Validate Forgejo migration candidates

Author: RamazanKara

CHANGELOG.md

@@ -27,6 +27,7 @@
 - Added best-effort live Datadog integration installation metadata collection.
 - Added a reproducible Datadog example refresh target and checked-in full example output.
 - Added fixture integration evidence refs and validation coverage for integration evidence.
+- Added Forgejo migration candidate validation for the GitHub Enterprise assessment path.
 - Updated CI and release workflows to Node.js 24-native GitHub Actions.
 
 ## 0.1.0 - 2026-05-24

README.md

@@ -116,7 +116,7 @@ Included in the current implementation:
 - OpenTelemetry Collector sketch.
 - ArgoCD starter manifest.
 - Typed migration plan manifest and phase-gate Markdown plan.
-- Validation report with embedded JSON Schema checks, Grafana dashboard, Prometheus alert, OpenTelemetry collector, and ArgoCD candidate checks, YAML/JSON parsing, evidence ref checks, secret scan, and optional `promtool`/`kubeconform` checks.
+- Validation report with embedded JSON Schema checks, Grafana dashboard, Prometheus alert, OpenTelemetry collector, ArgoCD, and Forgejo migration candidate checks, YAML/JSON parsing, evidence ref checks, secret scan, and optional `promtool`/`kubeconform` checks.
 - Evidence bundle export.
 - Evidence bundle path-safety checks that reject symlinks in exported project sections.
 - No-op assist provider and explicit opt-in LiteLLM assist.
@@ -158,7 +158,7 @@ The release checklist lives in `docs/release.md`. A release build should pass `m
 
 ## Assessment Paths
 
-GitHub Enterprise to Forgejo collects repository, team, branch protection, Actions workflow, secret metadata, runner, deploy key, and GitHub App installation metadata from live GitHub/GitHub Enterprise APIs or local fixtures. It generates Forgejo migration assessment, CI compatibility, branch protection mapping, runner migration, repository ownership reports, and a Forgejo migration candidate YAML.
+GitHub Enterprise to Forgejo collects repository, team, branch protection, Actions workflow, secret metadata, runner, deploy key, and GitHub App installation metadata from live GitHub/GitHub Enterprise APIs or local fixtures. It generates Forgejo migration assessment, CI compatibility, branch protection mapping, runner migration, repository ownership reports, and a validated Forgejo migration candidate YAML.
 
 Okta/Auth0 to Keycloak/Zitadel collects applications, SAML/OIDC client metadata, groups, policies, MFA settings, redirect URIs, owners, and break-glass account metadata from live Okta/Auth0 APIs or local fixtures. It generates identity migration risk, realm/client candidate config, break-glass, cutover, and rollback artifacts.
 

docs/cli.md

@@ -27,7 +27,7 @@ The CI test suite also runs this definition-of-done pipeline against the fixture
 
 The checked-in Datadog example can be refreshed with `make example VERSION=0.1.0-dev`. CI also runs `make example-smoke` as part of `make verify` to ensure the example fixture still completes the full pipeline.
 
-`openexit validate` performs typed consistency checks, embedded JSON Schema validation, Grafana dashboard candidate validation, Prometheus alert-rule candidate validation, OpenTelemetry collector candidate validation, ArgoCD candidate validation, YAML/JSON parse checks, evidence reference checks, secret scanning, and optional external tool checks when `promtool` or `kubeconform` are installed.
+`openexit validate` performs typed consistency checks, embedded JSON Schema validation, Grafana dashboard candidate validation, Prometheus alert-rule candidate validation, OpenTelemetry collector candidate validation, ArgoCD candidate validation, Forgejo migration candidate validation, YAML/JSON parse checks, evidence reference checks, secret scanning, and optional external tool checks when `promtool` or `kubeconform` are installed.
 
