fix: isolate PaC validation by selected consumer
This commit is contained in:
Codex
@@ -143,8 +143,13 @@ export interface PacConfig {
|
||||
}
|
||||
|
||||
export interface PacConfigValidationWarning {
|
||||
readonly code: "pac-unselected-consumer-invalid";
|
||||
readonly consumer: string;
|
||||
readonly code:
|
||||
| "pac-unselected-consumer-parse-invalid"
|
||||
| "pac-unselected-consumer-invalid"
|
||||
| "pac-unselected-repository-parse-invalid"
|
||||
| "pac-unselected-repository-invalid";
|
||||
readonly object: { readonly kind: "consumer" | "repository"; readonly id: string };
|
||||
readonly consumer: string | null;
|
||||
readonly configPath: string;
|
||||
readonly blocking: false;
|
||||
readonly evidence: string;
|
||||
@@ -439,6 +444,13 @@ function help(scope: string | null): Record<string, unknown> {
|
||||
|
||||
export function readPacConfig(selection: { readonly consumerId?: string | null; readonly selectDefault?: boolean } = {}): PacConfig {
|
||||
const root = materializeYamlComposition(readYamlRecord<Record<string, unknown>>(configFile, "platform-infra-pipelines-as-code"), { label: configLabel }).value;
|
||||
return parsePacConfigDocument(root, selection);
|
||||
}
|
||||
|
||||
export function parsePacConfigDocument(
|
||||
root: Record<string, unknown>,
|
||||
selection: { readonly consumerId?: string | null; readonly selectDefault?: boolean } = {},
|
||||
): PacConfig {
|
||||
const release = y.objectField(root, "release", "");
|
||||
const deliveryProvenance = y.objectField(root, "deliveryProvenance", "");
|
||||
const provenanceController = y.objectField(deliveryProvenance, "controller", "deliveryProvenance");
|
||||
@@ -454,13 +466,19 @@ export function readPacConfig(selection: { readonly consumerId?: string | null;
|
||||
const exporterFailure = y.objectField(observability, "exporterFailure", "observability");
|
||||
const admin = y.objectField(gitea, "admin", "gitea");
|
||||
const webhook = y.objectField(gitea, "webhook", "gitea");
|
||||
const repositories = root.repositories === undefined
|
||||
? [parseRepository(y.objectField(root, "repository", ""), "repository")]
|
||||
: y.arrayOfRecords(root.repositories, "repositories").map((item, index) => parseRepository(item, `repositories[${index}]`));
|
||||
const consumers = root.consumers === undefined
|
||||
? [parseConsumer(y.objectField(root, "consumer", ""), "consumer", repositories[0]?.id ?? "default")]
|
||||
: y.arrayOfRecords(root.consumers, "consumers").map((item, index) => parseConsumer(item, `consumers[${index}]`, repositories[0]?.id ?? "default"));
|
||||
const defaults = y.objectField(root, "defaults", "");
|
||||
const repositoryEntries = pacConfigObjectEntries(root.repositories, root.repository, "repositories", "repository");
|
||||
const consumerEntries = pacConfigObjectEntries(root.consumers, root.consumer, "consumers", "consumer");
|
||||
const defaultRepositoryRef = rawPacObjectId(repositoryEntries[0]?.value, repositoryEntries[0]?.path ?? "repository", "repository");
|
||||
const defaultConsumerId = typeof defaults.consumerId === "string" && defaults.consumerId.length > 0
|
||||
? defaults.consumerId
|
||||
: rawPacObjectId(consumerEntries[0]?.value, consumerEntries[0]?.path ?? "consumer", "consumer");
|
||||
const selectedConsumerIds = selectedPacConsumerIds(defaultConsumerId, selection);
|
||||
assertSelectedRawObjectsUnique(consumerEntries, selectedConsumerIds, "consumer");
|
||||
const selectedRepositoryRefs = selectedPacRepositoryRefs(consumerEntries, selectedConsumerIds, defaultRepositoryRef);
