Merge remote-tracking branch 'origin/master' into feat/pikaoa-platform
# Conflicts: # config/secrets-distribution.yaml # docs/MDTODO/agentrun-runtime-reliability.md # scripts/src/platform-infra-pipelines-as-code.ts
This commit is contained in:
Codex
@@ -2,6 +2,8 @@
|
||||
// Renders AgentRun YAML lane policy into runtime manager environment.
|
||||
import { createHash } from "node:crypto";
|
||||
import type { AgentRunLaneSpec } from "./agentrun-lanes";
|
||||
import { gitRepositoryIdentity, resolveCicdDeliveryAuthority } from "./cicd-delivery-authority";
|
||||
import { renderPacFeatureConfigSchemaStage } from "./pac-feature-config-schema-stage";
|
||||
import { stableJsonSha256 } from "./stable-json";
|
||||
|
||||
export interface AgentRunArtifactService {
|
||||
@@ -408,6 +410,19 @@ function agentRunTektonGitopsPublishScript(spec: AgentRunLaneSpec): string {
|
||||
const templateImage = agentRunImageArtifact(spec, { sourceCommit: sourcePlaceholder, envIdentity: envPlaceholder, digest: digestPlaceholder, status: statusPlaceholder });
|
||||
const templateFiles = renderAgentRunGitopsFiles(spec, { sourceCommit: sourcePlaceholder, image: templateImage });
|
||||
const templateB64 = Buffer.from(JSON.stringify(templateFiles), "utf8").toString("base64");
|
||||
const authority = resolveCicdDeliveryAuthority({
|
||||
node: spec.nodeId,
|
||||
lane: spec.lane,
|
||||
sourceRepository: gitRepositoryIdentity(spec.source.repository),
|
||||
sourceBranch: spec.source.branch,
|
||||
});
|
||||
if (authority.kind !== "pac-pr-merge") throw new Error(`AgentRun ${spec.nodeId}/${spec.lane} requires exact PaC consumer authority for feature config validation`);
|
||||
const featureConfigSchemaStage = renderPacFeatureConfigSchemaStage({
|
||||
repositoryId: authority.consumer.repositoryRef,
|
||||
consumer: authority.consumer.consumerId,
|
||||
repoDirExpression: '"$root"',
|
||||
renderedRootExpression: '"$PWD/$(params.gitops-root)"',
|
||||
});
|
||||
return [
|
||||
"#!/bin/sh",
|
||||
"set -eu",
|
||||
@@ -446,6 +461,7 @@ function agentRunTektonGitopsPublishScript(spec: AgentRunLaneSpec): string {
|
||||
" writeFileSync(file.path, content);",
|
||||
"}",
|
||||
"NODE",
|
||||
featureConfigSchemaStage,
|
||||
"git add source.json \"$(params.artifact-catalog)\" \"$(params.gitops-root)\"",
|
||||
"if git diff --quiet --cached; then changed=false; else changed=true; git -c user.email=agentrun@unidesk.local -c user.name='UniDesk AgentRun PaC' commit -m \"deploy: render AgentRun $(params.gitops-branch) from PaC\"; fi",
|
||||
"git remote set-url origin \"$git_auth_url\"",
|
||||
|
||||
@@ -667,7 +667,6 @@ function targetTaskPreflightFromArgs(args: string[], aipod: string): AgentRunTar
|
||||
mutation: false,
|
||||
recoveryActions: [
|
||||
"修复错误后用同一条 create task 命令重新执行；失败预检不会创建 task。",
|
||||
"先保留 --dry-run 查看 Target、source、workspaceRef、resourceBundleRef、session 与 SecretRef 摘要。",
|
||||
],
|
||||
valuesPrinted: false,
|
||||
},
|
||||
|
||||
@@ -84,6 +84,22 @@ describe("GitHub repository token overrides", () => {
|
||||
expect(selected.probe).toMatchObject({ source: "yaml-token-source", scope: "repository-override", yamlSourcePriority: "before-env" });
|
||||
});
|
||||
|
||||
test("matches repository overrides without case sensitivity", () => {
|
||||
delete process.env.GH_TOKEN;
|
||||
delete process.env.GITHUB_TOKEN;
|
||||
const authConfig = testAuthConfig();
|
||||
|
||||
for (const repo of ["PikaInc/selfmedia", "pikainc/SELFMEDIA", "PIKAINC/SELFMEDIA"]) {
|
||||
const selected = resolveToken(repo, false, authConfig);
|
||||
expect(selected.token).toBe("selfmedia-token");
|
||||
expect(selected.probe).toMatchObject({ scope: "repository-override", sourceRef: "selfmedia-token.txt", valuesPrinted: false });
|
||||
}
|
||||
|
||||
const global = resolveToken("PikasTech/UniDesk", false, authConfig);
|
||||
expect(global.token).toBe("global-token");
|
||||
expect(global.probe).toMatchObject({ scope: "global", sourceRef: "global-token.txt", valuesPrinted: false });
|
||||
});
|
||||
|
||||
test("uses the final positional repository for issue and PR token selection", () => {
|
||||
delete process.env.GH_TOKEN;
|
||||
delete process.env.GITHUB_TOKEN;
|
||||
|
||||
@@ -31,6 +31,10 @@ export interface GitHubYamlAuthConfig {
|
||||
repositoryOverrides: GitHubYamlTokenSourceConfig[];
|
||||
}
|
||||
|
||||
function repositoryLookupKey(repository: string): string {
|
||||
return repository.toLowerCase();
|
||||
}
|
||||
|
||||
export function readIssueLifecycleCommentBody(options: GitHubOptions, command: string): { body: string; bodySource: Record<string, unknown> } | null {
|
||||
if (options.comment === undefined && options.commentFile === undefined) return null;
|
||||
if (options.comment !== undefined) {
|
||||
@@ -59,7 +63,10 @@ export function tokenFromEnvironment(): GitHubTokenProbe {
|
||||
}
|
||||
|
||||
export function tokenFromYamlSource(repo: string, authConfig: GitHubYamlAuthConfig = readGitHubYamlAuthConfig()): { token: string | null; probe: GitHubTokenProbe } {
|
||||
const override = authConfig.repositoryOverrides.find((candidate) => candidate.repository === repo) ?? null;
|
||||
const repoLookupKey = repositoryLookupKey(repo);
|
||||
const override = authConfig.repositoryOverrides.find((candidate) => (
|
||||
candidate.repository !== undefined && repositoryLookupKey(candidate.repository) === repoLookupKey
|
||||
)) ?? null;
|
||||
const config = override ?? authConfig.tokenSource;
|
||||
if (config === null || config.enabled === false) {
|
||||
return {
|
||||
@@ -162,8 +169,9 @@ function readGitHubYamlAuthConfig(): GitHubYamlAuthConfig {
|
||||
const configRef = `${GITHUB_REPOSITORY_OVERRIDES_CONFIG_REF}[${index}]`;
|
||||
const override = asRecord(value, configRef);
|
||||
const repository = repositoryField(override, "repository", configRef);
|
||||
if (seenRepositories.has(repository)) throw new Error(`${GITHUB_REPOSITORY_OVERRIDES_CONFIG_REF} contains duplicate repository ${repository}`);
|
||||
seenRepositories.add(repository);
|
||||
const repositoryKey = repositoryLookupKey(repository);
|
||||
if (seenRepositories.has(repositoryKey)) throw new Error(`${GITHUB_REPOSITORY_OVERRIDES_CONFIG_REF} contains duplicate repository ${repository}`);
|
||||
seenRepositories.add(repositoryKey);
|
||||
return {
|
||||
repository,
|
||||
priority: tokenSourcePriorityField(override, "priority", configRef),
|
||||
|
||||
@@ -100,14 +100,14 @@ export function ghHelp(): unknown {
|
||||
"Commander brief ClaudeQQ defaults to private target 645275593 through backend-core /api/microservices/claudeqq/proxy; UNIDESK_COMMANDER_BRIEF_CLAUDEQQ_* env vars can override target, base URL, timeout, and enabled state.",
|
||||
"comment update/edit PATCHes /repos/{owner}/{repo}/issues/comments/{comment_id} and preserves the comment id/timeline; comment delete is supported because GitHub supports deleting issue comments, but routine wording fixes should use update/edit. issue/pr hard delete is unsupported and close is the lifecycle alternative.",
|
||||
"PR files is the canonical compact changed-file/stat summary. It uses GitHub REST, returns bounded file rows, additions/deletions/changes when available, truncation metadata, and a next command for full details. Raw diff patches are not emitted by default; gh pr diff <number> --stat is a compatibility alias for the same JSON summary.",
|
||||
"PR review-plan is the review-first bounded patch index. It uses GitHub REST PR files, prints changed files with additions/deletions/hunk counts/patch-line counts/default truncation flags, and emits one per-file gh pr diff --file drill-down command without creating a local worktree.",
|
||||
"PR review-plan is the review-first bounded patch index. It uses GitHub REST PR files, prints changed files with additions/deletions/hunk counts/patch-line counts/default truncation flags, and emits per-file gh pr diff --file drill-down commands without creating a local worktree. Use only the drill-downs needed for review; do not mechanically expand every file.",
|
||||
"PR diff --file reads one changed file patch from GitHub REST and prints only a bounded excerpt by default. Add --hunk N to inspect one hunk, --limit N to change displayed patch lines, or --full/--raw for explicit structured full-patch disclosure. --stat remains the no-patch file/stat compatibility path.",
|
||||
"PR edit/update PATCHes /repos/{owner}/{repo}/pulls/{number} through REST only, never GitHub Projects Classic GraphQL/projectCards, and returns low-noise JSON with repo, PR number, changedFields, url, and body size/SHA metadata instead of echoing the full body.",
|
||||
"PR view is the canonical bounded metadata summary; read remains a UniDesk compatibility alias. Human full-body reading uses `trans gh:/owner/repo/pr/<number> cat`, and targeted lookup uses the same route with `rg <pattern>`. `--json body`, `--full`, and `--raw` are explicit structured machine disclosure only. View/read retain positional numbers, GitHub URLs, owner/repo#number shorthand, compatible --number, REST closeout fields, and on-demand GraphQL closeout metadata.",
|
||||
"PR preflight/closeout accept the same owner/repo#number shorthand as PR view/read so merge readiness checks do not require repeating --repo after a PR URL has already been normalized.",
|
||||
"PR list does not fetch mergeability or statusCheckRollup; request those closeout fields with gh pr view <number> --json headRefName,baseRefName,mergeable,mergeStateStatus,statusCheckRollup.",
|
||||
"PR preflight is a low-noise read-only closeout helper for explicit diagnosis only. It combines redacted auth capability, PR branch/state metadata, mergeability, mergeStateStatus, compact status check counts, and an explicit read-only policy. It is not a required step before gh pr merge. Use --full or --raw to include all fetched status contexts.",
|
||||
"PR merge is the one-command guarded write path: it reads closeout metadata itself, retries GitHub UNKNOWN/null mergeability with YAML-configured exponential backoff, refuses non-open/draft/conflicting/non-clean/failed/pending PRs, then uses GitHub REST merge. It defaults to deleting the merged same-repo head branch, cleaning the matching local .worktree when clean, and fast-forwarding the local main worktree on the PR base branch; --sync-node NODE additionally runs mapped node source-workspace sync. Use --dry-run to see the exact merge and closeout plan without writing.",
|
||||
"PR merge is the one-command guarded write path: it reads closeout metadata itself, retries GitHub UNKNOWN/null mergeability with YAML-configured exponential backoff, refuses non-open/draft/conflicting/non-clean/failed/pending PRs, then uses GitHub REST merge. Its success summary includes mergeCommit and mergedAt, so a routine follow-up pr view is unnecessary. It defaults to deleting the merged same-repo head branch, cleaning the matching local .worktree when clean, and fast-forwarding the local main worktree on the PR base branch; --sync-node NODE additionally runs mapped node source-workspace sync. Use --dry-run to see the exact merge and closeout plan without writing.",
|
||||
],
|
||||
};
|
||||
}
|
||||
|
||||
@@ -169,6 +169,12 @@ export function renderPrMergeTable(result: GitHubCommandResult, fallbackDetails?
|
||||
: {};
|
||||
const mergeMethod = result.method ?? result.mergeMethod ?? details.method;
|
||||
const deleteBranch = result.deleteBranch ?? details.deleteBranch;
|
||||
const mergeResult = isRecord(result.mergeResult) ? result.mergeResult : {};
|
||||
const mergeCommitValue = pullRequest.mergeCommit;
|
||||
const mergeCommit = isRecord(mergeCommitValue)
|
||||
? mergeCommitValue.oid
|
||||
: mergeCommitValue ?? mergeResult.sha;
|
||||
const mergedAt = pullRequest.mergedAt;
|
||||
const status = result.ok === true
|
||||
? result.alreadyMerged === true
|
||||
? "already-merged"
|
||||
@@ -198,13 +204,14 @@ export function renderPrMergeTable(result: GitHubCommandResult, fallbackDetails?