 `openexit export` refuses to package symlinks from exported project sections, even with `--force`, so evidence bundles cannot accidentally include files from outside the project tree.
 

docs/github-enterprise-to-forgejo.md

@@ -43,4 +43,6 @@ Generated target candidate:
 
 - `generated-config/forgejo/migration-candidate.yaml`
 
+Validation checks the Forgejo migration candidate for source/target metadata, non-production safety flags, absence of credentials, repository/team/branch-protection/workflow/secret/runner/deploy-key/app coverage, preserved evidence refs, expected runner/deploy-key target actions, and non-low manual-review findings.
+
 The assessment flags branch protection gaps, GitHub-hosted runner dependency, GitHub-specific Actions usage, unknown secret consumers, offline runners, write-capable deploy keys, GitHub Pages/Packages/Discussions usage, and GitHub App webhook review.

docs/release.md

@@ -16,7 +16,7 @@ Release-blocking v0.1 requirements:
 - Markdown handover artifacts.
 - Grafana, Prometheus, OpenTelemetry, and ArgoCD candidate generators.
 - Typed migration plan manifest with assessment, pilot, shadow, and cutover phase gates.
-- Validation engine with embedded JSON Schema checks, Grafana dashboard, Prometheus alert, OpenTelemetry collector, and ArgoCD candidate checks, YAML/JSON parsing, evidence refs, secret scan, optional promtool, and optional kubeconform.
+- Validation engine with embedded JSON Schema checks, Grafana dashboard, Prometheus alert, OpenTelemetry collector, ArgoCD, and Forgejo migration candidate checks, YAML/JSON parsing, evidence refs, secret scan, optional promtool, and optional kubeconform.
 - Evidence bundle export with checksums and OpenExit version metadata.
 - No-op AI assist and optional external assist behind explicit opt-in.
 - Documentation, examples, CI, release draft workflow, and reproducible release artifacts.
@@ -51,6 +51,7 @@ The AI provider path is complete for local fixture assessment workflows and incl
 - [ ] `validation/validation-report.md` includes `prometheus-rule-candidates: passed` for the Datadog definition-of-done pipeline.
 - [ ] `validation/validation-report.md` includes `opentelemetry-candidate: passed` for the Datadog definition-of-done pipeline.
 - [ ] `validation/validation-report.md` includes `argocd-candidate: passed` for the Datadog definition-of-done pipeline.
+- [ ] `validation/validation-report.md` includes `forgejo-migration-candidate: passed` for the GitHub Enterprise to Forgejo pipeline.
 - [ ] `CHANGELOG.md` has a `0.1.0` section.
 - [ ] Exported bundle README includes version, commit, build date, bundle timestamp, and candidate warning.
 - [ ] Export refuses symlinks in exported project sections, including when `--force` is used.

internal/app/e2e_test.go

@@ -413,20 +413,7 @@ func TestAssessRejectsMismatchedProjectTarget(t *testing.T) {
 