|
||||
assertSelectedRawObjectsUnique(repositoryEntries, selectedRepositoryRefs, "repository");
|
||||
const parsedRepositories = parsePacRepositories(repositoryEntries, selectedRepositoryRefs);
|
||||
const parsedConsumers = parsePacConsumers(consumerEntries, selectedConsumerIds, defaultRepositoryRef);
|
||||
const parsed: PacConfig = {
|
||||
version: y.integerField(root, "version", ""),
|
||||
kind: "platform-infra-pipelines-as-code",
|
||||
@@ -472,7 +490,7 @@ export function readPacConfig(selection: { readonly consumerId?: string | null;
|
||||
},
|
||||
defaults: {
|
||||
targetId: y.stringField(defaults, "targetId", "defaults"),
|
||||
consumerId: typeof defaults.consumerId === "string" && defaults.consumerId.length > 0 ? defaults.consumerId : consumers[0]?.id ?? "default",
|
||||
consumerId: defaultConsumerId,
|
||||
},
|
||||
display: {
|
||||
timeZone: y.stringField(display, "timeZone", "display"),
|
||||
@@ -538,23 +556,138 @@ export function readPacConfig(selection: { readonly consumerId?: string | null;
|
||||
branch: y.stringField(webhook, "branch", "gitea.webhook"),
|
||||
},
|
||||
},
|
||||
repositories,
|
||||
consumers,
|
||||
validationWarnings: [],
|
||||
repositories: parsedRepositories.values,
|
||||
consumers: parsedConsumers.values,
|
||||
validationWarnings: [...parsedRepositories.warnings, ...parsedConsumers.warnings],
|
||||
};
|
||||
const selectedConsumerIds = selectedPacConsumerIds(parsed, selection);
|
||||
parsed.validationWarnings = validateConfig(parsed, selectedConsumerIds);
|
||||
parsed.validationWarnings = validateConfig(parsed, selectedConsumerIds, parsed.validationWarnings);
|
||||
return parsed;
|
||||
}
|
||||
|
||||
function selectedPacConsumerIds(
|
||||
config: PacConfig,
|
||||
defaultConsumerId: string,
|
||||
selection: { readonly consumerId?: string | null; readonly selectDefault?: boolean },
|
||||
): ReadonlySet<string> {
|
||||
if (typeof selection.consumerId === "string" && selection.consumerId.length > 0) {
|
||||
return new Set([selection.consumerId.toLowerCase()]);
|
||||
}
|
||||
return selection.selectDefault === true ? new Set([config.defaults.consumerId.toLowerCase()]) : new Set();
|
||||
return selection.selectDefault === true ? new Set([defaultConsumerId.toLowerCase()]) : new Set();
|
||||
}
|
||||
|
||||
interface PacConfigObjectEntry {
|
||||
readonly value: unknown;
|
||||
readonly path: string;
|
||||
}
|
||||
|
||||
function pacConfigObjectEntries(plural: unknown, singular: unknown, pluralLabel: string, singularLabel: string): PacConfigObjectEntry[] {
|
||||
if (plural === undefined) {
|
||||
if (singular === undefined) throw new Error(`${configLabel}.${singularLabel} must be an object`);
|
||||
return [{ value: singular, path: singularLabel }];
|
||||
}
|
||||
if (!Array.isArray(plural)) throw new Error(`${configLabel}.${pluralLabel} must be an array`);
|
||||
return plural.map((value, index) => ({ value, path: `${pluralLabel}[${index}]` }));
|
||||
}
|
||||
|
||||
function rawPacObjectId(value: unknown, path: string, kind: "consumer" | "repository"): string {
|
||||
if (!isRecord(value)) return path;
|
||||
if (typeof value.id === "string" && value.id.length > 0) return value.id;
|
||||
if (kind === "repository" && typeof value.name === "string" && value.name.length > 0) return value.name;
|
||||
if (kind === "consumer" && typeof value.node === "string" && value.node.length > 0 && typeof value.lane === "string" && value.lane.length > 0) {
|
||||
