Merge pull request #1965 from pikasTech/fix/hwlab-runtime-gitops-configmap-ownership

fix(pac): 收敛 HWLAB runtime GitOps ConfigMap ownership

scripts/src/hwlab-node/render.ts

@@ -47,6 +47,7 @@ import type { CicdDeliveryAuthority } from "../cicd-delivery-authority";
 
 const runtimeGitopsObservabilityNativeScript = readFileSync(rootPath("scripts/native/hwlab/runtime-gitops-observability.mjs"), "utf8").trimEnd();
 const runtimeGitopsPipelineGuardNativeScript = readFileSync(rootPath("scripts/native/hwlab/runtime-gitops-pipeline-guard.mjs"), "utf8").trimEnd();
+const runtimeGitopsScriptsConfigMapNativeScript = readFileSync(rootPath("scripts/native/hwlab/runtime-gitops-scripts-configmap.mjs"), "utf8").trimEnd();
 const runtimeGitopsPostprocessNativeScript = readFileSync(rootPath("scripts/native/hwlab/runtime-gitops-postprocess.mjs"), "utf8").trimEnd();
 const runtimeGitopsVerifyNativeScript = readFileSync(rootPath("scripts/native/hwlab/runtime-gitops-verify.mjs"), "utf8").trimEnd();
 const runtimePipelineProvenanceNativeScript = readFileSync(rootPath("scripts/native/hwlab/runtime-pipeline-provenance.mjs"), "utf8").trimEnd();
@@ -2927,6 +2928,7 @@ function runtimeGitopsPipelineGuardScript(): string[] {
     "runtime_gitops_guard_dir=\"$render_dir/.unidesk-runtime-gitops\"",
     "mkdir -p \"$runtime_gitops_guard_dir\"",
     ...writeRuntimeGitopsNativeScript("runtime-gitops-pipeline-guard.mjs", runtimeGitopsPipelineGuardNativeScript, "UNIDESK_RUNTIME_GITOPS_PIPELINE_GUARD_MJS"),
+    ...writeRuntimeGitopsNativeScript("runtime-gitops-scripts-configmap.mjs", runtimeGitopsScriptsConfigMapNativeScript, "UNIDESK_RUNTIME_GITOPS_SCRIPTS_CONFIGMAP_MJS"),
     ...writeRuntimeGitopsNativeScript("runtime-gitops-observability.mjs", runtimeGitopsObservabilityNativeScript, "UNIDESK_RUNTIME_GITOPS_OBSERVABILITY_MJS"),
     ...writeRuntimeGitopsNativeScript("runtime-gitops-postprocess.mjs", runtimeGitopsPostprocessNativeScript, "UNIDESK_RUNTIME_GITOPS_POSTPROCESS_MJS"),
     ...writeRuntimeGitopsNativeScript("runtime-gitops-verify.mjs", runtimeGitopsVerifyNativeScript, "UNIDESK_RUNTIME_GITOPS_VERIFY_MJS"),

scripts/src/platform-infra-pipelines-as-code-source-artifact.test.ts

@@ -35,6 +35,7 @@ import {
   observePacSourceArtifactRuntime,
   selectPipelineRunBySourceCommit,
 } from "../native/cicd/pac-source-artifact-runtime.mjs";
+import { renderGitOpsResources } from "../native/cicd/publish-unidesk-host-gitops.mjs";
 
 const sourceCommit = "a".repeat(40);
 const provenance = {
@@ -306,6 +307,7 @@ describe("HWLAB YAML-owned Pipeline provenance", () => {
       expect(scripts.join("\n")).not.toContain("UNIDESK_RUNTIME_GITOPS_OVERLAY_B64=");
       expect(scripts.join("\n")).not.toContain(Buffer.from(JSON.stringify(overlay.observability), "utf8").toString("base64"));
       const configMap = Bun.YAML.parse(readFileSync(configMapPath, "utf8")) as Record<string, any>;
+      expect(configMap.metadata.labels["app.kubernetes.io/managed-by"]).toBe("unidesk-host-gitops");
       expect(JSON.parse(configMap.data["runtime-gitops-overlay.json"])).toEqual({ runtimePath: overlay.runtimePath, observability: overlay.observability });
       expect(Object.keys(configMap.data).sort()).toEqual([
         "runtime-gitops-observability.mjs",
@@ -313,6 +315,34 @@ describe("HWLAB YAML-owned Pipeline provenance", () => {
         "runtime-gitops-postprocess.mjs",
         "runtime-gitops-verify.mjs",
       ]);
+      const hostConfig = Bun.YAML.parse(readFileSync(rootPath("config", "unidesk-host-k8s.yaml"), "utf8")) as Record<string, any>;
+      const runtimePaths = new Set(hostConfig.delivery.changeDetection.runtimePaths as string[]);
+      for (const inputPath of [
+        "config/hwlab-node-lanes.yaml",
+        "scripts/native/hwlab/runtime-gitops-observability.mjs",
+        "scripts/native/hwlab/runtime-gitops-postprocess.mjs",
+        "scripts/native/hwlab/runtime-gitops-scripts-configmap.mjs",
+        "scripts/native/hwlab/runtime-gitops-verify.mjs",
+        "scripts/src/config.ts",
+        "scripts/src/hwlab-node-lanes.ts",
+        "scripts/src/yaml-composition.ts",
+      ]) expect(runtimePaths.has(inputPath), inputPath).toBe(true);
+      expect(hostConfig.delivery.gitops.resources).toContainEqual({
+        id: "hwlab-nc01-v03-runtime-gitops-scripts",
+        renderer: "hwlab-runtime-gitops-scripts",
+        configRef: "config/hwlab-node-lanes.yaml#lanes.v03.targets.NC01",
+        manifestPath: "deploy/gitops/unidesk-host/hwlab-nc01-v03-runtime-gitops-scripts.yaml",
+        namespace: "hwlab-ci",
+      });
+      const gitopsResources = renderGitOpsResources(hostConfig.delivery.gitops, rootPath());
+      expect(gitopsResources).toHaveLength(1);
+      expect(gitopsResources[0]?.path).toBe("deploy/gitops/unidesk-host/hwlab-nc01-v03-runtime-gitops-scripts.yaml");
+      const gitopsConfigMap = Bun.YAML.parse(gitopsResources[0]?.content ?? "") as Record<string, any>;
+      expect(gitopsConfigMap.metadata.name).toBe("hwlab-nc01-v03-ci-image-publish-runtime-gitops-scripts");
+      expect(gitopsConfigMap.metadata.namespace).toBe("hwlab-ci");
+      expect(gitopsConfigMap.data["runtime-gitops-postprocess.mjs"]).toContain("UNIDESK_RUNTIME_GITOPS_OVERLAY_FILE");
+      expect(gitopsConfigMap.data["runtime-gitops-postprocess.mjs"].indexOf("UNIDESK_RUNTIME_GITOPS_OVERLAY_FILE"))
+        .toBeLessThan(gitopsConfigMap.data["runtime-gitops-postprocess.mjs"].indexOf("UNIDESK_RUNTIME_GITOPS_OVERLAY_B64"));
       const legacyPayload = Buffer.from(JSON.stringify({ runtimePath: overlay.runtimePath, observability: overlay.observability }), "utf8").toString("base64");
       const legacyPipeline = Bun.YAML.parse(readFileSync(pipelinePath, "utf8")) as Record<string, any>;
       const legacyStep = legacyPipeline.spec.tasks[0].taskSpec.steps[0];