|
||||
` repo=${ghText(result.repo)} title=${ghShort(ghText(pullRequest.title), 96)}`,
|
||||
` blockers=${blockers.length === 0 ? "-" : blockers.join(",")} pending=${pending.length === 0 ? "-" : pending.join(",")}`,
|
||||
` retry=${retry.attempts !== undefined && retry.maxAttempts !== undefined ? `${ghText(retry.attempts)}/${ghText(retry.maxAttempts)} exhausted=${ghText(retry.exhausted)}` : "-"}`,
|
||||
` mergeCommit=${ghText(mergeCommit)} mergedAt=${ghText(mergedAt)}`,
|
||||
` branchDeletion=${ghText(branchDeletion.ok ?? branchDeletion.skippedReason ?? branchDeletion.attempted)}`,
|
||||
` closeout localWorktree=${closeoutCell(localWorktree)} mainWorktree=${closeoutCell(mainWorktree)} nodeSyncs=${nodeSyncs.length === 0 ? "-" : nodeSyncs.map(closeoutCell).join(",")}`,
|
||||
"",
|
||||
"Next:",
|
||||
];
|
||||
if (result.ok === true && result.alreadyMerged !== true && result.dryRun !== true) {
|
||||
lines.push(` bun scripts/cli.ts gh pr view ${ghText(result.number ?? details.number)} --repo ${ghText(result.repo)}`);
|
||||
if (result.ok === true && result.dryRun !== true) {
|
||||
lines.push(" no follow-up required; merge facts are included in Summary.");
|
||||
} else {
|
||||
lines.push(` ${prMergeRetryCommand(ghText(result.repo), result.number ?? details.number, mergeMethod, deleteBranch)}`);
|
||||
lines.push(` bun scripts/cli.ts gh pr preflight ${ghText(result.number ?? details.number)} --repo ${ghText(result.repo)} --full`);
|
||||
|
||||
@@ -545,20 +545,27 @@ export interface HwlabRuntimeKafkaShadowProducerSpec {
|
||||
|
||||
export interface HwlabRuntimeKafkaEventBridgeSpec {
|
||||
readonly enabled: boolean;
|
||||
readonly features: {
|
||||
readonly directPublish: boolean;
|
||||
readonly liveKafkaSse: boolean;
|
||||
readonly kafkaRefreshReplay: boolean;
|
||||
readonly transactionalProjector: boolean;
|
||||
readonly projectionOutboxRelay: boolean;
|
||||
readonly projectionRealtime: boolean;
|
||||
readonly transactionalProjector?: {
|
||||
readonly heartbeatIntervalMs: number;
|
||||
};
|
||||
readonly refreshReplay?: {
|
||||
readonly groupIdPrefix: string;
|
||||
readonly timeoutMs: number;
|
||||
readonly scanLimit: number;
|
||||
readonly matchedEventLimit: number;
|
||||
readonly liveBufferLimit: number;
|
||||
readonly projectionOutboxRelay?: {
|
||||
readonly intervalMs: number;
|
||||
readonly batchSize: number;
|
||||
readonly leaseMs: number;
|
||||
readonly sendTimeoutMs: number;
|
||||
readonly retryBackoffMs: number;
|
||||
};
|
||||
readonly projectionRealtime?: {
|
||||
readonly outboxTailBatchSize: number;
|
||||
readonly sseHeartbeatMs: number;
|
||||
readonly sseDrainTimeoutMs: number;
|
||||
};
|
||||
readonly healthThresholds: {
|
||||
readonly consumerLagWarning: number;
|
||||
readonly outboxBacklogWarning: number;
|
||||
readonly retryCountWarning: number;
|
||||
readonly failedInboxWarning: number;
|
||||
readonly dlqWarning: number;
|
||||
};
|
||||
readonly configRef: string;
|
||||
readonly bootstrapServers: string;
|
||||
@@ -566,7 +573,6 @@ export interface HwlabRuntimeKafkaEventBridgeSpec {
|
||||
readonly agentRunEventTopic: string;
|
||||
readonly hwlabEventTopic: string;
|
||||
readonly clientId: string;
|
||||
readonly directPublishConsumerGroupId: string;
|
||||
readonly transactionalProjectorConsumerGroupId: string;
|
||||
readonly hwlabEventConsumerGroupId: string;
|
||||
}
|
||||
@@ -628,6 +634,7 @@ export interface HwlabRuntimePipelineProvenanceSpec {
|
||||
readonly configRef: string;
|
||||
readonly renderer: "hwlab-runtime-lane";
|
||||
readonly mode: "remote-pipeline-annotation";
|
||||
readonly maxInlineScriptBytes: number;
|
||||
}
|
||||
|
||||
export interface HwlabRuntimeLaneSpec {
|
||||
@@ -1060,6 +1067,7 @@ export function parseHwlabRuntimePipelineProvenance(
|
||||
configRef,
|
||||
renderer: enumStringField(raw, "renderer", path, ["hwlab-runtime-lane"]),
|
||||
mode: enumStringField(raw, "mode", path, ["remote-pipeline-annotation"]),
|
||||
maxInlineScriptBytes: boundedIntegerField(raw, "maxInlineScriptBytes", path, 1024, 131072),
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1220,55 +1228,75 @@ function codeAgentKafkaShadowProducerConfig(value: unknown, path: string): Hwlab
|
||||
|
||||
function codeAgentKafkaEventBridgeConfig(value: unknown, path: string): HwlabRuntimeKafkaEventBridgeSpec {
|
||||
const raw = asRecord(value, path);
|
||||
const features = asRecord(raw.features, `${path}.features`);
|
||||
const liveKafkaSse = booleanField(features, "liveKafkaSse", `${path}.features`);
|
||||
const kafkaRefreshReplay = booleanField(features, "kafkaRefreshReplay", `${path}.features`);
|
||||
const refreshReplay = raw.refreshReplay === undefined
|
||||
if (raw.refreshReplay !== undefined) throw new Error(`${path}.refreshReplay was removed with the fixed projection realtime architecture`);
|
||||
const enabled = booleanField(raw, "enabled", path);
|
||||
const transactionalProjectorConfig = raw.transactionalProjector === undefined
|
||||
? undefined
|
||||
: codeAgentKafkaRefreshReplayConfig(raw.refreshReplay, `${path}.refreshReplay`);
|
||||
if (kafkaRefreshReplay && refreshReplay === undefined) {
|
||||
throw new Error(`${path}.refreshReplay is required when ${path}.features.kafkaRefreshReplay is true`);
|
||||
}
|
||||
if (kafkaRefreshReplay && !liveKafkaSse) {
|
||||
throw new Error(`${path}.features.liveKafkaSse must be true when ${path}.features.kafkaRefreshReplay is true`);
|
||||
}
|
||||
const directPublishConsumerGroupId = stringField(raw, "directPublishConsumerGroupId", path);
|
||||
: codeAgentKafkaTransactionalProjectorConfig(raw.transactionalProjector, `${path}.transactionalProjector`);
|
||||
const projectionOutboxRelayConfig = raw.projectionOutboxRelay === undefined
|
||||
? undefined
|
||||
: codeAgentKafkaProjectionOutboxRelayConfig(raw.projectionOutboxRelay, `${path}.projectionOutboxRelay`);
|
||||
const projectionRealtimeConfig = raw.projectionRealtime === undefined
|
||||
? undefined
|
||||
: codeAgentKafkaProjectionRealtimeConfig(raw.projectionRealtime, `${path}.projectionRealtime`);
|
||||
if (transactionalProjectorConfig === undefined) throw new Error(`${path}.transactionalProjector is required by the fixed transactional projection architecture`);
|
||||
if (projectionOutboxRelayConfig === undefined) throw new Error(`${path}.projectionOutboxRelay is required by the fixed transactional projection architecture`);
|
||||
if (projectionRealtimeConfig === undefined) throw new Error(`${path}.projectionRealtime is required by the fixed transactional projection architecture`);
|
||||
const transactionalProjectorConsumerGroupId = stringField(raw, "transactionalProjectorConsumerGroupId", path);
|
||||
const hwlabEventConsumerGroupId = stringField(raw, "hwlabEventConsumerGroupId", path);
|
||||
if (new Set([directPublishConsumerGroupId, transactionalProjectorConsumerGroupId, hwlabEventConsumerGroupId]).size !== 3) {
|
||||
throw new Error(`${path} consumer group ids must be distinct so enabled capabilities receive independent event streams`);
|
||||
if (transactionalProjectorConsumerGroupId === hwlabEventConsumerGroupId) {
|
||||
throw new Error(`${path} projector and realtime consumer group ids must be distinct`);
|
||||
}
|
||||
return {
|
||||
enabled: booleanField(raw, "enabled", path),
|
||||
features: {
|
||||
directPublish: booleanField(features, "directPublish", `${path}.features`),
|
||||
liveKafkaSse,
|
||||
kafkaRefreshReplay,
|
||||
transactionalProjector: booleanField(features, "transactionalProjector", `${path}.features`),
|
||||
projectionOutboxRelay: booleanField(features, "projectionOutboxRelay", `${path}.features`),
|
||||
projectionRealtime: booleanField(features, "projectionRealtime", `${path}.features`),
|
||||
},
|
||||
...(refreshReplay === undefined ? {} : { refreshReplay }),
|
||||
enabled,
|
||||
transactionalProjector: transactionalProjectorConfig,
|
||||
projectionOutboxRelay: projectionOutboxRelayConfig,
|
||||
projectionRealtime: projectionRealtimeConfig,
|
||||
healthThresholds: codeAgentKafkaHealthThresholdsConfig(raw.healthThresholds, `${path}.healthThresholds`),
|
||||
configRef: stringField(raw, "configRef", path),
|
||||
bootstrapServers: stringField(raw, "bootstrapServers", path),
|
||||
stdioTopic: stringField(raw, "stdioTopic", path),
|
||||
agentRunEventTopic: stringField(raw, "agentRunEventTopic", path),
|
||||
hwlabEventTopic: stringField(raw, "hwlabEventTopic", path),
|
||||
clientId: stringField(raw, "clientId", path),
|
||||
directPublishConsumerGroupId,
|
||||
transactionalProjectorConsumerGroupId,
|
||||
hwlabEventConsumerGroupId,
|
||||
};
|
||||
}
|
||||
|
||||
function codeAgentKafkaRefreshReplayConfig(value: unknown, path: string): NonNullable<HwlabRuntimeKafkaEventBridgeSpec["refreshReplay"]> {
|
||||
function codeAgentKafkaTransactionalProjectorConfig(value: unknown, path: string): NonNullable<HwlabRuntimeKafkaEventBridgeSpec["transactionalProjector"]> {
|
||||
const raw = asRecord(value, path);
|
||||
return { heartbeatIntervalMs: numberField(raw, "heartbeatIntervalMs", path) };
|
||||
}
|
||||
|
||||
function codeAgentKafkaProjectionOutboxRelayConfig(value: unknown, path: string): NonNullable<HwlabRuntimeKafkaEventBridgeSpec["projectionOutboxRelay"]> {
|
||||
const raw = asRecord(value, path);
|
||||
return {
|
||||
groupIdPrefix: stringField(raw, "groupIdPrefix", path),
|
||||
timeoutMs: numberField(raw, "timeoutMs", path),
|
||||
scanLimit: numberField(raw, "scanLimit", path),
|
||||
matchedEventLimit: numberField(raw, "matchedEventLimit", path),
|
||||
liveBufferLimit: numberField(raw, "liveBufferLimit", path),
|
||||
intervalMs: numberField(raw, "intervalMs", path),
|
||||
batchSize: numberField(raw, "batchSize", path),
|
||||
leaseMs: numberField(raw, "leaseMs", path),
|
||||
sendTimeoutMs: numberField(raw, "sendTimeoutMs", path),
|
||||
retryBackoffMs: numberField(raw, "retryBackoffMs", path),
|
||||
};
|
||||
}
|
||||
|
||||
function codeAgentKafkaProjectionRealtimeConfig(value: unknown, path: string): NonNullable<HwlabRuntimeKafkaEventBridgeSpec["projectionRealtime"]> {
|
||||
const raw = asRecord(value, path);
|
||||
return {
|
||||
outboxTailBatchSize: numberField(raw, "outboxTailBatchSize", path),
|
||||
sseHeartbeatMs: numberField(raw, "sseHeartbeatMs", path),
|
||||
sseDrainTimeoutMs: numberField(raw, "sseDrainTimeoutMs", path),
|
||||
};
|
||||
}
|
||||
|
||||
function codeAgentKafkaHealthThresholdsConfig(value: unknown, path: string): HwlabRuntimeKafkaEventBridgeSpec["healthThresholds"] {
|
||||
const raw = asRecord(value, path);
|
||||
return {
|
||||
consumerLagWarning: nonNegativeIntegerField(raw, "consumerLagWarning", path),
|
||||
outboxBacklogWarning: nonNegativeIntegerField(raw, "outboxBacklogWarning", path),
|
||||
retryCountWarning: nonNegativeIntegerField(raw, "retryCountWarning", path),
|
||||
failedInboxWarning: nonNegativeIntegerField(raw, "failedInboxWarning", path),
|
||||
dlqWarning: nonNegativeIntegerField(raw, "dlqWarning", path),
|
||||
};
|
||||
}
|
||||
|
||||
|
||||
@@ -51,8 +51,8 @@ test("realtime fanout keeps the YAML terminal timeout when durationMs is absent"
|
||||
conditionalEventTypePairs: { "tool-call": { agentrun: "tool_call", hwlab: "tool" } },
|
||||
expectedKafka: {
|
||||
topics: { stdio: "codex-stdio.raw.v1", agentrun: "agentrun.event.v1", hwlab: "hwlab.event.v1" },
|
||||
groups: { directPublish: "direct", transactionalProjector: "projector", liveSse: "live" },
|
||||
capabilities: { directPublish: true, liveKafkaSse: true, kafkaRefreshReplay: true },
|
||||
groups: { transactionalProjector: "projector", liveSse: "live" },
|
||||
capabilities: { transactionalProjector: true, projectionOutboxRelay: true, projectionRealtime: true },
|
||||
},
|
||||
};
|
||||
|
||||
@@ -194,7 +194,7 @@ test("realtime fanout validates stdio against the scoped AgentRun session lineag
|
||||
assert.equal(expectedStreamSessionId("hwlab", hwlabSessionId), hwlabSessionId);
|
||||
});
|
||||
|
||||
test("realtime fanout validates YAML-owned refresh and legacy live-only connected contracts", () => {
|
||||
test("realtime fanout validates the fixed transactional replay and live connected contract", () => {
|
||||
const source = nodeWebObserveRunnerRealtimeSource();
|
||||
const build = new Function(`${source}\nreturn realtimeAssertConnectedContract;`) as () => (
|
||||
connected: Record<string, unknown>,
|
||||
@@ -207,7 +207,7 @@ test("realtime fanout validates YAML-owned refresh and legacy live-only connecte
|
||||
const sessionId = "ses_refresh_contract";
|
||||
const expectedKafka = {
|
||||
topics: { hwlab: "hwlab.event.v1" },
|
||||
capabilities: { directPublish: true, liveKafkaSse: true, kafkaRefreshReplay: true },
|
||||
capabilities: { transactionalProjector: true, projectionOutboxRelay: true, projectionRealtime: true },
|
||||
};
|
||||
const refreshProfile = {
|
||||
expectedKafka,
|
||||
@@ -249,28 +249,6 @@ test("realtime fanout validates YAML-owned refresh and legacy live-only connecte
|
||||
/replayed count exceeds matched count/u,
|
||||
);
|
||||
|
||||
const liveProfile = {
|
||||
expectedKafka: { topics: { hwlab: "hwlab.event.v1" }, capabilities: { directPublish: true, liveKafkaSse: true, kafkaRefreshReplay: false } },
|
||||
expectedProductSse: {
|
||||
deliverySemantics: "live-only",
|
||||
liveOnly: true,
|
||||
replay: false,
|
||||
replaySupported: false,
|
||||
lossPossible: true,
|
||||
refreshHandoff: false,
|
||||
replayPriorTraceOnReconnect: false,
|
||||
},
|
||||
};
|
||||
assert.doesNotThrow(() => assertConnected({
|
||||
realtimeSource: "hwlab.event.v1",
|
||||
deliverySemantics: "live-only",
|
||||
liveOnly: true,
|
||||
replay: false,
|
||||
replaySupported: false,
|
||||
lossPossible: true,
|
||||
filters: { sessionId, traceId: null },
|
||||
capabilities: liveProfile.expectedKafka.capabilities,
|
||||
}, sessionId, "live", liveProfile));
|
||||
});
|
||||
|
||||
test("existing session refresh rejects duplicate or reordered Workbench identities", () => {
|
||||
@@ -326,7 +304,7 @@ test("existing session refresh preserves rejected connected evidence and rejects
|
||||
counts: { matched: 8, replayed: 8, buffered: 1, bufferedDelivered: 1, liveDelivered: 0, deduplicated: 0 },
|
||||
};
|
||||
const profile = {
|
||||
expectedKafka: { topics: { hwlab: "hwlab.event.v1" }, capabilities: { directPublish: true, liveKafkaSse: true, kafkaRefreshReplay: true } },
|
||||
expectedKafka: { topics: { hwlab: "hwlab.event.v1" }, capabilities: { transactionalProjector: true, projectionOutboxRelay: true, projectionRealtime: true } },
|
||||
expectedProductSse: { deliverySemantics: "kafka-retention-then-live", liveOnly: false, replay: true, replaySupported: true, lossPossible: false, refreshHandoff: true },
|
||||
};
|
||||
const connected = {
|
||||
|
||||
@@ -803,11 +803,18 @@ function realtimeFanoutEffectiveProfile(profile, durationMs) {
|
||||
if (!expectedProductSse || typeof expectedProductSse.deliverySemantics !== "string") throw new Error("realtime fanout profile lacks YAML-owned product SSE expectations");
|
||||
const expectedKafka = profile.expectedKafka && typeof profile.expectedKafka === "object" ? profile.expectedKafka : null;
|
||||
if (!expectedKafka?.topics || !expectedKafka?.groups || !expectedKafka?.capabilities) throw new Error("realtime fanout profile lacks YAML-derived Kafka expectations");
