(f"Agent  : {AGENT_ID}")
+    print(f"Expect : {EXPECTED_SKILL_REL}")
+
+    test_skill_bundled_to_gemini_path()
+
+    print(f"\nResults: {PASS} passed, {FAIL} failed")
+    if FAIL:
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()