return `${value.node}-${value.lane}`;
|
||||
}
|
||||
return path;
|
||||
}
|
||||
|
||||
function rawPacObjectRefs(entry: PacConfigObjectEntry, kind: "consumer" | "repository"): string[] {
|
||||
if (!isRecord(entry.value)) return [entry.path.toLowerCase()];
|
||||
const refs = [rawPacObjectId(entry.value, entry.path, kind)];
|
||||
if (kind === "repository" && typeof entry.value.name === "string" && entry.value.name.length > 0) refs.push(entry.value.name);
|
||||
return [...new Set(refs.map((value) => value.toLowerCase()))];
|
||||
}
|
||||
|
||||
function assertSelectedRawObjectsUnique(
|
||||
entries: readonly PacConfigObjectEntry[],
|
||||
selectedRefs: ReadonlySet<string>,
|
||||
kind: "consumer" | "repository",
|
||||
): void {
|
||||
for (const selectedRef of selectedRefs) {
|
||||
const matches = entries.filter((entry) => rawPacObjectRefs(entry, kind).includes(selectedRef));
|
||||
if (matches.length !== 1) {
|
||||
throw new Error(`selected Pipelines-as-Code ${kind} ${selectedRef} must match exactly one YAML object; matched ${matches.length}`);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function selectedPacRepositoryRefs(
|
||||
consumerEntries: readonly PacConfigObjectEntry[],
|
||||
selectedConsumerIds: ReadonlySet<string>,
|
||||
defaultRepositoryRef: string,
|
||||
): ReadonlySet<string> {
|
||||
const refs = new Set<string>();
|
||||
for (const entry of consumerEntries) {
|
||||
if (!rawPacObjectRefs(entry, "consumer").some((value) => selectedConsumerIds.has(value))) continue;
|
||||
const repositoryRef = isRecord(entry.value) && typeof entry.value.repositoryRef === "string" && entry.value.repositoryRef.length > 0
|
||||
? entry.value.repositoryRef
|
||||
: defaultRepositoryRef;
|
||||
refs.add(repositoryRef.toLowerCase());
|
||||
}
|
||||
return refs;
|
||||
}
|
||||
|
||||
function parsePacRepositories(
|
||||
entries: readonly PacConfigObjectEntry[],
|
||||
selectedRepositoryRefs: ReadonlySet<string>,
|
||||
): { readonly values: PacRepository[]; readonly warnings: PacConfigValidationWarning[] } {
|
||||
const values: PacRepository[] = [];
|
||||
const warnings: PacConfigValidationWarning[] = [];
|
||||
for (const entry of entries) {
|
||||
const id = rawPacObjectId(entry.value, entry.path, "repository");
|
||||
try {
|
||||
if (!isRecord(entry.value)) throw new Error(`${configLabel}.${entry.path} must be an object`);
|
||||
values.push(parseRepository(entry.value, entry.path));
|
||||
} catch (error) {
|
||||
if (rawPacObjectRefs(entry, "repository").some((value) => selectedRepositoryRefs.has(value))) throw error;
|
||||
warnings.push(pacConfigWarning("pac-unselected-repository-parse-invalid", "repository", id, entry.path, error));
|
||||
}
|
||||
}
|
||||
return { values, warnings };
|
||||
}
|
||||
|
||||
function parsePacConsumers(
|
||||
entries: readonly PacConfigObjectEntry[],
|
||||
selectedConsumerIds: ReadonlySet<string>,
|
||||
defaultRepositoryRef: string,
|
||||
): { readonly values: PacConsumer[]; readonly warnings: PacConfigValidationWarning[] } {
|
||||
const values: PacConsumer[] = [];
|
||||
const warnings: PacConfigValidationWarning[] = [];
|
||||
for (const entry of entries) {
|
||||
const id = rawPacObjectId(entry.value, entry.path, "consumer");
|
||||
try {
|
||||
if (!isRecord(entry.value)) throw new Error(`${configLabel}.${entry.path} must be an object`);
|
||||
values.push(parseConsumer(entry.value, entry.path, defaultRepositoryRef));
|
||||
} catch (error) {
|
||||
if (selectedConsumerIds.has(id.toLowerCase())) throw error;
|