 func TestGitHubEnterpriseForgejoFixturePipeline(t *testing.T) {
 	projectDir := filepath.Join(t.TempDir(), "ghe-demo")
-	fixturePath := filepath.Join("..", "..", "testdata", "github-enterprise", "small.json")
-
-	commands := [][]string{
-		{"init", projectDir, "--source", "github-enterprise", "--target", "forgejo"},
-		{"collect", "github-fixture", "--project", projectDir, "--input", fixturePath},
-		{"assess", "--project", projectDir, "--target", "forgejo"},
-		{"generate", "--project", projectDir, "--all"},
-		{"validate", "--project", projectDir},
-	}
-	for _, args := range commands {
-		if err := executeForTest(args...); err != nil {
-			t.Fatalf("openexit %s failed: %v", strings.Join(args, " "), err)
-		}
-	}
+	runGitHubEnterpriseFixturePipeline(t, projectDir)
 	for _, rel := range []string{
 		"inventory/openexit.inventory.yaml",
 		"mapping/openexit.mapping.yaml",
@@ -464,6 +451,67 @@ func TestGitHubEnterpriseForgejoFixturePipeline(t *testing.T) {
 			t.Fatalf("expected assessment finding %s", id)
 		}
 	}
+	report, err := os.ReadFile(filepath.Join(projectDir, "validation", "validation-report.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(report), "forgejo-migration-candidate: passed") {
+		t.Fatalf("expected Forgejo candidate validation marker, got:\n%s", string(report))
+	}
+}
+
+func TestValidationRejectsProductionReadyForgejoCandidate(t *testing.T) {
+	projectDir := filepath.Join(t.TempDir(), "ghe-demo")
+	runGitHubEnterpriseFixturePipeline(t, projectDir)
+	candidatePath := filepath.Join(projectDir, "generated-config", "forgejo", "migration-candidate.yaml")
+	data, err := os.ReadFile(candidatePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	corrupt := strings.Replace(string(data), "productionReady: false", "productionReady: true", 1)
+	if corrupt == string(data) {
+		t.Fatal("test fixture did not contain productionReady marker")
+	}
+	if err := os.WriteFile(candidatePath, []byte(corrupt), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := executeForTest("validate", "--project", projectDir); err == nil {
+		t.Fatal("expected validation to fail when Forgejo candidate is marked production ready")
+	}
+	report, err := os.ReadFile(filepath.Join(projectDir, "validation", "validation-report.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(report), "forgejo-migration-candidate") || !strings.Contains(string(report), "productionReady") {
+		t.Fatalf("expected Forgejo candidate productionReady failure in validation report, got:\n%s", string(report))
+	}
+}
+
+func TestValidationRejectsBrokenForgejoRepositoryCandidate(t *testing.T) {
+	projectDir := filepath.Join(t.TempDir(), "ghe-demo")
+	runGitHubEnterpriseFixturePipeline(t, projectDir)
+	candidatePath := filepath.Join(projectDir, "generated-config", "forgejo", "migration-candidate.yaml")
+	data, err := os.ReadFile(candidatePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	corrupt := strings.Replace(string(data), "targetRepository: platform/api", "targetRepository: platform/api-drifted", 1)
+	if corrupt == string(data) {
+		t.Fatal("test fixture did not contain targetRepository metadata")
+	}
+	if err := os.WriteFile(candidatePath, []byte(corrupt), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if err := executeForTest("validate", "--project", projectDir); err == nil {
+		t.Fatal("expected validation to fail when Forgejo repository candidate drifts from inventory")
+	}
+	report, err := os.ReadFile(filepath.Join(projectDir, "validation", "validation-report.md"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(report), "forgejo-migration-candidate") || !strings.Contains(string(report), "targetRepository") {
+		t.Fatalf("expected Forgejo candidate targetRepository failure in validation report, got:\n%s", string(report))
+	}
 }
 
 func TestIdentityFixturePipeline(t *testing.T) {
@@ -643,6 +691,23 @@ func TestExportRefusesInvalidProjectWithoutForce(t *testing.T) {
 	}
 }
 
+func runGitHubEnterpriseFixturePipeline(t *testing.T, projectDir string) {
+	t.Helper()
+	fixturePath := filepath.Join("..", "..", "testdata", "github-enterprise", "small.json")
+	commands := [][]string{
+		{"init", projectDir, "--source", "github-enterprise", "--target", "forgejo"},
+		{"collect", "github-fixture", "--project", projectDir, "--input", fixturePath},
+		{"assess", "--project", projectDir, "--target", "forgejo"},
+		{"generate", "--project", projectDir, "--all"},
+		{"validate", "--project", projectDir},
+	}
+	for _, args := range commands {
+		if err := executeForTest(args...); err != nil {
+			t.Fatalf("openexit %s failed: %v", strings.Join(args, " "), err)
+		}
+	}
+}
+
 func executeForTest(args ...string) error {
 	cmd := NewRootCommand()
 	cmd.SetArgs(args)