diff --git a/exceptions/register.md b/exceptions/register.md index 5de5a6d..1b3ad87 100644 --- a/exceptions/register.md +++ b/exceptions/register.md @@ -13,6 +13,10 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in | [EX-0006](#ex-0006) | Open | K22-CI-16 (tag-only environment secrets) | standards | 2027-04-10; review 2027-01-10 | | [EX-0007](#ex-0007) | Closed | K22-REPO-12 (enrollment) | KofTwentyTwo/standards | Closed 2026-10-10 | | [EX-0008](#ex-0008) | Open | K22-CI-21 (HIGH dependency finding) | Website-Frontend, development-only braces 3.0.3 | 2026-11-10; review 2026-10-17 | +| [EX-0009](#ex-0009) | Open | K22-REPO-20 (linear history), K22-REPO-22 (squash only) | Website-Backend, Website-Frontend, Munitor, cluster-gitops | Reviewed yearly, next on 2027-10-12 | +| [EX-0010](#ex-0010) | Open | K22-CI-01, K22-CI-10 to K22-CI-24, K22-CI-30 (GitHub Actions gates and reusable workflows) | Website-Backend, Website-Frontend, Munitor | 2027-04-12; review 2027-01-12 | +| [EX-0011](#ex-0011) | Open | K22-CODE-TS-01, K22-CODE-SH-02 (Kingsrook 3-space layout) | Website-Frontend (TypeScript), Munitor (shell) | 2027-04-12; review 2027-01-12 | +| [EX-0012](#ex-0012) | Open | K22-CODE-TF-04 (state never committed), K22-CODE-TF-05 (no secrets in `.tfvars`) | Praetor | Reviewed yearly, next on 2027-10-12 | ## EX-0001 @@ -232,3 +236,110 @@ Open and closed exceptions to the KofTwentyTwo standards. The process is in - **Owner:** James Maes, repository maintainer. - **Review date:** 2026-10-17. Remove the consumer exception and close this entry once the affected dependency is replaced or patched. + +## EX-0009 + +**GitFlow with merge commits for Munitor-released and GitOps repositories** + +- **Requirements:** `K22-REPO-20` (linear history on `main`) and `K22-REPO-22` + (squash-only merges). +- **Scope:** `KofTwentyTwo/Website-Backend`, `KofTwentyTwo/Website-Frontend`, + `KofTwentyTwo/Munitor` (`develop` and `main`, `feature/*` and `hotfix/*` branches) + and `KofTwentyTwo/cluster-gitops` (`main`, merge commits). +- **Reason:** these repositories run GitFlow with merge commits. In Website-Backend + and Website-Frontend, `feature/*` and `hotfix/*` branches (and `develop` + promotions) merge to `main`, which releases and deploys through Munitor, and a + `main` to `develop` back-merge follows. Munitor itself merges `feature/*` into + `develop`, `release/X.Y.Z` into `main`, back-merges `main` into `develop`, and a + `vX.Y.Z` tag publishes the orb. Squash + or rebase merges break the ancestry between `develop` and `main` that the pipeline + relies on. cluster-gitops keeps merge commits so each change set applied by ArgoCD + stays one reviewable unit next to the automated image-bump commits. +- **Risk:** non-linear history is harder to bisect and to read, and a merge commit can + carry several commits that were never reviewed individually. +- **Compensating controls:** every human change to the Website repositories and + Munitor reaches `main` through a pull request; repository rulesets require signed + commits and the CircleCI checks on `main` and `develop`. cluster-gitops (Internal + tier, no CI) requires signed commits and blocks deletion and force pushes on `main`; + the Munitor deploy step writes image bumps to it directly as GitHub-signed commits + (GraphQL `createCommitOnBranch`), with no bypass actor; release tags stay protected + (`K22-REPO-21`); merged branches are deleted. +- **Expires:** reviewed yearly, next on 2027-10-12, or earlier if Munitor gains a + squash-compatible release mode. +- **Owner:** the maintainer. + +## EX-0010 + +**CircleCI instead of the GitHub Actions reusable workflows** + +- **Requirements:** `K22-CI-01` (required checks run by the reusable workflows), + `K22-CI-10` to `K22-CI-24` as written for GitHub Actions, and `K22-CI-30` + (releases built by the shared reusable release workflow). +- **Scope:** `KofTwentyTwo/Website-Backend`, `KofTwentyTwo/Website-Frontend` and + `KofTwentyTwo/Munitor` (the CircleCI orb that builds, releases and deploys them). +- **Reason:** these repositories build, publish container images and