check-architecture.yaml
2.21 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
# vibe_erp — architectural guardrail CI.
#
# Defends two rules from CLAUDE.md guardrails #9 and #10:
# - PBCs may NEVER import other PBCs
# - api-v1 and reference-customer code may only see api.v1.* — never
# org.vibeerp.platform.* or org.vibeerp.pbc.*
#
# Primary defense: the root build.gradle.kts afterEvaluate hooks reject
# illegal Gradle dependencies. This workflow simply runs the build so
# violations fail CI.
#
# Secondary defense: a source-tree grep for forbidden imports inside the
# api-v1 and reference-customer trees. This catches anyone reaching past
# the build system (e.g. via reflection-friendly imports).
name: check-architecture
on:
pull_request:
jobs:
build-guard:
name: gradle dependency rule
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Set up JDK 21
uses: actions/setup-java@v4
with:
distribution: temurin
java-version: "21"
- name: Cache Gradle
uses: actions/cache@v4
with:
path: |
~/.gradle/caches
~/.gradle/wrapper
key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties', 'gradle/libs.versions.toml') }}
- name: Build (enforces dependency rule via afterEvaluate hooks)
run: ./gradlew build --no-daemon
import-guard:
name: forbidden-import grep
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Reject internal imports from api-v1 and reference-customer
shell: bash
run: |
set -euo pipefail
violations=0
for path in api/api-v1/src reference-customer; do
if [ -d "$path" ]; then
if grep -RInE 'import[[:space:]]+org\.vibeerp\.(platform|pbc)' "$path"; then
echo "::error::Forbidden internal import found under $path"
violations=$((violations + 1))
fi
fi
done
if [ "$violations" -gt 0 ]; then
echo "Architectural violation: api-v1 and reference-customer may only depend on org.vibeerp.api.v1.*"
exit 1
fi
echo "OK — no forbidden imports."