|
||||
if (expectedKafka.capabilities.directPublish !== true || expectedKafka.capabilities.liveKafkaSse !== true) {
|
||||
throw new Error("realtime fanout profile requires YAML-enabled directPublish and liveKafkaSse capabilities");
|
||||
if (expectedKafka.capabilities.transactionalProjector !== true
|
||||
|| expectedKafka.capabilities.projectionOutboxRelay !== true
|
||||
|| expectedKafka.capabilities.projectionRealtime !== true) {
|
||||
throw new Error("realtime fanout profile requires the fixed transactional projection capabilities");
|
||||
}
|
||||
if (expectedProductSse.refreshHandoff !== (expectedKafka.capabilities.kafkaRefreshReplay === true)) {
|
||||
throw new Error("realtime fanout product SSE refreshHandoff differs from the YAML Kafka capability");
|
||||
if (expectedProductSse.deliverySemantics !== "kafka-retention-then-live"
|
||||
|| expectedProductSse.liveOnly !== false
|
||||
|| expectedProductSse.replay !== true
|
||||
|| expectedProductSse.replaySupported !== true
|
||||
|| expectedProductSse.lossPossible !== false
|
||||
|| expectedProductSse.refreshHandoff !== true) {
|
||||
throw new Error("realtime fanout product SSE must use fixed retention replay and live handoff semantics");
|
||||
}
|
||||
if (expectedProductSse.replayPriorTraceOnReconnect === true && expectedProductSse.replay !== true) {
|
||||
throw new Error("realtime fanout replayPriorTraceOnReconnect requires replay=true");
|
||||
|
||||
@@ -791,7 +791,7 @@ export function sentinelPublishImageBuildShell(state: SentinelCicdState, jobName
|
||||
].join("\n");
|
||||
}
|
||||
|
||||
export function sentinelPublishShell(state: SentinelCicdState, jobName: string, publishGitops: boolean): string {
|
||||
export function sentinelPublishShell(state: SentinelCicdState, jobName: string, publishGitops: boolean, featureConfigSchemaStage = ""): string {
|
||||
const gitopsFiles = publishGitops ? sentinelGitopsFiles(state) : [];
|
||||
const filesB64 = Buffer.from(JSON.stringify(gitopsFiles.map((file) => ({
|
||||
path: file.path,
|
||||
@@ -871,6 +871,7 @@ export function sentinelPublishShell(state: SentinelCicdState, jobName: string,
|
||||
"}",
|
||||
"console.error(JSON.stringify({event:'web-probe-sentinel-gitops-files', fileCount: files.length, valuesRedacted:true}));",
|
||||
"NODE",
|
||||
...(featureConfigSchemaStage.length === 0 ? [] : [featureConfigSchemaStage]),
|
||||
" git add .",
|
||||
" file_count=$(git diff --cached --name-only | wc -l | tr -d ' ')",
|
||||
" if git diff --quiet --cached; then changed=false; else changed=true; git -c user.email=web-probe-sentinel@unidesk.local -c user.name='UniDesk Web Probe Sentinel' commit -m \"deploy: render web-probe sentinel ${source_commit}\"; fi",
|
||||
|
||||
@@ -44,11 +44,15 @@ import { nodeRuntimeDeployYamlOverlayShellScript } from "./deploy-overlay";
|
||||
import { pipelineProvenanceAnnotationKeys } from "../pipeline-provenance";
|
||||
import { hwlabNodeDeliveryAuthority, hwlabNodeDeliveryNext } from "./delivery-authority";
|
||||
import type { CicdDeliveryAuthority } from "../cicd-delivery-authority";
|
||||
import { renderPacFeatureConfigSchemaStage } from "../pac-feature-config-schema-stage";
|
||||
|
||||
const runtimeGitopsObservabilityNativeScript = readFileSync(rootPath("scripts/native/hwlab/runtime-gitops-observability.mjs"), "utf8").trimEnd();
|
||||
const runtimeGitopsPipelineGuardNativeScript = readFileSync(rootPath("scripts/native/hwlab/runtime-gitops-pipeline-guard.mjs"), "utf8").trimEnd();
|
||||
const runtimeGitopsScriptsConfigMapNativeScript = readFileSync(rootPath("scripts/native/hwlab/runtime-gitops-scripts-configmap.mjs"), "utf8").trimEnd();
|
||||
const runtimeGitopsPostprocessNativeScript = readFileSync(rootPath("scripts/native/hwlab/runtime-gitops-postprocess.mjs"), "utf8").trimEnd();
|
||||
const runtimeGitopsVerifyNativeScript = readFileSync(rootPath("scripts/native/hwlab/runtime-gitops-verify.mjs"), "utf8").trimEnd();
|
||||
const featureConfigSchemaWarningNativeScript = readFileSync(rootPath("scripts/native/cicd/feature-config-schema-warning.mjs"), "utf8").trimEnd();
|
||||
const ajv2020BundleScript = readFileSync(rootPath("scripts/vendor/ajv-dist/8.17.1/ajv2020.min.js"), "utf8").trimEnd();
|
||||
const runtimePipelineProvenanceNativeScript = readFileSync(rootPath("scripts/native/hwlab/runtime-pipeline-provenance.mjs"), "utf8").trimEnd();
|
||||
|
||||
export function nodeRuntimeGitMirrorJobName(mirror: NodeRuntimeGitMirrorTargetSpec, action: "sync" | "flush"): string {
|
||||
@@ -753,6 +757,8 @@ export function summarizeNodeRuntimeControlPlaneStatus(
|
||||
const pipelineRunDiagnostics = record(status.pipelineRunDiagnostics);
|
||||
const argo = record(status.argo);
|
||||
const runtime = record(status.runtime);
|
||||
const codeAgentRuntime = record(runtime.codeAgentRuntime);
|
||||
const kafkaAuthority = record(codeAgentRuntime.kafkaAuthority);
|
||||
const publicProbes = record(status.publicProbes);
|
||||
const gitMirror = record(status.gitMirror);
|
||||
const gitMirrorCompact = record(gitMirror.compact);
|
||||
@@ -822,8 +828,25 @@ export function summarizeNodeRuntimeControlPlaneStatus(
|
||||
externalPostgresReady: runtime.externalPostgresBridge === undefined && runtime.externalPostgresSecrets === undefined
|
||||
? null
|
||||
: record(runtime.externalPostgresBridge).ready === true && record(runtime.externalPostgresSecrets).ready === true,
|
||||
codeAgentRuntimeReady: record(runtime.codeAgentRuntime).required === true ? record(runtime.codeAgentRuntime).ready === true : null,
|
||||
codeAgentRuntimeReason: typeof record(runtime.codeAgentRuntime).degradedReason === "string" ? record(runtime.codeAgentRuntime).degradedReason : null,
|
||||
codeAgentRuntimeReady: codeAgentRuntime.required === true ? codeAgentRuntime.ready === true : null,
|
||||
codeAgentRuntimeReason: typeof codeAgentRuntime.degradedReason === "string" ? codeAgentRuntime.degradedReason : null,
|
||||
kafkaAuthority: Object.keys(kafkaAuthority).length === 0 ? null : {
|
||||
authority: kafkaAuthority.authority ?? null,
|
||||
fixedGroups: kafkaAuthority.fixedGroups ?? null,
|
||||
capabilities: kafkaAuthority.capabilities ?? null,
|
||||
liveReplay: kafkaAuthority.liveReplay ?? null,
|
||||
healthObserved: kafkaAuthority.healthObserved === true,
|
||||
healthStatus: kafkaAuthority.healthStatus ?? null,
|
||||
consumerLag: kafkaAuthority.consumerLag ?? null,
|
||||
backlogCount: kafkaAuthority.backlogCount ?? null,
|
||||
retryCount: kafkaAuthority.retryCount ?? null,
|
||||
failedInboxCount: kafkaAuthority.failedInboxCount ?? null,
|
||||
dlqCount: kafkaAuthority.dlqCount ?? null,
|
||||
thresholds: kafkaAuthority.thresholds ?? null,
|
||||
warning: kafkaAuthority.warning === true,
|
||||
warningReasons: kafkaAuthority.warningReasons ?? [],
|
||||
blocking: false,
|
||||
},
|
||||
},
|
||||
publicProbe: {
|
||||
ready: publicProbes.ready === true,
|
||||
@@ -1520,12 +1543,24 @@ export function renderNodeRuntimeControlPlaneOnNode(spec: HwlabRuntimeLaneSpec,
|
||||
`--web-endpoint ${shellQuote(spec.publicWebUrl)}`,
|
||||
`--out ${shellQuote(renderDir)}`,
|
||||
].join(" "),
|
||||
...nodeRuntimePipelinePostprocessScript(),
|
||||
...nodeRuntimePipelinePostprocessScript(nodeRuntimeFeatureConfigSchemaStage(spec)),
|
||||
].join("\n");
|
||||
return { result: runNodeHostScriptAsync(spec, script, timeoutSeconds, `${spec.nodeId.toLowerCase()}-${spec.lane}-render`), renderDir, worktreeDir, location: "node-host" };
|
||||
}
|
||||
|
||||
export function nodeRuntimePipelinePostprocessScript(): string[] {
|
||||
export function nodeRuntimeFeatureConfigSchemaStage(spec: HwlabRuntimeLaneSpec): string {
|
||||
const authority = hwlabNodeDeliveryAuthority({ node: spec.nodeId, lane: spec.lane, spec });
|
||||
if (authority.kind !== "pac-pr-merge") throw new Error(`HWLAB ${spec.nodeId}/${spec.lane} requires exact PaC consumer authority for feature config validation`);
|
||||
return renderPacFeatureConfigSchemaStage({
|
||||
repositoryId: authority.consumer.repositoryRef,
|
||||
consumer: authority.consumer.consumerId,
|
||||
repoDirExpression: '"$PWD"',
|
||||
renderedRootExpression: JSON.stringify(spec.runtimePath),
|
||||
ajvBundleExpression: "'/etc/unidesk-cicd-runtime-gitops/ajv2020.min.js'",
|
||||
});
|
||||
}
|
||||
|
||||
export function nodeRuntimePipelinePostprocessScript(featureConfigSchemaStage: string): string[] {
|
||||
return [
|
||||
"node - \"$render_dir\" \"$overlay_b64\" <<'NODE'",
|
||||
"const fs = require('fs');",
|
||||
@@ -1534,6 +1569,7 @@ export function nodeRuntimePipelinePostprocessScript(): string[] {
|
||||
"const renderDir = process.argv[2];",
|
||||
"const overlay = JSON.parse(Buffer.from(process.argv[3], 'base64').toString('utf8'));",
|
||||
`const runtimeGitopsObservabilityNativeScript = ${JSON.stringify(runtimeGitopsObservabilityNativeScript)};`,
|
||||
`const featureConfigSchemaStage = ${JSON.stringify(featureConfigSchemaStage)};`,
|
||||
"const pipelinePath = path.join(renderDir, overlay.tektonDir, 'pipeline.yaml');",
|
||||
"let text = fs.readFileSync(pipelinePath, 'utf8');",
|
||||
"let YAML = null;",
|
||||
@@ -1562,6 +1598,9 @@ export function nodeRuntimePipelinePostprocessScript(): string[] {
|
||||
"echo '{\"event\":\"prepare-source-dependencies\",\"status\":\"not-required\",\"dependency\":\"yaml\",\"manager\":\"inline-service-id-parser\"}' >&2",
|
||||
"ci_timing_emit prepare-source-dependencies succeeded \"$prepare_source_dependencies_started_ms\"`;",
|
||||
"}",
|
||||
"function featureConfigSchemaValidationScript() {",
|
||||
" return featureConfigSchemaStage;",
|
||||
"}",
|
||||
"function validatePrepareSourceDependencyScript(script) {",
|
||||
" const marker = 'NODE_UNIDESK_YAML_DEPENDENCY';",
|
||||
" let offset = 0;",
|
||||
@@ -1818,12 +1857,6 @@ export function nodeRuntimePipelinePostprocessScript(): string[] {
|
||||
"function cloudWebRuntimeEnvEntries() {",
|
||||
" const exposure = overlay.publicExposure;",
|
||||
" const entries = !exposure || !Array.isArray(exposure.extraProxies) ? [] : exposure.extraProxies.filter((proxy) => proxy && proxy.cloudWebEnvName && proxy.publicBaseUrl).map((proxy) => ({ name: String(proxy.cloudWebEnvName), value: String(proxy.publicBaseUrl) }));",
|
||||
" const kafka = overlay.codeAgentRuntime && overlay.codeAgentRuntime.kafkaEventBridge;",
|
||||
" if (kafka) {",
|
||||
" entries.push({ name: 'HWLAB_WORKBENCH_LIVE_KAFKA_SSE_ENABLED', value: String(kafka.enabled && kafka.features.liveKafkaSse) });",
|
||||
" entries.push({ name: 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_ENABLED', value: String(kafka.enabled && kafka.features.kafkaRefreshReplay) });",
|
||||
" entries.push({ name: 'HWLAB_WORKBENCH_PROJECTION_REALTIME_ENABLED', value: String(kafka.enabled && kafka.features.projectionRealtime) });",
|
||||
" }",
|
||||
" return entries;",
|
||||
"}",
|
||||
"function startupProbeFrom(probe) {",
|
||||
@@ -1921,31 +1954,35 @@ export function nodeRuntimePipelinePostprocessScript(): string[] {
|
||||
" if (codeAgentRuntime.kafkaEventBridge) {",
|
||||
" const kafka = codeAgentRuntime.kafkaEventBridge;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_ENABLED', String(kafka.enabled)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_AGENTRUN_EVENT_CONSUME_ENABLED', String(kafka.enabled && (kafka.features.directPublish || kafka.features.transactionalProjector))) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_AGENTRUN_EVENT_CONSUME_ENABLED', String(kafka.enabled)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_BOOTSTRAP_SERVERS', String(kafka.bootstrapServers)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_STDIO_TOPIC', String(kafka.stdioTopic)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_AGENTRUN_EVENT_TOPIC', String(kafka.agentRunEventTopic)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_EVENT_TOPIC', String(kafka.hwlabEventTopic)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_CLIENT_ID', String(kafka.clientId)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_AGENTRUN_EVENT_GROUP_ID', String(kafka.directPublishConsumerGroupId)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_PROJECTOR_GROUP_ID', String(kafka.transactionalProjectorConsumerGroupId)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_HWLAB_EVENT_GROUP_ID', String(kafka.hwlabEventConsumerGroupId)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_DIRECT_PUBLISH_ENABLED', String(kafka.enabled && kafka.features.directPublish)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_WORKBENCH_LIVE_KAFKA_SSE_ENABLED', String(kafka.enabled && kafka.features.liveKafkaSse)) || codeAgentRuntimeChanged;",
|
||||
" const refreshReplayEnabled = kafka.enabled && kafka.features.kafkaRefreshReplay;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_ENABLED', String(refreshReplayEnabled)) || codeAgentRuntimeChanged;",
|
||||
" if (refreshReplayEnabled) {",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_GROUP_PREFIX', String(kafka.refreshReplay.groupIdPrefix)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_TIMEOUT_MS', String(kafka.refreshReplay.timeoutMs)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_SCAN_LIMIT', String(kafka.refreshReplay.scanLimit)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_MATCHED_EVENT_LIMIT', String(kafka.refreshReplay.matchedEventLimit)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_LIVE_BUFFER_LIMIT', String(kafka.refreshReplay.liveBufferLimit)) || codeAgentRuntimeChanged;",
|
||||
" if (kafka.enabled) {",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_PROJECTOR_HEARTBEAT_INTERVAL_MS', String(kafka.transactionalProjector.heartbeatIntervalMs)) || codeAgentRuntimeChanged;",
|
||||
" } else {",
|
||||
" codeAgentRuntimeChanged = removeEnvValues(container, ['HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_GROUP_PREFIX', 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_TIMEOUT_MS', 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_SCAN_LIMIT', 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_MATCHED_EVENT_LIMIT', 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_LIVE_BUFFER_LIMIT']) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = removeEnvValues(container, ['HWLAB_KAFKA_PROJECTOR_HEARTBEAT_INTERVAL_MS']) || codeAgentRuntimeChanged;",
|
||||
" }",
|
||||
" if (kafka.enabled) {",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_OUTBOX_RELAY_INTERVAL_MS', String(kafka.projectionOutboxRelay.intervalMs)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_OUTBOX_RELAY_BATCH_SIZE', String(kafka.projectionOutboxRelay.batchSize)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_OUTBOX_RELAY_LEASE_MS', String(kafka.projectionOutboxRelay.leaseMs)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_OUTBOX_RELAY_SEND_TIMEOUT_MS', String(kafka.projectionOutboxRelay.sendTimeoutMs)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_OUTBOX_RELAY_RETRY_BACKOFF_MS', String(kafka.projectionOutboxRelay.retryBackoffMs)) || codeAgentRuntimeChanged;",
|
||||
" } else {",
|
||||
" codeAgentRuntimeChanged = removeEnvValues(container, ['HWLAB_KAFKA_OUTBOX_RELAY_INTERVAL_MS', 'HWLAB_KAFKA_OUTBOX_RELAY_BATCH_SIZE', 'HWLAB_KAFKA_OUTBOX_RELAY_LEASE_MS', 'HWLAB_KAFKA_OUTBOX_RELAY_SEND_TIMEOUT_MS', 'HWLAB_KAFKA_OUTBOX_RELAY_RETRY_BACKOFF_MS']) || codeAgentRuntimeChanged;",
|
||||
" }",
|
||||
