• A docker-containerized micro-service for https://cyber-dojo.org.
• An HTTP Sinatra web service, for the core edit+review pages.
• Demonstrates a Kosli instrumented GitHub CI workflow deploying, with Continuous Compliance, to its staging AWS environment.
• Deployment to its production AWS environment is via a separate promotion workflow.
• Uses attestation patterns from https://www.kosli.com/blog/using-kosli-attest-in-github-action-workflows-some-tips/

# Run a demo
$ make demo

# Build the image
$ make image

# Run the server tests
$ make test_server

# Run only specific tests, naming test-id prefix(es)
$ make test_server tids=3d99

# Run the client (Capybara + Selenium) tests, which make test_server does not
$ make test_client

# Build, run the server tests, and judge the run
$ make all

Running the tests and judging them are separate steps. make test_server runs every server test directory in one ruby process, its test classes in parallel, and writes reports/test_metrics.json and reports/coverage_metrics.json. Two targets then check those against pinned limits, and fail if any is breached:

$ make metrics_coverage

                code.branches.total |    33   >=     1 |  true
                   code.lines.total |   496   >=     1 |  true
                test.branches.total |    26   >=     1 |  true
                   test.lines.total |  1340   >=     1 |  true

               code.branches.missed |     3   <=     3 |  true
                code.branches.total |    33   <=    33 |  true
                  code.lines.missed |     0   <=     0 |  true
                   code.lines.total |   496   <=   496 |  true
               test.branches.missed |     8   <=     8 |  true
                test.branches.total |    26   <=    26 |  true
                  test.lines.missed |     9   <=     9 |  true
                   test.lines.total |  1340   <=  1340 |  true

make metrics_test does the same for the test counts and the run's duration.

The bounds live in test/coverage_metrics_params.json and test/test_metrics_params.json. Each is written once and applied twice: these targets check them locally, and CI evaluates the same files with a rego policy before attesting the verdict to Kosli.

A max bound is a ratchet - the number may fall, never rise - so growing the code, or letting a missed count grow, is a deliberate act that has to be acknowledged by editing the file. The min bounds exist because upper bounds alone cannot catch an empty report: a report of all zeros satisfies every one of them.