||||
warnings.push(pacConfigWarning("pac-unselected-consumer-parse-invalid", "consumer", id, entry.path, error));
|
||||
}
|
||||
}
|
||||
return { values, warnings };
|
||||
}
|
||||
|
||||
function pacConfigWarning(
|
||||
code: PacConfigValidationWarning["code"],
|
||||
kind: PacConfigValidationWarning["object"]["kind"],
|
||||
id: string,
|
||||
path: string,
|
||||
error: unknown,
|
||||
): PacConfigValidationWarning {
|
||||
return {
|
||||
code,
|
||||
object: { kind, id },
|
||||
consumer: kind === "consumer" ? id : null,
|
||||
configPath: `${configLabel}#${path}`,
|
||||
blocking: false,
|
||||
evidence: pacValueEvidence(error instanceof Error ? error.message : String(error)),
|
||||
};
|
||||
}
|
||||
|
||||
function parseRepository(repository: Record<string, unknown>, path: string): PacRepository {
|
||||
@@ -846,45 +979,51 @@ function parseTarget(record: Record<string, unknown>, index: number): PacTarget
|
||||
}
|
||||
|
||||
export function validatePacConfig(config: PacConfig, selectedConsumerIds: ReadonlySet<string>): PacConfigValidationWarning[] {
|
||||
return validateConfig(config, selectedConsumerIds);
|
||||
return validateConfig(config, selectedConsumerIds, []);
|
||||
}
|
||||
|
||||
function validateConfig(config: PacConfig, selectedConsumerIds: ReadonlySet<string>): PacConfigValidationWarning[] {
|
||||
function validateConfig(
|
||||
config: PacConfig,
|
||||
selectedConsumerIds: ReadonlySet<string>,
|
||||
initialWarnings: readonly PacConfigValidationWarning[],
|
||||
): PacConfigValidationWarning[] {
|
||||
if (config.version !== 1) throw new Error(`${configLabel}.version must be 1`);
|
||||
resolveTarget(config, config.defaults.targetId);
|
||||
if (config.release.waitTimeoutSeconds > 55) throw new Error(`${configLabel}.release.waitTimeoutSeconds must fit the 60s trans budget`);
|
||||
if (config.closeout.gitOpsMirrorFlush.waitTimeoutSeconds > 55) throw new Error(`${configLabel}.closeout.gitOpsMirrorFlush.waitTimeoutSeconds must fit the 60s trans budget`);
|
||||
resolveConsumer(config, config.defaults.consumerId);
|
||||
if (selectedConsumerIds.has(config.defaults.consumerId.toLowerCase())) resolveConsumer(config, config.defaults.consumerId);
|
||||
const warnings: PacConfigValidationWarning[] = [...initialWarnings];
|
||||
const selectedRepositoryRefs = new Set(config.consumers
|
||||
.filter((consumer) => selectedConsumerIds.has(consumer.id.toLowerCase()))
|
||||
.map((consumer) => consumer.repositoryRef.toLowerCase()));
|
||||
const ids = new Set<string>();
|
||||
for (const repository of config.repositories) {
|
||||
if (ids.has(repository.id)) throw new Error(`${configLabel}.repositories id must be unique: ${repository.id}`);
|
||||
ids.add(repository.id);
|
||||
if (repository.providerType !== "gitea") throw new Error(`${configLabel}.repositories.${repository.id}.providerType must be gitea`);
|
||||
if (isInternalRepositoryMatchUrl(repository.url)) throw new Error(`${configLabel}.repositories.${repository.id}.url must be the public Gitea URL used in webhook payloads; keep internal service URLs in cloneUrl/params.git_read_url`);
|
||||
if (new URL(repository.cloneUrl).origin !== new URL(config.gitea.internalBaseUrl).origin) throw new Error(`${configLabel}.repositories.${repository.id}.cloneUrl must use the configured internal Gitea base URL`);
|
||||
try {
|
||||
if (ids.has(repository.id)) throw new Error(`${configLabel}.repositories id must be unique: ${repository.id}`);
|
||||