" if (kafka.enabled) {",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_WORKBENCH_OUTBOX_TAIL_BATCH_SIZE', String(kafka.projectionRealtime.outboxTailBatchSize)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_WORKBENCH_SSE_HEARTBEAT_MS', String(kafka.projectionRealtime.sseHeartbeatMs)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_WORKBENCH_SSE_DRAIN_TIMEOUT_MS', String(kafka.projectionRealtime.sseDrainTimeoutMs)) || codeAgentRuntimeChanged;",
|
||||
" } else {",
|
||||
" codeAgentRuntimeChanged = removeEnvValues(container, ['HWLAB_WORKBENCH_OUTBOX_TAIL_BATCH_SIZE', 'HWLAB_WORKBENCH_SSE_HEARTBEAT_MS', 'HWLAB_WORKBENCH_SSE_DRAIN_TIMEOUT_MS']) || codeAgentRuntimeChanged;",
|
||||
" }",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_TRANSACTIONAL_PROJECTOR_ENABLED', String(kafka.enabled && kafka.features.transactionalProjector)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_KAFKA_PROJECTION_OUTBOX_RELAY_ENABLED', String(kafka.enabled && kafka.features.projectionOutboxRelay)) || codeAgentRuntimeChanged;",
|
||||
" codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_WORKBENCH_PROJECTION_REALTIME_ENABLED', String(kafka.enabled && kafka.features.projectionRealtime)) || codeAgentRuntimeChanged;",
|
||||
" }",
|
||||
" }",
|
||||
" }",
|
||||
@@ -2270,12 +2307,6 @@ export function nodeRuntimePipelinePostprocessScript(): string[] {
|
||||
"function cloudWebRuntimeEnvEntries() {",
|
||||
" const exposure = overlay.publicExposure;",
|
||||
" const entries = !exposure || !Array.isArray(exposure.extraProxies) ? [] : exposure.extraProxies.filter((proxy) => proxy && proxy.cloudWebEnvName && proxy.publicBaseUrl).map((proxy) => ({ name: String(proxy.cloudWebEnvName), value: String(proxy.publicBaseUrl) }));",
|
||||
" const kafka = overlay.codeAgentRuntime && overlay.codeAgentRuntime.kafkaEventBridge;",
|
||||
" if (kafka) {",
|
||||
" entries.push({ name: 'HWLAB_WORKBENCH_LIVE_KAFKA_SSE_ENABLED', value: String(kafka.enabled && kafka.features.liveKafkaSse) });",
|
||||
" entries.push({ name: 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_ENABLED', value: String(kafka.enabled && kafka.features.kafkaRefreshReplay) });",
|
||||
" entries.push({ name: 'HWLAB_WORKBENCH_PROJECTION_REALTIME_ENABLED', value: String(kafka.enabled && kafka.features.projectionRealtime) });",
|
||||
" }",
|
||||
" return entries;",
|
||||
"}",
|
||||
"function workloadRef(item, file, container) { return { file, kind: item && item.kind, name: item && item.metadata && item.metadata.name, container: container && container.name }; }",
|
||||
@@ -2349,31 +2380,14 @@ export function nodeRuntimePipelinePostprocessScript(): string[] {
|
||||
" if (codeAgentRuntime.kafkaEventBridge) {",
|
||||
" const kafka = codeAgentRuntime.kafkaEventBridge;",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_ENABLED', String(kafka.enabled));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_AGENTRUN_EVENT_CONSUME_ENABLED', String(kafka.enabled && (kafka.features.directPublish || kafka.features.transactionalProjector)));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_AGENTRUN_EVENT_CONSUME_ENABLED', String(kafka.enabled));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_BOOTSTRAP_SERVERS', String(kafka.bootstrapServers));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_STDIO_TOPIC', String(kafka.stdioTopic));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_AGENTRUN_EVENT_TOPIC', String(kafka.agentRunEventTopic));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_EVENT_TOPIC', String(kafka.hwlabEventTopic));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_CLIENT_ID', String(kafka.clientId));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_AGENTRUN_EVENT_GROUP_ID', String(kafka.directPublishConsumerGroupId));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_PROJECTOR_GROUP_ID', String(kafka.transactionalProjectorConsumerGroupId));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_HWLAB_EVENT_GROUP_ID', String(kafka.hwlabEventConsumerGroupId));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_DIRECT_PUBLISH_ENABLED', String(kafka.enabled && kafka.features.directPublish));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_WORKBENCH_LIVE_KAFKA_SSE_ENABLED', String(kafka.enabled && kafka.features.liveKafkaSse));",
|
||||
" const refreshReplayEnabled = kafka.enabled && kafka.features.kafkaRefreshReplay;",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_ENABLED', String(refreshReplayEnabled));",
|
||||
" if (refreshReplayEnabled) {",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_GROUP_PREFIX', String(kafka.refreshReplay.groupIdPrefix));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_TIMEOUT_MS', String(kafka.refreshReplay.timeoutMs));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_SCAN_LIMIT', String(kafka.refreshReplay.scanLimit));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_MATCHED_EVENT_LIMIT', String(kafka.refreshReplay.matchedEventLimit));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_LIVE_BUFFER_LIMIT', String(kafka.refreshReplay.liveBufferLimit));",
|
||||
" } else {",
|
||||
" for (const envName of ['HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_GROUP_PREFIX', 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_TIMEOUT_MS', 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_SCAN_LIMIT', 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_MATCHED_EVENT_LIMIT', 'HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_LIVE_BUFFER_LIMIT']) checkCodeAgentRuntimeAbsent(item, file, container, envName);",
|
||||
" }",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_TRANSACTIONAL_PROJECTOR_ENABLED', String(kafka.enabled && kafka.features.transactionalProjector));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_KAFKA_PROJECTION_OUTBOX_RELAY_ENABLED', String(kafka.enabled && kafka.features.projectionOutboxRelay));",
|
||||
" checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_WORKBENCH_PROJECTION_REALTIME_ENABLED', String(kafka.enabled && kafka.features.projectionRealtime));",
|
||||
" }",
|
||||
" }",
|
||||
" }",
|
||||
@@ -2407,7 +2421,6 @@ export function nodeRuntimePipelinePostprocessScript(): string[] {
|
||||
"if (workloadCheck.wrongCodeAgentRuntimeEnvs.length > 0) fail('code-agent-runtime-env-mismatch', { refs: workloadCheck.wrongCodeAgentRuntimeEnvs.slice(0, 12), count: workloadCheck.wrongCodeAgentRuntimeEnvs.length });",
|
||||
"if (overlay.codeAgentRuntime && overlay.codeAgentRuntime.enabled) checks.push('code-agent-runtime-env');",
|
||||
"if (workloadCheck.wrongCloudWebRuntimeEnvs.length > 0) fail('cloud-web-runtime-env-mismatch', { refs: workloadCheck.wrongCloudWebRuntimeEnvs.slice(0, 12), count: workloadCheck.wrongCloudWebRuntimeEnvs.length });",
|
||||
"if (cloudWebRuntimeEnvEntries().length > 0) checks.push('cloud-web-runtime-env');",
|
||||
"const pg = overlay.externalPostgres;",
|
||||
"if (pg && pg.serviceName) {",
|
||||
" const access = pg.runtimeAccess || { endpointAddress: pg.endpointAddress, port: pg.port };",
|
||||
@@ -2528,8 +2541,8 @@ export function nodeRuntimePipelinePostprocessScript(): string[] {
|
||||
" return next;",
|
||||
" });",
|
||||
" result = result.replace(/(node scripts\\/run-bun\\.mjs scripts\\/gitops-render\\.mjs[^\\n]*--use-deploy-images[^\\n]*)/g, (match) => {",
|
||||
" if (match.includes('--check')) return runtimeGitopsVerifyScript();",
|
||||
" return `${match}\\n${[runtimePathOverlayScript(), runtimeGitopsPostprocessScript()].filter(Boolean).join('\\n')}`;",
|
||||
" if (match.includes('--check')) return match;",
|
||||
" return `${match}\\n${featureConfigSchemaValidationScript()}\\n${runtimePathOverlayScript()}`;",
|
||||
" });",
|
||||
" result = result.replace(/node scripts\\/run-bun\\.mjs scripts\\/gitops-render\\.mjs([^\\n]*?)--out \"\\$render_check_dir\"/g, (match) => match.includes('--gitops-root ') ? match : `${match} --gitops-root ${JSON.stringify(overlay.gitopsRoot)} --node ${shellSingle(overlay.nodeId)} --git-read-url ${shellSingle(overlay.gitReadUrl)} --git-write-url ${shellSingle(overlay.gitWriteUrl)} --runtime-endpoint ${shellSingle(overlay.publicApiUrl)} --web-endpoint ${shellSingle(overlay.publicWebUrl)}`);",
|
||||
" validatePrepareSourceDependencyScript(result);",
|
||||
@@ -2887,9 +2900,12 @@ function runtimeGitopsPipelineGuardScript(): string[] {
|
||||
"runtime_gitops_guard_dir=\"$render_dir/.unidesk-runtime-gitops\"",
|
||||
"mkdir -p \"$runtime_gitops_guard_dir\"",
|
||||
...writeRuntimeGitopsNativeScript("runtime-gitops-pipeline-guard.mjs", runtimeGitopsPipelineGuardNativeScript, "UNIDESK_RUNTIME_GITOPS_PIPELINE_GUARD_MJS"),
|
||||
...writeRuntimeGitopsNativeScript("runtime-gitops-scripts-configmap.mjs", runtimeGitopsScriptsConfigMapNativeScript, "UNIDESK_RUNTIME_GITOPS_SCRIPTS_CONFIGMAP_MJS"),
|
||||
...writeRuntimeGitopsNativeScript("runtime-gitops-observability.mjs", runtimeGitopsObservabilityNativeScript, "UNIDESK_RUNTIME_GITOPS_OBSERVABILITY_MJS"),
|
||||
...writeRuntimeGitopsNativeScript("runtime-gitops-postprocess.mjs", runtimeGitopsPostprocessNativeScript, "UNIDESK_RUNTIME_GITOPS_POSTPROCESS_MJS"),
|
||||
...writeRuntimeGitopsNativeScript("runtime-gitops-verify.mjs", runtimeGitopsVerifyNativeScript, "UNIDESK_RUNTIME_GITOPS_VERIFY_MJS"),
|
||||
...writeRuntimeGitopsNativeScript("feature-config-schema-warning.mjs", featureConfigSchemaWarningNativeScript, "UNIDESK_FEATURE_CONFIG_SCHEMA_WARNING_MJS"),
|
||||
...writeRuntimeGitopsNativeScript("ajv2020.min.js", ajv2020BundleScript, "UNIDESK_AJV2020_MIN_JS"),
|
||||
[
|
||||
"UNIDESK_RUNTIME_GITOPS_OVERLAY_B64=\"$overlay_b64\"",
|
||||
"node \"$runtime_gitops_guard_dir/runtime-gitops-pipeline-guard.mjs\"",
|
||||
|
||||
@@ -3,11 +3,13 @@ import { mkdtemp, writeFile } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
import { test } from "bun:test";
|
||||
import { readFileSync } from "node:fs";
|
||||
|
||||
import { hwlabRuntimeLaneSpecForNode } from "../hwlab-node-lanes";
|
||||
import { rootPath } from "../config";
|
||||
import { buildWebObserveCommandVisibility, nodeWebProbeRealtimeFanoutProfiles, nodeWebProbeWorkbenchKafkaDebugReplay, nodeWebProbeWorkbenchTraceReadability, resolveWebObserveActionJson } from "./web-probe-observe-actions";
|
||||
|
||||
test("realtime fanout runner contract derives topics, groups, and independent capabilities from owning YAML", () => {
|
||||
test("realtime authority runner contract derives topics, groups, and transactional capabilities from owning YAML", () => {
|
||||
const profiles = nodeWebProbeRealtimeFanoutProfiles(hwlabRuntimeLaneSpecForNode("v03", "NC01"));
|
||||
const expectedKafka = profiles["pure-kafka-live"]?.expectedKafka as Record<string, any>;
|
||||
assert.deepEqual(expectedKafka.topics, {
|
||||
@@ -16,17 +18,34 @@ test("realtime fanout runner contract derives topics, groups, and independent ca
|
||||
hwlab: "hwlab.event.v1",
|
||||
});
|
||||
assert.deepEqual(expectedKafka.groups, {
|
||||
directPublish: "hwlab-v03-agentrun-event-direct-publish",
|
||||
transactionalProjector: "hwlab-v03-agentrun-event-projector",
|
||||
liveSse: "hwlab-v03-workbench-live-sse",
|
||||
});
|
||||
assert.deepEqual(expectedKafka.capabilities, {
|
||||
directPublish: true,
|
||||
liveKafkaSse: true,
|
||||
kafkaRefreshReplay: true,
|
||||
transactionalProjector: false,
|
||||
projectionOutboxRelay: false,
|
||||
projectionRealtime: false,
|
||||
transactionalProjector: true,
|
||||
projectionOutboxRelay: true,
|
||||
projectionRealtime: true,
|
||||
});
|
||||
const kafka = hwlabRuntimeLaneSpecForNode("v03", "NC01").codeAgentRuntime?.kafkaEventBridge;
|
||||
assert.deepEqual(kafka?.transactionalProjector, { heartbeatIntervalMs: 2_000 });
|
||||
assert.deepEqual(kafka?.projectionOutboxRelay, {
|
||||
intervalMs: 250,
|
||||
batchSize: 100,
|
||||
leaseMs: 30_000,
|
||||
sendTimeoutMs: 10_000,
|
||||
retryBackoffMs: 1_000,
|
||||
});
|
||||
assert.deepEqual(kafka?.projectionRealtime, {
|
||||
outboxTailBatchSize: 100,
|
||||
sseHeartbeatMs: 15_000,
|
||||
sseDrainTimeoutMs: 2_500,
|
||||
});
|
||||
assert.deepEqual(kafka?.healthThresholds, {
|
||||
consumerLagWarning: 0,
|
||||
outboxBacklogWarning: 0,
|
||||
retryCountWarning: 0,
|
||||
failedInboxWarning: 0,
|
||||
dlqWarning: 0,
|
||||
});
|
||||
assert.deepEqual(profiles["pure-kafka-live"]?.requiredEventTypes, {
|
||||
agentrun: ["user_message", "assistant_message", "terminal_status"],
|
||||
@@ -38,6 +57,16 @@ test("realtime fanout runner contract derives topics, groups, and independent ca
|
||||
});
|
||||
});
|
||||
|
||||
test("realtime authority parser and inline render expose no direct authority or duplicate native postprocess execution", () => {
|
||||
const laneSource = readFileSync(rootPath("scripts", "src", "hwlab-node-lanes.ts"), "utf8");
|
||||
const renderSource = readFileSync(rootPath("scripts", "src", "hwlab-node", "render.ts"), "utf8");
|
||||
assert.doesNotMatch(laneSource, /direct-live/u);
|
||||
assert.equal(renderSource.includes("UNIDESK_RUNTIME_GITOPS_RUNTIME_PATH"), false);
|
||||
assert.equal(renderSource.includes('UNIDESK_RUNTIME_GITOPS_OVERLAY_B64="$overlay_b64" UNIDESK_RUNTIME_GITOPS_RUNTIME_PATH'), false);
|
||||
assert.match(renderSource, /runtimeGitopsPostprocessScript\(\)/u);
|
||||
assert.match(renderSource, /writeRuntimeGitopsNativeScript\("runtime-gitops-postprocess\.mjs"/u);
|
||||
});
|
||||
|
||||
test("Workbench Kafka debug replay runner contract is derived from owning YAML", () => {
|
||||
assert.deepEqual(nodeWebProbeWorkbenchKafkaDebugReplay(hwlabRuntimeLaneSpecForNode("v03", "NC01")), {
|
||||
enabled: true,
|
||||
|
||||
@@ -23,7 +23,11 @@ export function nodeWebProbeRealtimeFanoutProfiles(spec: HwlabRuntimeLaneSpec):
|
||||
if (Object.keys(profiles).length === 0) return {};
|
||||
const kafka = spec.codeAgentRuntime?.kafkaEventBridge;
|
||||
if (kafka === undefined) throw new Error("realtimeFanoutProfiles requires codeAgentRuntime.kafkaEventBridge in the owning YAML");
|
||||
const capabilities = Object.fromEntries(Object.entries(kafka.features).map(([name, enabled]) => [name, kafka.enabled && enabled]));
|
||||
const capabilities = {
|
||||
transactionalProjector: kafka.enabled,
|
||||
projectionOutboxRelay: kafka.enabled,
|
||||
projectionRealtime: kafka.enabled,
|
||||
};
|
||||
return Object.fromEntries(Object.entries(profiles).map(([id, profile]) => {
|
||||
if (profile.businessEvent !== kafka.hwlabEventTopic) {
|
||||
throw new Error(`realtimeFanoutProfiles.${id}.businessEvent must match codeAgentRuntime.kafkaEventBridge.hwlabEventTopic`);
|
||||
@@ -38,7 +42,6 @@ export function nodeWebProbeRealtimeFanoutProfiles(spec: HwlabRuntimeLaneSpec):
|
||||
hwlab: kafka.hwlabEventTopic,
|
||||
},
|
||||
groups: {
|
||||
directPublish: kafka.directPublishConsumerGroupId,
|
||||
transactionalProjector: kafka.transactionalProjectorConsumerGroupId,
|
||||
liveSse: kafka.hwlabEventConsumerGroupId,
|
||||
},
|
||||
|
||||
@@ -1482,6 +1482,7 @@ export function nodeRuntimeCodeAgentRuntimeStatus(spec: HwlabRuntimeLaneSpec, na
|
||||
const apiKey = secretKeyStatus(spec, runtime.apiKeySecretName, runtime.apiKeySecretKey);
|
||||
const cloudApiEnv = nodeRuntimeCodeAgentCloudApiEnvStatus(spec, runtime);
|
||||
const cloudWebEnv = nodeRuntimeCodeAgentCloudWebEnvStatus(spec, runtime);
|
||||
const kafkaAuthority = nodeRuntimeKafkaAuthorityStatus(spec, runtime);