deploy to the + k8s-galaxy cluster through the Munitor CircleCI orb, which predates the reusable + GitHub Actions workflows and holds the deploy integration (image publishing, + cluster-gitops version bumps). Porting the pipeline is a separate project. +- **Risk:** the gates are implemented per orb rather than by the audited reusable + workflows, so a gate can be missing or weaker than the standard (for example + CodeQL, zizmor, Scorecard and SLSA provenance have no CircleCI equivalent here). +- **Compensating controls:** the CircleCI checks are required by the repository + rulesets (Website: `build-and-test`, `secrets-scan`, `sast-scan`; Munitor: + `orb-tools/lint`, `pack`, `review`, `test`); the orb runs the test suite, gitleaks and Trivy where configured; + GitHub-side controls still apply (secret scanning with push protection, Dependabot + alerts and security updates, code scanning default setup where available); orbs are + pinned to exact versions; signed commits are required. +- **Expires:** 2027-04-12, or when the repositories move to the reusable workflows; + review 2027-01-12. +- **Owner:** the maintainer. + +## EX-0011 + +**Website-Frontend and Munitor keep 2-space formatting** + +- **Requirements:** `K22-CODE-TS-01` (Kingsrook layout through the KofTwentyTwo ESLint + configuration: 3-space indent, Allman braces) and `K22-CODE-SH-02` (3-space shell + indentation). +- **Scope:** `KofTwentyTwo/Website-Frontend` TypeScript, JavaScript, CSS and JSON + sources; `KofTwentyTwo/Munitor` Bash scripts and templates. +- **Reason:** the Next.js code base was written in the framework's default 2-space + layout and is formatted by Prettier 3 (with `prettier-plugin-tailwindcss`) plus + ESLint 9 with `eslint-config-next`, which the TypeScript profile does not use. + Munitor's 100+ orb scripts and templates use 2-space indentation. Reformatting + either is a large whitespace-only diff that triggers releases (a Website deploy or + a new orb version for every consumer) and obscures history. +- **Risk:** inconsistent layout across KofTwentyTwo TypeScript code; no functional + risk. +- **Compensating controls:** `.editorconfig` comes from the standard, with only the + indent size overridden for these file types and a comment citing this exception; + the existing lint, type and orb checks still gate CI. +- **Expires:** 2027-04-12, or when the code base is reformatted and adopts + `configs/typescript/eslint.config.mjs` (Website-Frontend) and the orb scripts are + reformatted with shfmt (Munitor); review 2027-01-12. +- **Owner:** the maintainer. + +## EX-0012 + +**Praetor commits git-crypt-encrypted OpenTofu state and variable files** + +- **Requirements:** `K22-CODE-TF-04` (state is never committed; remote state with + locking and encryption) and `K22-CODE-TF-05` (no secrets in `.tfvars` files). +- **Scope:** `KofTwentyTwo/Praetor` (Internal tier, private): the local-backend roots + under `terraform/` and `unifi/` (17 `*.tfstate*` files) and their 10 `*.tfvars` + files. +- **Reason:** Praetor provisions the homelab that would host any remote state backend + (the cluster, the NAS and Infisical are themselves managed here), so a remote backend + creates a bootstrap dependency on the infrastructure it builds. Committed, encrypted + local state is the recovery path when that infrastructure is down. +- **Risk:** state and variable files contain credentials; anyone holding the git-crypt + key or a decrypted clone can read them. Local state has no locking, so two + concurrent applies could corrupt it. +- **Compensating controls:** `.gitattributes` encrypts every `*.tfstate*`, `*.tfvars*`, + kubeconfig, talosconfig and `*secret*` path with git-crypt (GPG key held by the + maintainer); `git-crypt status` reports no unencrypted secret files; the repository + is private; applies are human-gated by the maintainer in session (`EX-0005`), which + serializes them; secrets are moving into Infisical with `sensitive = true` outputs. +- **Expires:** reviewed yearly, next on 2027-10-12, or when the roots move to an + encrypted remote backend. +- **Owner:** the maintainer.