if (repository.providerType !== "gitea") throw new Error(`${configLabel}.repositories.${repository.id}.providerType must be gitea`);
|
||||
if (isInternalRepositoryMatchUrl(repository.url)) throw new Error(`${configLabel}.repositories.${repository.id}.url must be the public Gitea URL used in webhook payloads; keep internal service URLs in cloneUrl/params.git_read_url`);
|
||||
if (new URL(repository.cloneUrl).origin !== new URL(config.gitea.internalBaseUrl).origin) throw new Error(`${configLabel}.repositories.${repository.id}.cloneUrl must use the configured internal Gitea base URL`);
|
||||
ids.add(repository.id);
|
||||
} catch (error) {
|
||||
if (selectedRepositoryRefs.has(repository.id.toLowerCase()) || selectedRepositoryRefs.has(repository.name.toLowerCase())) throw error;
|
||||
warnings.push(pacConfigWarning("pac-unselected-repository-invalid", "repository", repository.id, `repositories.${repository.id}`, error));
|
||||
}
|
||||
}
|
||||
const consumerIds = new Set<string>();
|
||||
const markerValues = new Set<string>();
|
||||
const reservedServiceAccounts = new Set<string>();
|
||||
const warnings: PacConfigValidationWarning[] = [];
|
||||
for (const consumer of config.consumers) {
|
||||
if (consumerIds.has(consumer.id)) throw new Error(`${configLabel}.consumers id must be unique: ${consumer.id}`);
|
||||
consumerIds.add(consumer.id);
|
||||
try {
|
||||
if (consumerIds.has(consumer.id)) throw new Error(`${configLabel}.consumers id must be unique: ${consumer.id}`);
|
||||
validateConsumerConfig(config, consumer, markerValues, reservedServiceAccounts);
|
||||
consumerIds.add(consumer.id);
|
||||
if (consumer.deliveryProvenance !== null) {
|
||||
markerValues.add(consumer.deliveryProvenance.markerValue);
|
||||
reservedServiceAccounts.add(`${consumer.node.toLowerCase()}\u0000${consumer.deliveryProvenance.executionServiceAccountName}`);
|
||||
}
|
||||
} catch (error) {
|
||||
if (selectedConsumerIds.has(consumer.id.toLowerCase())) throw error;
|
||||
warnings.push({
|
||||
code: "pac-unselected-consumer-invalid",
|
||||
consumer: consumer.id,
|
||||
configPath: `${configLabel}#consumers.${consumer.id}`,
|
||||
blocking: false,
|
||||
evidence: pacValueEvidence(error instanceof Error ? error.message : String(error)),
|
||||
});
|
||||
warnings.push(pacConfigWarning("pac-unselected-consumer-invalid", "consumer", consumer.id, `consumers.${consumer.id}`, error));
|
||||
}
|
||||
}
|
||||
if (!config.gitea.webhook.events.includes("push")) throw new Error(`${configLabel}.gitea.webhook.events must include push`);
|
||||
@@ -977,24 +1116,38 @@ function resolveTarget(config: PacConfig, targetId: string | null): PacTarget {
|
||||
|
||||
function resolveConsumer(config: PacConfig, consumerId: string | null): PacConsumer {
|
||||
const id = consumerId ?? config.defaults.consumerId;
|
||||
const consumer = config.consumers.find((item) => item.id.toLowerCase() === id.toLowerCase());
|
||||
if (consumer === undefined) throw new Error(`unknown Pipelines-as-Code consumer ${id}; known consumers: ${config.consumers.map((item) => item.id).join(", ")}`);
|
||||
return consumer;
|
||||
const matches = config.consumers.filter((item) => item.id.toLowerCase() === id.toLowerCase());
|
||||
if (matches.length !== 1) throw new Error(`Pipelines-as-Code consumer ${id} must resolve exactly once; matched ${matches.length}; known consumers: ${config.consumers.map((item) => item.id).join(", ")}`);
|
||||
return matches[0] as PacConsumer;
|
||||
}
|
||||
|
||||
function resolveRepository(config: PacConfig, repositoryRef: string): PacRepository {