|
||||
const ready = runnerNamespace.exitCode === 0
|
||||
&& secretNamespace.exitCode === 0
|
||||
&& managerNamespace.exitCode === 0
|
||||
@@ -1538,12 +1539,73 @@ export function nodeRuntimeCodeAgentRuntimeStatus(spec: HwlabRuntimeLaneSpec, na
|
||||
apiKey,
|
||||
cloudApiEnv,
|
||||
cloudWebEnv,
|
||||
kafkaAuthority,
|
||||
repoUrlFrom: runtime.repoUrlFrom,
|
||||
providerIdFrom: runtime.providerIdFrom,
|
||||
valuesPrinted: false,
|
||||
};
|
||||
}
|
||||
|
||||
function nodeRuntimeKafkaAuthorityStatus(spec: HwlabRuntimeLaneSpec, runtime: NonNullable<HwlabRuntimeLaneSpec["codeAgentRuntime"]>): Record<string, unknown> {
|
||||
const kafka = runtime.kafkaEventBridge;
|
||||
if (kafka === undefined || kafka.enabled === false) return { required: false, authority: kafka === undefined ? null : "transactional-projection", valuesPrinted: false };
|
||||
const healthUrl = `${spec.publicApiUrl.replace(/\/+$/u, "")}/health/ready`;
|
||||
const result = runCommand(["curl", "-k", "-sS", "--connect-timeout", "5", "--max-time", "12", healthUrl], repoRoot, { timeoutMs: 15_000 });
|
||||
let health: Record<string, unknown> = {};
|
||||
try {
|
||||
health = result.exitCode === 0 ? record(JSON.parse(result.stdout)) : {};
|
||||
} catch {
|
||||
health = {};
|
||||
}
|
||||
const projector = record(health.kafkaProjector);
|
||||
const components = Array.isArray(projector.components) ? projector.components.map(record) : [];
|
||||
const observations = [projector, ...components];
|
||||
const consumerLag = observations.map((item) => record(item.consumerLag).total).find((value) => typeof value === "number") ?? null;
|
||||
const backlogCount = observations.map((item) => item.backlogCount).find((value) => typeof value === "number") ?? null;
|
||||
const retryCount = observations.map((item) => item.retryCount).find((value) => typeof value === "number") ?? null;
|
||||
const failedInboxCount = observations.map((item) => item.failedInboxCount).find((value) => typeof value === "number") ?? null;
|
||||
const dlqCount = observations.map((item) => item.dlqCount).find((value) => typeof value === "number") ?? null;
|
||||
const thresholds = kafka.healthThresholds;
|
||||
const warningReasons = [
|
||||
typeof consumerLag === "number" && consumerLag > thresholds.consumerLagWarning ? "consumer-lag" : null,
|
||||
typeof backlogCount === "number" && backlogCount > thresholds.outboxBacklogWarning ? "outbox-backlog" : null,
|
||||
typeof retryCount === "number" && retryCount > thresholds.retryCountWarning ? "outbox-retry" : null,
|
||||
typeof failedInboxCount === "number" && failedInboxCount > thresholds.failedInboxWarning ? "failed-inbox" : null,
|
||||
typeof dlqCount === "number" && dlqCount > thresholds.dlqWarning ? "dlq" : null,
|
||||
].filter((value): value is string => value !== null);
|
||||
return {
|
||||
required: true,
|
||||
authority: "transactional-projection",
|
||||
fixedGroups: {
|
||||
transactionalProjector: kafka.transactionalProjectorConsumerGroupId,
|
||||
liveSse: kafka.hwlabEventConsumerGroupId,
|
||||
},
|
||||
capabilities: {
|
||||
transactionalProjector: true,
|
||||
projectionOutboxRelay: true,
|
||||
projectionRealtime: true,
|
||||
},
|
||||
liveReplay: {
|
||||
live: true,
|
||||
replay: true,
|
||||
cursor: "projection-outbox-seq",
|
||||
},
|
||||
healthObserved: Object.keys(projector).length > 0,
|
||||
healthStatus: projector.status ?? null,
|
||||
consumerLag,
|
||||
backlogCount,
|
||||
retryCount,
|
||||
failedInboxCount,
|
||||
dlqCount,
|
||||
thresholds,
|
||||
warning: warningReasons.length > 0,
|
||||
warningReasons,
|
||||
blocking: false,
|
||||
result: compactRuntimeCommand(result),
|
||||
valuesPrinted: false,
|
||||
};
|
||||
}
|
||||
|
||||
function nodeRuntimeCodeAgentManagerTarget(managerUrl: string, fallbackNamespace: string): { namespace: string; serviceName: string } {
|
||||
let parsed: URL | null = null;
|
||||
try {
|
||||
@@ -1632,47 +1694,55 @@ function nodeRuntimeCodeAgentCloudApiEnvStatus(spec: HwlabRuntimeLaneSpec, runti
|
||||
const kafkaEventBridge = runtime.kafkaEventBridge;
|
||||
if (kafkaEventBridge !== undefined) {
|
||||
expectValue("HWLAB_KAFKA_ENABLED", String(kafkaEventBridge.enabled));
|
||||
expectValue("HWLAB_KAFKA_AGENTRUN_EVENT_CONSUME_ENABLED", String(kafkaEventBridge.enabled && (kafkaEventBridge.features.directPublish || kafkaEventBridge.features.transactionalProjector)));
|
||||
expectValue("HWLAB_KAFKA_AGENTRUN_EVENT_CONSUME_ENABLED", String(kafkaEventBridge.enabled));
|
||||
expectValue("HWLAB_KAFKA_BOOTSTRAP_SERVERS", kafkaEventBridge.bootstrapServers);
|
||||
expectValue("HWLAB_KAFKA_STDIO_TOPIC", kafkaEventBridge.stdioTopic);
|
||||
expectValue("HWLAB_KAFKA_AGENTRUN_EVENT_TOPIC", kafkaEventBridge.agentRunEventTopic);
|
||||
expectValue("HWLAB_KAFKA_EVENT_TOPIC", kafkaEventBridge.hwlabEventTopic);
|
||||
expectValue("HWLAB_KAFKA_CLIENT_ID", kafkaEventBridge.clientId);
|
||||
expectValue("HWLAB_KAFKA_AGENTRUN_EVENT_GROUP_ID", kafkaEventBridge.directPublishConsumerGroupId);
|
||||
expectValue("HWLAB_KAFKA_PROJECTOR_GROUP_ID", kafkaEventBridge.transactionalProjectorConsumerGroupId);
|
||||
expectValue("HWLAB_KAFKA_HWLAB_EVENT_GROUP_ID", kafkaEventBridge.hwlabEventConsumerGroupId);
|
||||
expectValue("HWLAB_KAFKA_DIRECT_PUBLISH_ENABLED", String(kafkaEventBridge.enabled && kafkaEventBridge.features.directPublish));
|
||||
expectValue("HWLAB_WORKBENCH_LIVE_KAFKA_SSE_ENABLED", String(kafkaEventBridge.enabled && kafkaEventBridge.features.liveKafkaSse));
|
||||
const refreshReplayEnabled = kafkaEventBridge.enabled && kafkaEventBridge.features.kafkaRefreshReplay;
|
||||
expectValue("HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_ENABLED", String(refreshReplayEnabled));
|
||||
const refreshReplayEnvNames = [
|
||||
"HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_GROUP_PREFIX",
|
||||
"HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_TIMEOUT_MS",
|
||||
"HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_SCAN_LIMIT",
|
||||
"HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_MATCHED_EVENT_LIMIT",
|
||||
"HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_LIVE_BUFFER_LIMIT",
|
||||
];
|
||||
if (refreshReplayEnabled) {
|
||||
const refreshReplay = kafkaEventBridge.refreshReplay;
|
||||
if (refreshReplay === undefined) throw new Error("codeAgentRuntime.kafkaEventBridge.refreshReplay is required when Kafka refresh replay is enabled");
|
||||
expectValue("HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_GROUP_PREFIX", refreshReplay.groupIdPrefix);
|
||||
expectValue("HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_TIMEOUT_MS", String(refreshReplay.timeoutMs));
|
||||
expectValue("HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_SCAN_LIMIT", String(refreshReplay.scanLimit));
|
||||
expectValue("HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_MATCHED_EVENT_LIMIT", String(refreshReplay.matchedEventLimit));
|
||||
expectValue("HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_LIVE_BUFFER_LIMIT", String(refreshReplay.liveBufferLimit));
|
||||
if (kafkaEventBridge.enabled) {
|
||||
if (kafkaEventBridge.transactionalProjector === undefined) throw new Error("codeAgentRuntime.kafkaEventBridge.transactionalProjector is required when transactional projector is enabled");
|
||||
expectValue("HWLAB_KAFKA_PROJECTOR_HEARTBEAT_INTERVAL_MS", String(kafkaEventBridge.transactionalProjector.heartbeatIntervalMs));
|
||||
} else {
|
||||
for (const name of refreshReplayEnvNames) expectAbsent(name);
|
||||
expectAbsent("HWLAB_KAFKA_PROJECTOR_HEARTBEAT_INTERVAL_MS");
|
||||
}
|
||||
const relayEnvNames = [
|
||||
"HWLAB_KAFKA_OUTBOX_RELAY_INTERVAL_MS",
|
||||
"HWLAB_KAFKA_OUTBOX_RELAY_BATCH_SIZE",
|
||||
"HWLAB_KAFKA_OUTBOX_RELAY_LEASE_MS",
|
||||
"HWLAB_KAFKA_OUTBOX_RELAY_SEND_TIMEOUT_MS",
|
||||
"HWLAB_KAFKA_OUTBOX_RELAY_RETRY_BACKOFF_MS",
|
||||
];
|
||||
if (kafkaEventBridge.enabled) {
|
||||
const relay = kafkaEventBridge.projectionOutboxRelay;
|
||||
if (relay === undefined) throw new Error("codeAgentRuntime.kafkaEventBridge.projectionOutboxRelay is required when projection outbox relay is enabled");
|
||||
expectValue("HWLAB_KAFKA_OUTBOX_RELAY_INTERVAL_MS", String(relay.intervalMs));
|
||||
expectValue("HWLAB_KAFKA_OUTBOX_RELAY_BATCH_SIZE", String(relay.batchSize));
|
||||
expectValue("HWLAB_KAFKA_OUTBOX_RELAY_LEASE_MS", String(relay.leaseMs));
|
||||
expectValue("HWLAB_KAFKA_OUTBOX_RELAY_SEND_TIMEOUT_MS", String(relay.sendTimeoutMs));
|
||||
expectValue("HWLAB_KAFKA_OUTBOX_RELAY_RETRY_BACKOFF_MS", String(relay.retryBackoffMs));
|
||||
} else {
|
||||
for (const name of relayEnvNames) expectAbsent(name);
|
||||
}
|
||||
const projectionRealtimeEnvNames = ["HWLAB_WORKBENCH_OUTBOX_TAIL_BATCH_SIZE", "HWLAB_WORKBENCH_SSE_HEARTBEAT_MS", "HWLAB_WORKBENCH_SSE_DRAIN_TIMEOUT_MS"];
|
||||
if (kafkaEventBridge.enabled) {
|
||||
const realtime = kafkaEventBridge.projectionRealtime;
|
||||
if (realtime === undefined) throw new Error("codeAgentRuntime.kafkaEventBridge.projectionRealtime is required when projection realtime is enabled");
|
||||
expectValue("HWLAB_WORKBENCH_OUTBOX_TAIL_BATCH_SIZE", String(realtime.outboxTailBatchSize));
|
||||
expectValue("HWLAB_WORKBENCH_SSE_HEARTBEAT_MS", String(realtime.sseHeartbeatMs));
|
||||
expectValue("HWLAB_WORKBENCH_SSE_DRAIN_TIMEOUT_MS", String(realtime.sseDrainTimeoutMs));
|
||||
} else {
|
||||
for (const name of projectionRealtimeEnvNames) expectAbsent(name);
|
||||
}
|
||||
expectValue("HWLAB_KAFKA_TRANSACTIONAL_PROJECTOR_ENABLED", String(kafkaEventBridge.enabled && kafkaEventBridge.features.transactionalProjector));
|
||||
expectValue("HWLAB_KAFKA_PROJECTION_OUTBOX_RELAY_ENABLED", String(kafkaEventBridge.enabled && kafkaEventBridge.features.projectionOutboxRelay));
|
||||
expectValue("HWLAB_WORKBENCH_PROJECTION_REALTIME_ENABLED", String(kafkaEventBridge.enabled && kafkaEventBridge.features.projectionRealtime));
|
||||
}
|
||||
return {
|
||||
ready: mismatches.length === 0,
|
||||
deploymentExists: true,
|
||||
deploymentName: "hwlab-cloud-api",
|
||||
containerName: "hwlab-cloud-api",
|
||||
checkedEnvCount: 9 + (kafkaShadowProducer === undefined ? 0 : 5) + (kafkaEventBridge === undefined ? 0 : 21),
|
||||
checkedEnvCount: 9 + (kafkaShadowProducer === undefined ? 0 : 5) + (kafkaEventBridge === undefined ? 0 : 22),
|
||||
envCount: envByName.size,
|
||||
mismatches,
|
||||
result: compactCodeAgentDeploymentProbeResult(envProbe),
|
||||
@@ -1681,53 +1751,9 @@ function nodeRuntimeCodeAgentCloudApiEnvStatus(spec: HwlabRuntimeLaneSpec, runti
|
||||
}
|
||||
|
||||
function nodeRuntimeCodeAgentCloudWebEnvStatus(spec: HwlabRuntimeLaneSpec, runtime: NonNullable<HwlabRuntimeLaneSpec["codeAgentRuntime"]>): Record<string, unknown> {
|
||||
const kafkaEventBridge = runtime.kafkaEventBridge;
|
||||
if (kafkaEventBridge === undefined) return { required: false, ready: true, checkedEnvCount: 0, valuesPrinted: false };
|
||||
const envProbe = runNodeK3sArgs(spec, [
|
||||
"kubectl",
|
||||
"-n",
|
||||
spec.runtimeNamespace,
|
||||
"get",
|
||||
"deployment",
|
||||
"hwlab-cloud-web",
|
||||
"-o",
|
||||
'jsonpath={range .spec.template.spec.containers[?(@.name=="hwlab-cloud-web")].env[*]}{.name}{"\\t"}{.value}{"\\t"}{.valueFrom.secretKeyRef.name}{"\\t"}{.valueFrom.secretKeyRef.key}{"\\n"}{end}',
|
||||
], 60);
|
||||
if (envProbe.exitCode !== 0) {
|
||||
return {
|
||||
required: true,
|
||||
ready: false,
|
||||
deploymentExists: false,
|
||||
mismatches: [{ name: "hwlab-cloud-web", reason: "deployment-missing" }],
|
||||
result: compactCodeAgentDeploymentProbeResult(envProbe),
|
||||
valuesPrinted: false,
|
||||
};
|
||||
}
|
||||
const envByName = parseCodeAgentEnvProbe(envProbe.stdout);
|
||||
const mismatches: Array<Record<string, unknown>> = [];
|
||||
const expectValue = (name: string, expected: string): void => {
|
||||
const item = envByName.get(name);
|
||||
if (item === undefined) {
|
||||
mismatches.push({ name, expected, present: false, kind: "value" });
|
||||
return;
|
||||
}
|
||||
if (item.value !== expected) mismatches.push({ name, expected, value: item.value, present: true, kind: "value" });
|
||||
};
|
||||
expectValue("HWLAB_WORKBENCH_LIVE_KAFKA_SSE_ENABLED", String(kafkaEventBridge.enabled && kafkaEventBridge.features.liveKafkaSse));
|
||||
expectValue("HWLAB_WORKBENCH_KAFKA_REFRESH_REPLAY_ENABLED", String(kafkaEventBridge.enabled && kafkaEventBridge.features.kafkaRefreshReplay));
|
||||
expectValue("HWLAB_WORKBENCH_PROJECTION_REALTIME_ENABLED", String(kafkaEventBridge.enabled && kafkaEventBridge.features.projectionRealtime));
|
||||
return {
|
||||
required: true,
|
||||
ready: mismatches.length === 0,
|
||||
deploymentExists: true,
|
||||
deploymentName: "hwlab-cloud-web",
|
||||
containerName: "hwlab-cloud-web",
|
||||
checkedEnvCount: 3,
|
||||
envCount: envByName.size,
|
||||
mismatches,
|
||||
result: compactCodeAgentDeploymentProbeResult(envProbe),
|
||||
valuesPrinted: false,
|
||||
};
|
||||
void spec;
|
||||
void runtime;
|
||||
return { required: false, ready: true, checkedEnvCount: 0, valuesPrinted: false };
|
||||
}
|
||||
|
||||
type CodeAgentEnvProbeRow = {
|
||||
|
||||
@@ -0,0 +1,123 @@
|
||||
import { expect, test } from "bun:test";
|
||||
import { mkdtempSync, mkdirSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join, resolve } from "node:path";
|
||||
import { spawnSync } from "node:child_process";
|
||||
|
||||
import { resolveAgentRunLaneTarget } from "./agentrun-lanes";
|
||||
import { renderAgentRunPipelineManifest } from "./agentrun-manifests";
|
||||
import { renderPacFeatureConfigSchemaStage } from "./pac-feature-config-schema-stage";
|
||||
|
||||
test("shared stage injects owning YAML OTel values for all three PaC repositories", () => {
|
||||
for (const [repositoryId, consumer] of [
|
||||
["hwlab-nc01-v03", "hwlab-nc01-v03"],
|
||||
["agentrun-nc01-v02", "agentrun-nc01-v02"],
|
||||
["sentinel-nc01-v03", "sentinel-nc01-v03"],
|
||||
] as const) {
|
||||
const stage = renderPacFeatureConfigSchemaStage({
|
||||
repositoryId,
|
||||
consumer,
|
||||
repoDirExpression: "'/workspace/source'",
|
||||
renderedRootExpression: "'/workspace/rendered'",
|
||||
});
|
||||
expect(stage).toContain("feature-config-schema-validation");
|
||||
expect(stage).toContain("cicd.feature_config.schema");
|
||||
expect(stage).toContain("OTEL_EXPORTER_OTLP_TRACES_ENDPOINT='http://otel-collector.platform-infra.svc.cluster.local:4318/v1/traces'");
|
||||
expect(stage).toContain("OTEL_TRACES_SAMPLER_ARG='1'");
|
||||
expect(stage).toContain("OTEL_EXPORTER_TIMEOUT_MS='300'");
|
||||
expect(stage).toContain("NODE_UNIDESK_AJV2020_BUNDLE");
|
||||
expect(stage).not.toContain("process.env.webProbeSentinel");
|
||||
}
|
||||
});
|
||||
|
||||
test("HWLAB, AgentRun, and Sentinel normal stages validate without source workspace node_modules", () => {
|
||||
const root = mkdtempSync(join(tmpdir(), "feature-config-consumers-"));
|
||||
try {
|
||||
const source = join(root, "source");
|
||||
const rendered = join(root, "rendered");
|
||||
const temp = join(root, "tmp");
|
||||
mkdirSync(join(source, "config"), { recursive: true });
|
||||
mkdirSync(rendered, { recursive: true });
|
||||
mkdirSync(temp);
|
||||
writeFileSync(join(source, "config", "feature-config.schema.json"), JSON.stringify({
|
||||
$schema: "https://json-schema.org/draft/2020-12/schema",
