nordisk/dwarves

pipelines/drift.runa.ron

// drift.runa.ron — the syscall-profile DRIFT GATE (Heimdall tooling plan step 6, owner
// decision 2026-10-31) on every new head of `main`. It runs in the repository's checkout (a
// project's `[[pipelines]]` names `repo`; `file_in = "dwarves"` names this file's home).
//
// The step builds each measured row (`[[build]]` in `.nornir/profiles/<row>/measure.toml`)
// and checks it with the EXTERNAL `heimdall profile check` (Build Thing's `measure gate`,
// reached as `cargo bt`): a call a checked-in profile does not allow is named by row,
// program, call and test, and the run is red. It only checks: a profile changes by
// `measure syscalls <row>` and a reviewed commit, never by the forge. The heimdall binary is
// the one the rows pin by version and sha256, kept by the box (`tools = ["heimdall"]`).
Pipeline(
    name: "drift",
    triggers: [
        Push(branch: "main"),
        Manual,
    ],
    stages: [
        Stage(
            name: "drift",
            steps: [
                Xtask(alias: "bt", cmd: "measure", args: ["gate", "--build"]),
            ],
        ),
    ],
)