|
||||
const repository = config.repositories.find((item) => item.id === repositoryRef || item.name === repositoryRef);
|
||||
if (repository === undefined) throw new Error(`unknown Pipelines-as-Code repository ${repositoryRef}; known repositories: ${config.repositories.map((item) => item.id).join(", ")}`);
|
||||
return repository;
|
||||
const matches = config.repositories.filter((item) => item.id === repositoryRef || item.name === repositoryRef);
|
||||
if (matches.length !== 1) throw new Error(`Pipelines-as-Code repository ${repositoryRef} must resolve exactly once; matched ${matches.length}; known repositories: ${config.repositories.map((item) => item.id).join(", ")}`);
|
||||
return matches[0] as PacRepository;
|
||||
}
|
||||
|
||||
function consumerParams(repository: PacRepository, consumer: PacConsumer): Record<string, string> {
|
||||
return { ...repository.params, ...consumer.params };
|
||||
}
|
||||
|
||||
function validPacConsumers(config: PacConfig): PacConsumer[] {
|
||||
const invalid = new Set(config.validationWarnings.map((warning) => warning.consumer.toLowerCase()));
|
||||
return config.consumers.filter((consumer) => !invalid.has(consumer.id.toLowerCase()));
|
||||
export function validPacConsumers(config: PacConfig): PacConsumer[] {
|
||||
const invalidConsumers = new Set(config.validationWarnings
|
||||
.filter((warning) => warning.object.kind === "consumer")
|
||||
.map((warning) => warning.object.id.toLowerCase()));
|
||||
const invalidRepositories = new Set(config.validationWarnings
|
||||
.filter((warning) => warning.object.kind === "repository")
|
||||
.map((warning) => warning.object.id.toLowerCase()));
|
||||
for (const repository of config.repositories) {
|
||||
if (invalidRepositories.has(repository.id.toLowerCase()) || invalidRepositories.has(repository.name.toLowerCase())) {
|
||||
invalidRepositories.add(repository.id.toLowerCase());
|
||||
invalidRepositories.add(repository.name.toLowerCase());
|
||||
}
|
||||
}
|
||||
return config.consumers.filter((consumer) => (
|
||||
!invalidConsumers.has(consumer.id.toLowerCase())
|
||||
&& !invalidRepositories.has(consumer.repositoryRef.toLowerCase())
|
||||
));
|
||||
}
|
||||
|
||||
function plan(options: CommonOptions): Record<string, unknown> {
|
||||
@@ -2432,8 +2585,8 @@ function renderPacConfigWarnings(warnings: readonly Record<string, unknown>[]):
|
||||
return [
|
||||
"",
|
||||
"NON-BLOCKING WARNINGS",
|
||||
...table(["CONSUMER", "BLOCKING", "CODE", "CONFIG"], warnings.map((item) => [
|
||||
stringValue(item.consumer),
|
||||
...table(["OBJECT", "BLOCKING", "CODE", "CONFIG"], warnings.map((item) => [
|
||||
`${stringValue(record(item.object).kind)}:${stringValue(record(item.object).id)}`,
|
||||
boolText(item.blocking),
|
||||
stringValue(item.code),
|
||||
stringValue(item.configPath),
|
||||
@@ -2955,6 +3108,10 @@ function record(value: unknown): Record<string, unknown> {
|
||||
return typeof value === "object" && value !== null && !Array.isArray(value) ? value as Record<string, unknown> : {};
|
||||
}
|
||||
|
||||
function isRecord(value: unknown): value is Record<string, unknown> {
|
||||
return typeof value === "object" && value !== null && !Array.isArray(value);
|
||||
}
|
||||
|
||||
function arrayRecords(value: unknown): Record<string, unknown>[] {
|
||||
return Array.isArray(value) ? value.filter((item) => typeof item === "object" && item !== null && !Array.isArray(item)) as Record<string, unknown>[] : [];
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user