|
||||
type: "object",
|
||||
properties: { webProbeSentinel: { type: "boolean", "x-unidesk-feature": "web-probe-sentinel" } },
|
||||
additionalProperties: false,
|
||||
}));
|
||||
writeFileSync(join(rendered, "deployment.json"), JSON.stringify({
|
||||
apiVersion: "apps/v1",
|
||||
kind: "Deployment",
|
||||
spec: { template: { spec: { containers: [{ name: "fixture", env: [{ name: "webProbeSentinel", value: "true" }] }] } } },
|
||||
}));
|
||||
const vendorBundle = resolve(import.meta.dir, "../vendor/ajv-dist/8.17.1/ajv2020.min.js");
|
||||
for (const consumer of [
|
||||
{ repositoryId: "hwlab-nc01-v03", consumer: "hwlab-nc01-v03", ajvBundleExpression: JSON.stringify(vendorBundle) },
|
||||
{ repositoryId: "agentrun-nc01-v02", consumer: "agentrun-nc01-v02" },
|
||||
{ repositoryId: "sentinel-nc01-v03", consumer: "sentinel-nc01-v03" },
|
||||
]) {
|
||||
const stage = renderPacFeatureConfigSchemaStage({
|
||||
...consumer,
|
||||
repoDirExpression: JSON.stringify(source),
|
||||
renderedRootExpression: JSON.stringify(rendered),
|
||||
});
|
||||
const result = spawnSync("sh", [], {
|
||||
input: `set -eu\n${stage}\n`,
|
||||
encoding: "utf8",
|
||||
env: { ...process.env, TMPDIR: temp },
|
||||
});
|
||||
expect(result.status, consumer.consumer).toBe(0);
|
||||
expect(result.stderr, consumer.consumer).toContain('"code":"feature-config-schema-valid"');
|
||||
expect(result.stderr, consumer.consumer).not.toContain("feature-config-validator-unavailable");
|
||||
expect(result.stderr, consumer.consumer).not.toContain("feature-config-validator-process-failure");
|
||||
expect(readdirSync(temp), consumer.consumer).toEqual([]);
|
||||
}
|
||||
} finally {
|
||||
rmSync(root, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
test("embedded node process failure remains a typed warning with zero shell exit", () => {
|
||||
const root = mkdtempSync(join(tmpdir(), "feature-config-stage-"));
|
||||
try {
|
||||
const bin = join(root, "bin");
|
||||
const temp = join(root, "tmp");
|
||||
mkdirSync(bin);
|
||||
mkdirSync(temp);
|
||||
writeFileSync(join(bin, "node"), "#!/bin/sh\nexit 71\n", { mode: 0o755 });
|
||||
const stage = renderPacFeatureConfigSchemaStage({
|
||||
repositoryId: "sentinel-nc01-v03",
|
||||
consumer: "sentinel-nc01-v03",
|
||||
repoDirExpression: "'/workspace/source'",
|
||||
renderedRootExpression: "'/workspace/rendered'",
|
||||
});
|
||||
const result = spawnSync("sh", [], {
|
||||
input: `set -eu\n${stage}\n`,
|
||||
env: { ...process.env, PATH: `${bin}:${process.env.PATH ?? ""}`, TMPDIR: temp },
|
||||
encoding: "utf8",
|
||||
});
|
||||
expect(result.status).toBe(0);
|
||||
expect(result.stderr).toContain("feature-config-validator-process-failure");
|
||||
expect(readdirSync(temp)).toEqual([]);
|
||||
} finally {
|
||||
rmSync(root, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
test("AgentRun normal GitOps publish task contains the shared warning-only stage", () => {
|
||||
const { spec } = resolveAgentRunLaneTarget({ node: "NC01", lane: "nc01-v02" });
|
||||
const pipeline = renderAgentRunPipelineManifest(spec) as Record<string, any>;
|
||||
const scripts = pipeline.spec.tasks.flatMap((task: Record<string, any>) => task.taskSpec.steps.map((step: Record<string, any>) => String(step.script ?? ""))).join("\n");
|
||||
expect(scripts).toContain("UNIDESK_PAC_CONSUMER='agentrun-nc01-v02'");
|
||||
expect(scripts).toContain("feature-config-schema-validation");
|
||||
expect(scripts).toContain("feature-config-validator-process-failure");
|
||||
expect(scripts).toContain("OTEL_EXPORTER_TIMEOUT_MS='300'");
|
||||
expect(scripts).toContain("NODE_UNIDESK_AJV2020_BUNDLE");
|
||||
});
|
||||
|
||||
test("repo-owned schema is Draft 2020-12 with one canonical feature property", () => {
|
||||
const schema = JSON.parse(readFileSync("config/feature-config.schema.json", "utf8"));
|
||||
expect(schema.$schema).toBe("https://json-schema.org/draft/2020-12/schema");
|
||||
expect(schema.properties.webProbeSentinel["x-unidesk-feature"]).toBe("web-probe-sentinel");
|
||||
expect(Object.keys(schema.properties)).toEqual(["webProbeSentinel"]);
|
||||
});
|
||||
@@ -0,0 +1,66 @@
|
||||
import { readFileSync } from "node:fs";
|
||||
|
||||
import { rootPath } from "./config";
|
||||
import { loadCicdOtelRuntimeConfig } from "../native/cicd/otel-runtime-config";
|
||||
|
||||
const validatorSource = readFileSync(rootPath("scripts/native/cicd/feature-config-schema-warning.mjs"), "utf8").trimEnd();
|
||||
const ajv2020BundleSource = readFileSync(rootPath("scripts/vendor/ajv-dist/8.17.1/ajv2020.min.js"), "utf8").trimEnd();
|
||||
|
||||
export interface PacFeatureConfigSchemaStageOptions {
|
||||
readonly repositoryId: string;
|
||||
readonly consumer: string;
|
||||
readonly repoDirExpression: string;
|
||||
readonly renderedRootExpression: string;
|
||||
readonly ajvBundleExpression?: string | null;
|
||||
}
|
||||
|
||||
export function renderPacFeatureConfigSchemaStage(options: PacFeatureConfigSchemaStageOptions): string {
|
||||
const otel = loadCicdOtelRuntimeConfig(options.repositoryId);
|
||||
const materializeBundle = options.ajvBundleExpression === undefined || options.ajvBundleExpression === null;
|
||||
return [
|
||||
"feature_config_schema_started_ms=\"$(date +%s%3N 2>/dev/null || date +%s000)\"",
|
||||
`export UNIDESK_FEATURE_CONFIG_REPO_DIR=${options.repoDirExpression}`,
|
||||
`export UNIDESK_FEATURE_CONFIG_RENDERED_ROOT=${options.renderedRootExpression}`,
|
||||
`export UNIDESK_PAC_CONSUMER=${shellSingle(options.consumer)}`,
|
||||
`export OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=${shellSingle(otel.endpoint)}`,
|
||||
`export OTEL_SERVICE_NAME=${shellSingle(otel.serviceName)}`,
|
||||
`export OTEL_TRACES_SAMPLER_ARG=${shellSingle(String(otel.samplingRatio))}`,
|
||||
`export OTEL_EXPORTER_TIMEOUT_MS=${shellSingle(String(otel.timeoutMs))}`,
|
||||
...(materializeBundle
|
||||
? [
|
||||
"feature_config_ajv_bundle=''",
|
||||
"if feature_config_ajv_bundle=\"$(mktemp \"${TMPDIR:-/tmp}/unidesk-ajv2020.XXXXXX\" 2>/dev/null)\"; then",
|
||||
" if ! cat >\"$feature_config_ajv_bundle\" <<'NODE_UNIDESK_AJV2020_BUNDLE'",
|
||||
ajv2020BundleSource,
|
||||
"NODE_UNIDESK_AJV2020_BUNDLE",
|
||||
" then",
|
||||
" rm -f \"$feature_config_ajv_bundle\" || true",
|
||||
" feature_config_ajv_bundle=''",
|
||||
" fi",
|
||||
"fi",
|
||||
"export UNIDESK_AJV2020_BUNDLE=\"${feature_config_ajv_bundle:-${TMPDIR:-/tmp}/unidesk-ajv2020-unavailable}\"",
|
||||
]
|
||||
: [`export UNIDESK_AJV2020_BUNDLE=${options.ajvBundleExpression}`]),
|
||||
"if ! node --input-type=module <<'NODE_UNIDESK_FEATURE_CONFIG_SCHEMA'",
|
||||
validatorSource,
|
||||
"await runFeatureConfigSchemaValidation({",
|
||||
" repoDir: process.env.UNIDESK_FEATURE_CONFIG_REPO_DIR,",
|
||||
" renderedRoot: process.env.UNIDESK_FEATURE_CONFIG_RENDERED_ROOT,",
|
||||
" consumer: process.env.UNIDESK_PAC_CONSUMER,",
|
||||
"});",
|
||||
"NODE_UNIDESK_FEATURE_CONFIG_SCHEMA",
|
||||
"then",
|
||||
" printf '{\"event\":\"feature-config-schema-validation\",\"warning\":true,\"blocking\":false,\"code\":\"feature-config-validator-process-failure\",\"mutation\":false,\"valuesPrinted\":false}\\n' >&2",
|
||||
"fi",
|
||||
...(materializeBundle ? ["if [ -n \"$feature_config_ajv_bundle\" ]; then rm -f \"$feature_config_ajv_bundle\" || true; fi"] : []),
|
||||
"if command -v ci_timing_emit >/dev/null 2>&1; then",
|
||||
" ci_timing_emit feature-config-schema-validation succeeded \"$feature_config_schema_started_ms\"",
|
||||
"else",
|
||||
" printf '{\"event\":\"ci.stage.timing\",\"stage\":\"feature-config-schema-validation\",\"status\":\"succeeded\",\"blocking\":false}\\n' >&2",
|
||||
"fi",
|
||||
].join("\n");
|
||||
}
|
||||
|
||||
function shellSingle(value: string): string {
|
||||
return `'${value.replaceAll("'", `'"'"'`)}'`;
|
||||
}
|
||||
@@ -11,6 +11,9 @@ const require = createRequire(import.meta.url);
|
||||
const { parsePacLogRecords } = require("../native/cicd/pac-status-evaluator.cjs") as {
|
||||
parsePacLogRecords(value: string): Array<Record<string, unknown>>;
|
||||
};
|
||||
const { extractPacSourceObservation } = require("../native/cicd/pac-status-evaluator.cjs") as {
|
||||
extractPacSourceObservation(records: Array<Record<string, unknown>>, sourceCommit: string): Record<string, unknown>;
|
||||
};
|
||||
|
||||
describe("PaC 失败证据合同", () => {
|
||||
test("真实 sentinel TaskRun 日志保留 typed 首断点", () => {
|
||||
@@ -52,6 +55,39 @@ describe("PaC 失败证据合同", () => {
|
||||
expect(compactStatus).toMatchObject({ artifact: { traceId: row.traceId, firstBreak: row.firstBreak, error: row.error } });
|
||||
});
|
||||
|
||||
test("feature-config warning 在 status、history、debug-step 同构有界投影", () => {
|
||||
const observation = extractPacSourceObservation([
|
||||
{
|
||||
event: "pac-delivery-plan",
|
||||
sourceCommitId: "a".repeat(40),
|
||||
affectedServices: [],
|
||||
rolloutServices: [],
|
||||
buildServices: [],
|
||||
reusedServices: [],
|
||||
},
|
||||
{
|
||||
event: "feature-config-schema-validation",
|
||||
warning: true,
|
||||
blocking: false,
|
||||
code: "feature-config-input-missing",
|
||||
schemaPath: "config/feature-config.schema.json",
|
||||
errorCount: 1,
|
||||
firstError: "rendered workload candidate snapshot is missing",
|
||||
mutation: false,
|
||||
valuesPrinted: false,
|
||||
},
|
||||
]);
|
||||
const expected = "feature-config-schema: warning=true blocking=false code=feature-config-input-missing path=config/feature-config.schema.json errors=1 first=rendered workload candidate snapshot is missing";
|
||||
const history = renderHistory({ rows: [{ id: "run", sourceObservation: observation }], detailId: "run", config: {}, historyErrors: [], next: {} }).renderedText;
|
||||
const debug = renderDebugStep({ realRun: { found: true, pipelineRun: {}, artifact: { sourceObservation: observation } }, checks: [], target: {}, next: {} }).renderedText;
|
||||
const status = renderStatus({ summary: { latestPipelineRun: {}, artifact: {}, diagnostics: {}, sourceObservation: observation }, consumer: {}, deliveryAuthority: {}, config: {}, coverage: [], target: {}, next: {} }).renderedText;
|
||||
expect(status).toContain(expected);
|
||||
expect(debug).toContain(expected);
|
||||
expect(history).toContain("featureConfigCode");
|
||||
expect(history).toContain("feature-config-input-missing");
|
||||
expect(JSON.stringify(observation)).not.toContain("process.env");
|
||||
});
|
||||
|
||||
test("collector 遍历全部 matching TaskRun，terminal record 仍限定合同任务", () => {
|
||||
const remote = readFileSync(resolve(import.meta.dir, "platform-infra-pipelines-as-code-remote.sh"), "utf8");
|
||||
expect(remote).toContain("for (const item of matching)");
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
import { expect, test } from "bun:test";
|
||||
|
||||
import { featureConfigSchemaHistoryFields, renderFeatureConfigSchemaLine } from "./platform-infra-pac-feature-config-projection";
|
||||
|
||||
test("status and debug share one bounded feature config line", () => {
|
||||
const observation = {
|
||||
warning: true,
|
||||
blocking: false,
|
||||
code: "feature-config-value-mismatch",
|
||||
schemaPath: "config/feature-config.schema.json",
|
||||
errorCount: 2,
|
||||
firstError: " /webProbeSentinel required must have required property ",
|
||||
};
|
||||
const line = renderFeatureConfigSchemaLine(observation);
|
||||
expect(line).toBe(" feature-config-schema: warning=true blocking=false code=feature-config-value-mismatch path=config/feature-config.schema.json errors=2 first=/webProbeSentinel required must have required property");
|
||||
expect(line.length).toBeLessThan(300);
|
||||
});
|
||||
|
||||
test("history uses the same bounded observation fields", () => {
|
||||
expect(featureConfigSchemaHistoryFields({
|
||||
warning: true,
|
||||
blocking: false,
|
||||
code: "feature-config-schema-missing",
|
||||
schemaPath: "config/feature-config.schema.json",
|
||||
errorCount: 1,
|
||||
firstError: "schema file is missing",
|
||||
})).toEqual([
|
||||
["featureConfigWarning", "true"],
|
||||
["featureConfigBlocking", "false"],
|
||||
["featureConfigCode", "feature-config-schema-missing"],
|
||||
["featureConfigSchemaPath", "config/feature-config.schema.json"],
|
||||
["featureConfigErrorCount", "1"],
|
||||
["featureConfigFirstError", "schema file is missing"],
|
||||
]);
|
||||
});
|
||||
@@ -0,0 +1,35 @@
|
||||
export function renderFeatureConfigSchemaLine(value: unknown): string {
|
||||
const featureConfigSchema = record(value);
|
||||
return ` feature-config-schema: warning=${boolText(featureConfigSchema.warning)} blocking=${boolText(featureConfigSchema.blocking)} code=${stringValue(featureConfigSchema.code)} path=${stringValue(featureConfigSchema.schemaPath)} errors=${stringValue(featureConfigSchema.errorCount)} first=${compactLine(stringValue(featureConfigSchema.firstError))}`;
|
||||
}
|
||||
|
||||
export function featureConfigSchemaHistoryFields(value: unknown): string[][] {
|
||||
const featureConfigSchema = record(value);
|
||||
return [
|
||||
["featureConfigWarning", stringValue(featureConfigSchema.warning)],
|
||||
["featureConfigBlocking", stringValue(featureConfigSchema.blocking)],
|
||||
["featureConfigCode", stringValue(featureConfigSchema.code)],
|
||||
["featureConfigSchemaPath", stringValue(featureConfigSchema.schemaPath)],
|
||||
["featureConfigErrorCount", stringValue(featureConfigSchema.errorCount)],
|
||||
["featureConfigFirstError", compactLine(stringValue(featureConfigSchema.firstError))],
|
||||
];
|
||||
}
|
||||
|
||||
function record(value: unknown): Record<string, unknown> {
|
||||
return typeof value === "object" && value !== null && !Array.isArray(value) ? value as Record<string, unknown> : {};
|
||||
}
|
||||
|
||||
function stringValue(value: unknown, fallback = "-"): string {
|
||||
if (typeof value === "string" && value.length > 0) return value;
|
||||
if (typeof value === "number" || typeof value === "boolean") return String(value);
|
||||
return fallback;
|
||||
}
|
||||
|
||||
function boolText(value: unknown): string {
|
||||
return value === true ? "true" : "false";
|
||||
}
|
||||
|
||||
function compactLine(value: string): string {
|
||||
const trimmed = value.replace(/\s+/gu, " ").trim();
|
||||
return trimmed.length > 0 ? trimmed.slice(0, 120) : "-";
|
||||
}
|
||||
@@ -7,7 +7,7 @@ import { resolve } from "node:path";
|
||||
import { rootPath } from "./config";
|
||||
import { applyNodeRuntimeDeployYamlOverlay, nodeRuntimeDeployYamlOverlayShellScript } from "./hwlab-node/deploy-overlay";
|
||||
import { hwlabRuntimePipelineProvenance } from "./hwlab-node/pipeline-provenance";
|
||||
import { nodeRuntimePipelineProvenancePostprocessScript } from "./hwlab-node/render";
|
||||
import { nodeRuntimeFeatureConfigSchemaStage, nodeRuntimePipelinePostprocessScript, nodeRuntimePipelineProvenancePostprocessScript } from "./hwlab-node/render";
|
||||
import { nodeRuntimeRenderOverlay } from "./hwlab-node/web-probe";
|
||||
import { hwlabRuntimeLaneSpecForNode, parseHwlabRuntimePipelineProvenance } from "./hwlab-node-lanes";
|
||||
import { pipelineProvenanceAnnotationKeys, pipelineProvenanceAnnotations } from "./pipeline-provenance";
|
||||
@@ -35,6 +35,7 @@ import {
|
||||
observePacSourceArtifactRuntime,
|
||||
selectPipelineRunBySourceCommit,
|
||||
} from "../native/cicd/pac-source-artifact-runtime.mjs";
|
||||
import { renderGitOpsResources } from "../native/cicd/publish-unidesk-host-gitops.mjs";
|
||||
|
||||
const sourceCommit = "a".repeat(40);
|
||||
const provenance = {
|
||||
@@ -238,6 +239,189 @@ describe("HWLAB YAML-owned Pipeline provenance", () => {
|
||||
}, ownerPath, configRef)).toThrow("mode must be one of remote-pipeline-annotation");
|
||||
});
|
||||
|
||||
test("runtime GitOps guard keeps Tekton scripts below the owning YAML budget", () => {
|
||||
const temporary = mkdtempSync(resolve(tmpdir(), "unidesk-hwlab-runtime-gitops-guard-"));
|
||||
try {
|
||||
const spec = hwlabRuntimeLaneSpecForNode("v03", "NC01");
|
||||
const budget = spec.pipelineProvenance?.maxInlineScriptBytes;
|
||||
expect(budget).toBeNumber();
|
||||
const overlay = nodeRuntimeRenderOverlay(spec);
|
||||
const pipelineDir = resolve(temporary, spec.tektonDir);
|
||||
const pipelinePath = resolve(pipelineDir, "pipeline.yaml");
|
||||
const configMapPath = resolve(pipelineDir, "runtime-gitops-scripts.yaml");
|
||||
const gitMirrorDir = resolve(temporary, "devops-infra");
|
||||
mkdirSync(pipelineDir, { recursive: true });
|
||||
mkdirSync(gitMirrorDir, { recursive: true });
|
||||
writeFileSync(resolve(gitMirrorDir, "git-mirror.yaml"), Bun.YAML.stringify({
|
||||
apiVersion: "v1",
|
||||
kind: "List",
|
||||
items: [
|
||||
{
|
||||
apiVersion: "v1",
|
||||
kind: "ConfigMap",
|
||||
metadata: { name: overlay.gitMirror.syncConfigMapName },
|
||||
data: {
|
||||
"sync.sh": "#!/bin/sh\nset -eu\nrepo_url='ssh://git@github.com/pikasTech/HWLAB.git'\n",
|
||||
"flush.sh": "#!/bin/sh\nset -eu\nremote='ssh://git@github.com/pikasTech/HWLAB.git'\n",
|
||||
},
|
||||
},
|
||||
{
|
||||
apiVersion: "apps/v1",
|
||||
kind: "Deployment",
|
||||
metadata: { name: overlay.gitMirror.serviceReadName },
|
||||
spec: { template: { spec: { containers: [{ name: "git-mirror", env: [] }] } } },
|
||||
},
|
||||
],
|
||||
}));
|
||||
writeFileSync(pipelinePath, Bun.YAML.stringify({
|
||||
apiVersion: "tekton.dev/v1",
|
||||
kind: "Pipeline",
|
||||
metadata: { name: spec.pipeline, namespace: "hwlab-ci" },
|
||||
spec: { tasks: [{
|
||||
name: "gitops-promote",
|
||||
taskSpec: { steps: [{
|
||||
name: "render",
|
||||
script: [
|
||||
"if [ -s /workspace/source/affected-services.json ] && node - /workspace/source/affected-services.json <<'NODE'",
|
||||
"const fs = require(\"node:fs\");",
|
||||
"const plan = JSON.parse(fs.readFileSync(process.argv[2], \"utf8\"));",
|
||||
"const buildServices = Array.isArray(plan.buildServices) ? plan.buildServices : [];",
|
||||
"const affectedServices = Array.isArray(plan.affectedServices) ? plan.affectedServices : [];",
|
||||
"const willRunGitopsPromote = plan.ciCdPlan && plan.ciCdPlan.willRunGitopsPromote === true;",
|
||||
"process.exit(!willRunGitopsPromote && buildServices.length === 0 && affectedServices.length === 0 ? 0 : 1);",
|
||||
"NODE",
|
||||
"then",
|
||||
" printf 'false' > /tekton/results/runtime-ready-required || true",
|
||||
" echo '{\"event\":\"gitops-promote\",\"status\":\"skipped\",\"reason\":\"no-build-no-rollout-plan\"}'",
|
||||
" exit 0",
|
||||
"fi",
|
||||
"node scripts/run-bun.mjs scripts/gitops-render.mjs --use-deploy-images",
|
||||
"node scripts/run-bun.mjs scripts/gitops-render.mjs --use-deploy-images --check",
|
||||
"",
|
||||
].join("\n"),
|
||||
}] },
|
||||
}] },
|
||||
}));
|
||||
const overlayBase64 = Buffer.from(JSON.stringify(overlay), "utf8").toString("base64");
|
||||
const postprocessInput = [
|
||||
"set -eu",
|
||||
`render_dir=${JSON.stringify(temporary)}`,
|
||||
`overlay_b64=${JSON.stringify(overlayBase64)}`,
|
||||
...nodeRuntimePipelinePostprocessScript(nodeRuntimeFeatureConfigSchemaStage(spec)),
|
||||
].join("\n");
|
||||
const result = spawnSync("sh", [], {
|
||||
cwd: rootPath(),
|
||||
input: postprocessInput,
|
||||
encoding: "utf8",
|
||||
timeout: 30_000,
|
||||
});
|
||||
expect(result.status, result.stderr).toBe(0);
|
||||
const guardedPipelineText = readFileSync(pipelinePath, "utf8");
|
||||
const repeated = spawnSync("node", [
|
||||
resolve(temporary, ".unidesk-runtime-gitops", "runtime-gitops-pipeline-guard.mjs"),
|
||||
"--pipeline", pipelinePath,
|
||||
], {
|
||||
cwd: rootPath(),
|
||||
env: { ...process.env, UNIDESK_RUNTIME_GITOPS_OVERLAY_B64: overlayBase64 },
|
||||
encoding: "utf8",
|
||||
timeout: 30_000,
|
||||
});
|
||||
expect(repeated.status, repeated.stderr).toBe(0);
|
||||
expect(readFileSync(pipelinePath, "utf8")).toBe(guardedPipelineText);
|
||||
const pipeline = Bun.YAML.parse(guardedPipelineText) as Record<string, any>;
|
||||
const scripts = pipeline.spec.tasks.flatMap((task: Record<string, any>) => task.taskSpec.steps.map((step: Record<string, any>) => String(step.script ?? "")));
|
||||
expect(Math.max(...scripts.map((script: string) => Buffer.byteLength(script)))).toBeLessThanOrEqual(budget as number);
|
||||
expect(scripts.join("\n")).toContain("process.exit(buildServices.length === 0 && affectedServices.length === 0 ? 0 : 1);");
|
||||
expect(scripts.join("\n")).not.toContain("!willRunGitopsPromote");
|
||||
expect(scripts.join("\n")).toContain("no-build-no-rollout-plan-gitops-verify");
|
||||
expect(scripts.join("\n")).not.toContain('"status":"skipped","reason":"no-build-no-rollout-plan"');
|
||||
expect(scripts.join("\n")).toContain("UNIDESK_RUNTIME_GITOPS_OVERLAY_FILE=/etc/unidesk-cicd-runtime-gitops/runtime-gitops-overlay.json");
|
||||
expect(scripts.join("\n")).toContain("export UNIDESK_AJV2020_BUNDLE='/etc/unidesk-cicd-runtime-gitops/ajv2020.min.js'");
|
||||
expect(scripts.join("\n")).toContain("feature-config-schema-validation");
|
||||
expect(scripts.join("\n")).toContain("cicd.feature_config.schema");
|
||||
expect(scripts.join("\n")).toContain("export OTEL_EXPORTER_OTLP_TRACES_ENDPOINT='http://otel-collector.platform-infra.svc.cluster.local:4318/v1/traces'");
|
||||
expect(scripts.join("\n")).toContain("export OTEL_SERVICE_NAME='unidesk-cicd'");
|
||||
expect(scripts.join("\n")).toContain("export OTEL_TRACES_SAMPLER_ARG='1'");
|
||||
expect(scripts.join("\n")).toContain("export OTEL_EXPORTER_TIMEOUT_MS='300'");
|
||||
expect(scripts.join("\n")).toContain("feature-config-validator-process-failure");
|
||||
expect(scripts.join("\n").indexOf("scripts/gitops-render.mjs --use-deploy-images"))
|
||||
.toBeLessThan(scripts.join("\n").indexOf("feature-config-schema-validation"));
|
||||
expect(scripts.join("\n")).not.toContain("NODE_UNIDESK_RUNTIME_GITOPS_POSTPROCESS");
|
||||
expect(scripts.join("\n")).not.toContain("NODE_UNIDESK_RUNTIME_GITOPS_VERIFY");
|
||||
expect(scripts.join("\n")).not.toContain("UNIDESK_RUNTIME_GITOPS_OVERLAY_B64=");
|
||||
expect(scripts.join("\n")).not.toContain(Buffer.from(JSON.stringify(overlay.observability), "utf8").toString("base64"));
|
||||
const configMap = Bun.YAML.parse(readFileSync(configMapPath, "utf8")) as Record<string, any>;
|
||||
expect(configMap.metadata.labels["app.kubernetes.io/managed-by"]).toBe("unidesk-host-gitops");
|
||||
expect(JSON.parse(configMap.data["runtime-gitops-overlay.json"])).toEqual({ runtimePath: overlay.runtimePath, observability: overlay.observability, codeAgentRuntime: overlay.codeAgentRuntime });
|
||||
expect(Object.keys(configMap.data).sort()).toEqual([
|
||||
"ajv2020.min.js",
|
||||
"feature-config-schema-warning.mjs",
|
||||
"runtime-gitops-observability.mjs",
|
||||
"runtime-gitops-overlay.json",
|
||||
"runtime-gitops-postprocess.mjs",
|
||||
"runtime-gitops-verify.mjs",
|
||||
]);
|
||||
const hostConfig = Bun.YAML.parse(readFileSync(rootPath("config", "unidesk-host-k8s.yaml"), "utf8")) as Record<string, any>;
|
||||
const runtimePaths = new Set(hostConfig.delivery.changeDetection.runtimePaths as string[]);
|
||||
for (const inputPath of [
|
||||
"bun.lock",
|
||||
"config/hwlab-node-lanes.yaml",
|
||||
"package.json",
|
||||
"scripts/native/cicd/feature-config-schema-warning.mjs",
|
||||
"scripts/native/hwlab/runtime-gitops-observability.mjs",
|
||||
"scripts/native/hwlab/runtime-gitops-postprocess.mjs",
|
||||
"scripts/native/hwlab/runtime-gitops-scripts-configmap.mjs",
|
||||
"scripts/native/hwlab/runtime-gitops-verify.mjs",
|
||||
"scripts/vendor/ajv-dist/8.17.1/ajv2020.min.js",
|
||||
"scripts/vendor/ajv-dist/8.17.1/manifest.json",
|
||||
"scripts/src/config.ts",
|
||||
"scripts/src/hwlab-node/render.ts",
|
||||
"scripts/src/hwlab-node-lanes.ts",
|
||||
"scripts/src/platform-infra-pipelines-as-code.ts",
|
||||
"scripts/src/yaml-composition.ts",
|
||||
]) expect(runtimePaths.has(inputPath), inputPath).toBe(true);
|
||||
expect(hostConfig.delivery.gitops.resources).toContainEqual({
|
||||
id: "hwlab-nc01-v03-runtime-gitops-scripts",
|
||||
renderer: "hwlab-runtime-gitops-scripts",
|
||||
configRef: "config/hwlab-node-lanes.yaml#lanes.v03.targets.NC01",
|
||||
manifestPath: "deploy/gitops/unidesk-host/hwlab-nc01-v03-runtime-gitops-scripts.yaml",
|
||||
namespace: "hwlab-ci",
|
||||
});
|
||||
const gitopsResources = renderGitOpsResources(hostConfig.delivery.gitops, rootPath());
|
||||
expect(gitopsResources).toHaveLength(1);
|
||||
expect(gitopsResources[0]?.path).toBe("deploy/gitops/unidesk-host/hwlab-nc01-v03-runtime-gitops-scripts.yaml");
|
||||
const gitopsConfigMap = Bun.YAML.parse(gitopsResources[0]?.content ?? "") as Record<string, any>;
|
||||
expect(gitopsConfigMap.metadata.name).toBe("hwlab-nc01-v03-ci-image-publish-runtime-gitops-scripts");
|
||||
expect(gitopsConfigMap.metadata.namespace).toBe("hwlab-ci");
|
||||
expect(gitopsConfigMap.data["runtime-gitops-postprocess.mjs"]).toContain("UNIDESK_RUNTIME_GITOPS_OVERLAY_FILE");
|
||||
expect(gitopsConfigMap.data["runtime-gitops-postprocess.mjs"].indexOf("UNIDESK_RUNTIME_GITOPS_OVERLAY_FILE"))
|
||||
.toBeLessThan(gitopsConfigMap.data["runtime-gitops-postprocess.mjs"].indexOf("UNIDESK_RUNTIME_GITOPS_OVERLAY_B64"));
|
||||
const legacyPayload = Buffer.from(JSON.stringify({ runtimePath: overlay.runtimePath, observability: overlay.observability }), "utf8").toString("base64");
|
||||
const legacyPipeline = Bun.YAML.parse(readFileSync(pipelinePath, "utf8")) as Record<string, any>;
|
||||
const legacyStep = legacyPipeline.spec.tasks[0].taskSpec.steps[0];
|
||||
legacyStep.script = String(legacyStep.script).replaceAll(
|
||||
"UNIDESK_RUNTIME_GITOPS_OVERLAY_FILE=/etc/unidesk-cicd-runtime-gitops/runtime-gitops-overlay.json",
|
||||
`UNIDESK_RUNTIME_GITOPS_OVERLAY_B64='${legacyPayload}'`,
|
||||
);
|
||||
writeFileSync(pipelinePath, Bun.YAML.stringify(legacyPipeline));
|
||||
const migrated = spawnSync("node", [
|
||||
rootPath("scripts", "native", "hwlab", "runtime-gitops-pipeline-guard.mjs"),
|
||||
"--pipeline", pipelinePath,
|
||||
], {
|
||||
cwd: rootPath(),
|
||||
env: { ...process.env, UNIDESK_RUNTIME_GITOPS_OVERLAY_B64: Buffer.from(JSON.stringify(overlay), "utf8").toString("base64") },
|
||||
encoding: "utf8",
|
||||
timeout: 30_000,
|
||||
});
|
||||
expect(migrated.status).toBe(0);
|
||||
const migratedText = readFileSync(pipelinePath, "utf8");
|
||||
expect(migratedText).toContain("UNIDESK_RUNTIME_GITOPS_OVERLAY_FILE=/etc/unidesk-cicd-runtime-gitops/runtime-gitops-overlay.json");
|
||||
expect(migratedText).not.toContain(legacyPayload);
|
||||
} finally {
|
||||
rmSync(temporary, { recursive: true, force: true });
|
||||
}
|
||||
});
|
||||
|
||||
test("normal control-plane postprocess writes exactly the shared four provenance fields", () => {
|
||||
const temporary = mkdtempSync(resolve(tmpdir(), "unidesk-hwlab-pipeline-provenance-"));
|
||||
try {
|
||||
@@ -491,7 +675,15 @@ describe("runtime source-commit selection", () => {
|
||||
configRef: "config/hwlab-node-lanes.yaml#lanes.v03.targets.NC01",
|
||||
renderer: "hwlab-runtime-lane",
|
||||
mode: "remote-pipeline-annotation",
|
||||
maxInlineScriptBytes: 32768,
|
||||
});
|
||||
expect(spec.codeAgentRuntime?.kafkaEventBridge).toMatchObject({
|
||||
enabled: true,
|
||||
transactionalProjectorConsumerGroupId: "hwlab-v03-agentrun-event-projector",
|
||||
hwlabEventConsumerGroupId: "hwlab-v03-workbench-live-sse",
|
||||
});
|
||||
expect(spec.codeAgentRuntime?.kafkaEventBridge).not.toHaveProperty("features");
|
||||
expect(spec.codeAgentRuntime?.kafkaEventBridge).not.toHaveProperty("refreshReplay");
|
||||
expect(remoteAnnotations).toEqual(pipelineProvenanceAnnotations(remoteProvenance));
|
||||
expect(Object.keys(remoteAnnotations).sort()).toEqual(Object.values(pipelineProvenanceAnnotationKeys).sort());
|
||||
expect(readFileSync(rootPath("scripts", "src", "hwlab-node", "render.ts"), "utf8")).not.toContain("overlay.sourceArtifactProvenance");
|
||||
|
||||
@@ -9,7 +9,7 @@ import { AGENTRUN_CONFIG_PATH, resolveAgentRunLaneTarget } from "./agentrun-lane
|
||||
import { renderAgentRunPipelineManifest } from "./agentrun-manifests";
|
||||
import { hwlabRuntimeLaneSpecForNode, isHwlabRuntimeLane, type HwlabRuntimeLaneSpec } from "./hwlab-node-lanes";
|
||||
import { nodeRuntimeGitopsRoot } from "./hwlab-node/cleanup";
|
||||
import { nodeRuntimePipelinePostprocessScript } from "./hwlab-node/render";
|
||||
import { nodeRuntimeFeatureConfigSchemaStage, nodeRuntimePipelinePostprocessScript } from "./hwlab-node/render";
|
||||
import { nodeRuntimeRenderOverlay } from "./hwlab-node/web-probe";
|
||||
import { hwlabRuntimePipelineProvenance } from "./hwlab-node/pipeline-provenance";
|
||||
import { applyNodeRuntimeDeployYamlOverlay } from "./hwlab-node/deploy-overlay";
|
||||
@@ -617,7 +617,7 @@ function renderHwlabPipelineFromOwningYaml(spec: HwlabRuntimeLaneSpec, sourceWor
|
||||
"set -eu",
|
||||
`render_dir=${shellQuote(output)}`,
|
||||
`overlay_b64=${shellQuote(overlay)}`,
|
||||
...nodeRuntimePipelinePostprocessScript(),
|
||||
...nodeRuntimePipelinePostprocessScript(nodeRuntimeFeatureConfigSchemaStage(spec)),
|
||||
].join("\n");
|
||||
runChecked("sh", [], temporarySource, 120_000, "HWLAB UniDesk domain postprocess/verify renderer", postprocess);
|
||||
const path = resolve(output, spec.tektonDir, "pipeline.yaml");
|
||||
|
||||
@@ -36,6 +36,7 @@ import {
|
||||
renderPacBootstrap,
|
||||
resolvePacBootstrapMirrorRepository,
|
||||
} from "./platform-infra-pipelines-as-code-bootstrap";
|
||||
import { featureConfigSchemaHistoryFields, renderFeatureConfigSchemaLine } from "./platform-infra-pac-feature-config-projection";
|
||||
|
||||
const configFile = rootPath("config", "platform-infra", "pipelines-as-code.yaml");
|
||||
const configLabel = "config/platform-infra/pipelines-as-code.yaml";
|
||||
@@ -2286,6 +2287,7 @@ export function renderStatus(result: Record<string, unknown>): RenderedCliResult
|
||||
stringValue(deliveryPlan.reusedServiceCount),
|
||||
stringValue(sourceObservation.reason),
|
||||
]]),
|
||||
renderFeatureConfigSchemaLine(sourceObservation.featureConfigSchema),
|
||||
"",
|
||||
"TASKRUN DURATIONS",
|
||||
...(taskRuns.length === 0 ? ["-"] : table(["TASKRUN", "STATUS", "REASON", "FAILED_STEP", "EXIT", "DURATION_S"], taskRuns.map((item) => {
|
||||
@@ -2503,6 +2505,7 @@ export function renderDebugStep(result: Record<string, unknown>): RenderedCliRes
|
||||
stringValue(catalog.digestCount),
|
||||
short(stringValue(artifact.gitopsCommit), 16),
|
||||
]]),
|
||||
renderFeatureConfigSchemaLine(record(artifact.sourceObservation).featureConfigSchema),
|
||||
]),
|
||||
"",
|
||||
"STATUS EVALUATOR FIXTURES",
|
||||
@@ -2925,6 +2928,7 @@ function renderHistoryDetail(row: Record<string, unknown>): string[] {
|
||||
["rolloutServices", stringValue(deliveryPlan.rolloutServiceCount)],
|
||||
["buildServices", stringValue(deliveryPlan.buildServiceCount)],
|
||||
["reusedServices", stringValue(deliveryPlan.reusedServiceCount)],
|
||||
...featureConfigSchemaHistoryFields(sourceObservation.featureConfigSchema),
|
||||
]),
|
||||
"",
|
||||
"TERMINAL EVIDENCE",
|
||||
|
||||
+203
-19
@@ -40,7 +40,7 @@ interface SecretDistributionConfig {
|
||||
version: number;
|
||||
kind: "unidesk-secret-distribution";
|
||||
metadata: { id: string; owner: string; relatedIssues: number[] };
|
||||
sources: { root: string; files: EnvSourceFileConfig[]; externalFiles: RawSourceFileConfig[] };
|
||||
sources: { root: string; files: EnvSourceFileConfig[]; externalFiles: SourceFileConfig[] };
|
||||
targets: DistributionTarget[];
|
||||
kubernetesSecrets: KubernetesSecretConfig[];
|
||||
}
|
||||
@@ -76,6 +76,11 @@ interface DistributionTarget {
|
||||
namespace: string;
|
||||
scope: string;
|
||||
enabled: boolean;
|
||||
consumerRollout: {
|
||||
deployments: string[];
|
||||
timeoutSeconds: number;
|
||||
pollIntervalSeconds: number;
|
||||
} | null;
|
||||
}
|
||||
|
||||
interface KubernetesSecretConfig {
|
||||
@@ -263,8 +268,9 @@ async function sync(config: UniDeskConfig, options: SecretsOptions): Promise<Rec
|
||||
mode: "confirmed",
|
||||
mutation: true,
|
||||
config: configSummary(distribution, options),
|
||||
localSources: sourceSummary(sources),
|
||||
desiredSecrets: desired.map(desiredSecretSummary),
|
||||
...(options.full
|
||||
? { localSources: sourceSummary(sources), desiredSecrets: desired.map(desiredSecretSummary) }
|
||||
: { localSources: compactSourceSummary(sources), desiredSecrets: desired.map(compactDesiredSecretSummary) }),
|
||||
targets: perTarget,
|
||||
valuesPrinted: false,
|
||||
};
|
||||
@@ -311,7 +317,7 @@ function readSecretDistributionConfig(pathArg: string): SecretDistributionConfig
|
||||
files: arrayOfRecords(sources.files, `${label}.sources.files`).map((item, index) => parseSourceFile(item, `${label}.sources.files[${index}]`)),
|
||||
externalFiles: sources.externalFiles === undefined
|
||||
? []
|
||||
: arrayOfRecords(sources.externalFiles, `${label}.sources.externalFiles`).map((item, index) => parseRawSourceFile(item, `${label}.sources.externalFiles[${index}]`)),
|
||||
: arrayOfRecords(sources.externalFiles, `${label}.sources.externalFiles`).map((item, index) => parseExternalSourceFile(item, `${label}.sources.externalFiles[${index}]`)),
|
||||
},
|
||||
targets: arrayOfRecords(root.targets, `${label}.targets`).map((item, index) => parseTarget(item, `${label}.targets[${index}]`)),
|
||||
kubernetesSecrets: arrayOfRecords(root.kubernetesSecrets, `${label}.kubernetesSecrets`).map((item, index) => parseKubernetesSecret(item, `${label}.kubernetesSecrets[${index}]`)),
|
||||
@@ -320,13 +326,13 @@ function readSecretDistributionConfig(pathArg: string): SecretDistributionConfig
|
||||
return config;
|
||||
}
|
||||
|
||||
function parseSourceFile(record: Record<string, unknown>, path: string): EnvSourceFileConfig {
|
||||
function parseSourceFile(record: Record<string, unknown>, path: string, external = false): EnvSourceFileConfig {
|
||||
const type = stringField(record, "type", path);
|
||||
if (type !== "env") throw new Error(`${path}.type must be env`);
|
||||
const createRaw = record.createIfMissing === undefined ? {} : objectField(record, "createIfMissing", path);
|
||||
const randomBase64UrlRaw = createRaw.randomBase64Url === undefined ? {} : objectField(createRaw, "randomBase64Url", `${path}.createIfMissing`);
|
||||
return {
|
||||
sourceRef: sourceRefField(record, "sourceRef", path),
|
||||
sourceRef: external ? externalSourceRefField(record, "sourceRef", path) : sourceRefField(record, "sourceRef", path),
|
||||
type,
|
||||
requiredKeys: stringArrayField(record, "requiredKeys", path).map((key, index) => envKeyValue(key, `${path}.requiredKeys[${index}]`)),
|
||||
required: true,
|
||||
@@ -339,15 +345,16 @@ function parseSourceFile(record: Record<string, unknown>, path: string): EnvSour
|
||||
};
|
||||
}
|
||||
|
||||
function parseRawSourceFile(record: Record<string, unknown>, path: string): RawSourceFileConfig {
|
||||
function parseExternalSourceFile(record: Record<string, unknown>, path: string): SourceFileConfig {
|
||||
const type = stringField(record, "type", path);
|
||||
if (type === "env") return parseSourceFile(record, path, true);
|
||||
if (type !== "raw-file") throw new Error(`${path}.type must be raw-file`);
|
||||
const createRaw = objectField(record, "createIfMissing", path);
|
||||
const enabled = booleanField(createRaw, "enabled", `${path}.createIfMissing`);
|
||||
const randomHex = createRaw.randomHex === undefined
|
||||
const randomHex: Record<string, number> = createRaw.randomHex === undefined
|
||||
? {}
|
||||
: { contents: randomByteCount(createRaw.randomHex, `${path}.createIfMissing.randomHex`) };
|
||||
const randomBase64Url = createRaw.randomBase64Url === undefined
|
||||
const randomBase64Url: Record<string, { bytes: number; prefix: string }> = createRaw.randomBase64Url === undefined
|
||||
? {}
|
||||
: { contents: randomBase64UrlSpec(createRaw.randomBase64Url, `${path}.createIfMissing.randomBase64Url`) };
|
||||
if (createRaw.values !== undefined) throw new Error(`${path}.createIfMissing.values is not allowed for raw-file sources`);
|
||||
@@ -369,12 +376,22 @@ function parseRawSourceFile(record: Record<string, unknown>, path: string): RawS
|
||||
}
|
||||
|
||||
function parseTarget(record: Record<string, unknown>, path: string): DistributionTarget {
|
||||
const rollout = record.consumerRollout === undefined ? null : objectField(record, "consumerRollout", path);
|
||||
const deployments = rollout === null
|
||||
? []
|
||||
: stringArrayField(rollout, "deployments", `${path}.consumerRollout`).map((value, index) => kubernetesNameValue(value, `${path}.consumerRollout.deployments[${index}]`));
|
||||
const timeoutSeconds = rollout === null ? 0 : integerField(rollout, "timeoutSeconds", `${path}.consumerRollout`);
|
||||
const pollIntervalSeconds = rollout === null ? 0 : integerField(rollout, "pollIntervalSeconds", `${path}.consumerRollout`);
|
||||
if (rollout !== null && (deployments.length === 0 || timeoutSeconds <= 0 || pollIntervalSeconds <= 0)) {
|
||||
throw new Error(`${path}.consumerRollout requires deployments, a positive timeoutSeconds, and a positive pollIntervalSeconds`);
|
||||
}
|
||||
return {
|
||||
id: simpleId(stringField(record, "id", path), `${path}.id`),
|
||||
route: stringField(record, "route", path),
|
||||
namespace: kubernetesNameField(record, "namespace", path),
|
||||
scope: simpleId(stringField(record, "scope", path), `${path}.scope`),
|
||||
enabled: booleanField(record, "enabled", path),
|
||||
consumerRollout: rollout === null ? null : { deployments, timeoutSeconds, pollIntervalSeconds },
|
||||
};
|
||||
}
|
||||
|
||||
@@ -414,7 +431,8 @@ function validateDistributionConfig(config: SecretDistributionConfig): void {
|
||||
for (const item of secret.data) {
|
||||
const source = sources.get(item.sourceRef);
|
||||
if (source === undefined) throw new Error(`${config.configPath}.kubernetesSecrets.${secret.name} references undeclared sourceRef ${item.sourceRef}`);
|
||||
if (!source.requiredKeys.includes(item.sourceKey)) throw new Error(`${config.configPath}.kubernetesSecrets.${secret.name} maps undeclared source key ${item.sourceRef}.${item.sourceKey}`);
|
||||
const requiredKeys: readonly string[] = source.requiredKeys;
|
||||
if (!requiredKeys.includes(item.sourceKey)) throw new Error(`${config.configPath}.kubernetesSecrets.${secret.name} maps undeclared source key ${item.sourceRef}.${item.sourceKey}`);
|
||||
if (targetKeys.has(item.targetKey)) throw new Error(`${config.configPath}.kubernetesSecrets.${secret.name} maps duplicate target key ${item.targetKey}`);
|
||||
targetKeys.add(item.targetKey);
|
||||
}
|
||||
@@ -429,7 +447,7 @@ function inspectSources(config: SecretDistributionConfig, materialize: boolean,
|
||||
const root = secretRoot(config);
|
||||
const materials = new Map<string, SourceMaterial>();
|
||||
const entries = allSourceFiles(config).filter((source) => selectedRefs.has(source.sourceRef)).map((source) => {
|
||||
const sourcePath = source.type === "env" ? join(root, source.sourceRef) : externalSourcePath(source.sourceRef);
|
||||
const sourcePath = sourcePathFor(root, source);
|
||||
const exists = existsSync(sourcePath);
|
||||
const existingText = exists ? readFileSync(sourcePath, "utf8") : "";
|
||||
const existing = exists ? source.type === "env" ? parseEnvFile(existingText) : { contents: existingText } : {};
|
||||
@@ -502,6 +520,8 @@ function inspectSources(config: SecretDistributionConfig, materialize: boolean,
|
||||
presence,
|
||||
bytes,
|
||||
fingerprint,
|
||||
ownerOnly: true,
|
||||
fileMode: "0600",
|
||||
valuesPrinted: false,
|
||||
};
|
||||
}
|
||||
@@ -517,6 +537,8 @@ function inspectSources(config: SecretDistributionConfig, materialize: boolean,
|
||||
generatedKeys,
|
||||
unmaterializedGeneratedKeys,
|
||||
fingerprint: material.fingerprint,
|
||||
ownerOnly: true,
|
||||
fileMode: "0600",
|
||||
valuesPrinted: false,
|
||||
};
|
||||
});
|
||||
@@ -590,10 +612,17 @@ async function applyTargetSecrets(config: UniDeskConfig, target: DistributionTar
|
||||
const yaml = renderSecretManifest(target, secrets);
|
||||
const result = await capture(config, target.route, ["sh"], applySecretScript(target, secrets, yaml));
|
||||
const parsed = parseJsonOutput(result.stdout);
|
||||
const applied = result.exitCode === 0 && boolField(parsed, "ok", false);
|
||||
const consumerRolloutStatus = applied && target.consumerRollout !== null
|
||||
? await waitForConsumerRollout(config, target)
|
||||
: null;
|
||||
return {
|
||||
ok: result.exitCode === 0 && boolField(parsed, "ok", false),
|
||||
ok: applied && (consumerRolloutStatus === null || consumerRolloutStatus.ok === true),
|
||||
target: targetSummary(target),
|
||||
summary: parsed,
|
||||
summary: {
|
||||
...parsed,
|
||||
...(consumerRolloutStatus === null ? {} : { consumerRolloutStatus }),
|
||||
},
|
||||
remote: secretCaptureSummary(result),
|
||||
...(options.raw ? { rawCaptureOmitted: true, rawPolicy: "Secret distribution never returns raw SSH capture because remote output can contain credential-bearing diagnostics." } : {}),
|
||||
};
|
||||
@@ -640,6 +669,9 @@ ${Object.entries(secret.data).sort(([a], [b]) => a.localeCompare(b)).map(([key,
|
||||
function applySecretScript(target: DistributionTarget, secrets: DesiredSecret[], yaml: string): string {
|
||||
const manifestB64 = Buffer.from(yaml, "utf8").toString("base64");
|
||||
const summaryB64 = Buffer.from(JSON.stringify(secrets.map(remoteSecretSummary)), "utf8").toString("base64");
|
||||
const rollout = target.consumerRollout;
|
||||
const rolloutDeployments = rollout?.deployments.join(" ") ?? "";
|
||||
const rolloutSummaryB64 = Buffer.from(JSON.stringify(rollout), "utf8").toString("base64");
|
||||
return `
|
||||
set -u
|
||||
tmp="$(mktemp -d)"
|
||||
@@ -656,22 +688,38 @@ else
|
||||
printf '%s\\n' 'skipped because namespace sync failed' >"$tmp/apply.err"
|
||||
apply_rc=1
|
||||
fi
|
||||
python3 - "$ns_rc" "$apply_rc" "$tmp/ns.out" "$tmp/ns.err" "$tmp/apply.out" "$tmp/apply.err" <<'PY'
|
||||
rollout_restart_rc=0
|
||||
: >"$tmp/rollout-restart.out"
|
||||
: >"$tmp/rollout-restart.err"
|
||||
if [ "$apply_rc" -eq 0 ] && [ -n '${rolloutDeployments}' ]; then
|
||||
for deployment in ${rolloutDeployments}; do
|
||||
kubectl -n ${target.namespace} rollout restart "deployment/$deployment" >>"$tmp/rollout-restart.out" 2>>"$tmp/rollout-restart.err" || {
|
||||
rollout_restart_rc=$?
|
||||
break
|
||||
}
|
||||
done
|
||||
elif [ "$apply_rc" -ne 0 ] && [ -n '${rolloutDeployments}' ]; then
|
||||
rollout_restart_rc=1
|
||||
printf '%s\\n' 'skipped because Secret apply failed' >"$tmp/rollout-restart.err"
|
||||
fi
|
||||
python3 - "$ns_rc" "$apply_rc" "$rollout_restart_rc" "$tmp/ns.out" "$tmp/ns.err" "$tmp/apply.out" "$tmp/apply.err" "$tmp/rollout-restart.out" "$tmp/rollout-restart.err" <<'PY'
|
||||
import base64, json, os, sys
|
||||
ns_rc, apply_rc = int(sys.argv[1]), int(sys.argv[2])
|
||||
ns_rc, apply_rc, rollout_restart_rc = [int(value) for value in sys.argv[1:4]]
|
||||
def byte_count(path):
|
||||
try:
|
||||
return os.path.getsize(path)
|
||||
except FileNotFoundError:
|
||||
return 0
|
||||
payload = {
|
||||
"ok": ns_rc == 0 and apply_rc == 0,
|
||||
"ok": ns_rc == 0 and apply_rc == 0 and rollout_restart_rc == 0,
|
||||
"namespace": "${target.namespace}",
|
||||
"secrets": json.loads(base64.b64decode("${summaryB64}").decode("utf-8")),
|
||||
"consumerRollout": json.loads(base64.b64decode("${rolloutSummaryB64}").decode("utf-8")),
|
||||
"valuesPrinted": False,
|
||||
"steps": {
|
||||
"namespace": {"exitCode": ns_rc, "stdoutBytes": byte_count(sys.argv[3]), "stderrBytes": byte_count(sys.argv[4]), "outputOmitted": True},
|
||||
"apply": {"exitCode": apply_rc, "stdoutBytes": byte_count(sys.argv[5]), "stderrBytes": byte_count(sys.argv[6]), "outputOmitted": True},
|
||||
"namespace": {"exitCode": ns_rc, "stdoutBytes": byte_count(sys.argv[4]), "stderrBytes": byte_count(sys.argv[5]), "outputOmitted": True},
|
||||
"apply": {"exitCode": apply_rc, "stdoutBytes": byte_count(sys.argv[6]), "stderrBytes": byte_count(sys.argv[7]), "outputOmitted": True},
|
||||
"consumerRolloutRestart": {"exitCode": rollout_restart_rc, "stdoutBytes": byte_count(sys.argv[8]), "stderrBytes": byte_count(sys.argv[9]), "outputOmitted": True},
|
||||
},
|
||||
}
|
||||
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
||||
@@ -680,6 +728,105 @@ PY
|
||||
`;
|
||||
}
|
||||
|
||||
async function waitForConsumerRollout(config: UniDeskConfig, target: DistributionTarget): Promise<Record<string, unknown>> {
|
||||
const rollout = target.consumerRollout;
|
||||
if (rollout === null) return { ok: true, mode: "not-declared", mutation: false };
|
||||
const startedAt = Date.now();
|
||||
const deadline = startedAt + rollout.timeoutSeconds * 1000;
|
||||
let attempts = 0;
|
||||
let lastSummary: Record<string, unknown> | null = null;
|
||||
let lastRemote: Record<string, unknown> | null = null;
|
||||
while (true) {
|
||||
attempts += 1;
|
||||
const result = await capture(config, target.route, ["sh"], consumerRolloutStatusScript(target));
|
||||
const parsed = parseJsonOutput(result.stdout);
|
||||
lastSummary = parsed;
|
||||
lastRemote = secretCaptureSummary(result);
|
||||
if (result.exitCode === 0 && boolField(parsed, "ok", false)) {
|
||||
return {
|
||||
ok: true,
|
||||
mutation: false,
|
||||
attempts,
|
||||
elapsedSeconds: Math.ceil((Date.now() - startedAt) / 1000),
|
||||
summary: parsed,
|
||||
remote: lastRemote,
|
||||
valuesPrinted: false,
|
||||
};
|
||||
}
|
||||
const remainingMs = deadline - Date.now();
|
||||
if (remainingMs <= 0) {
|
||||
return {
|
||||
ok: false,
|
||||
mutation: false,
|
||||
attempts,
|
||||
elapsedSeconds: Math.ceil((Date.now() - startedAt) / 1000),
|
||||
reason: "consumer-rollout-timeout",
|
||||
summary: lastSummary,
|
||||
remote: lastRemote,
|
||||
valuesPrinted: false,
|
||||
};
|
||||
}
|
||||
await Bun.sleep(Math.min(rollout.pollIntervalSeconds * 1000, remainingMs));
|
||||
}
|
||||
}
|
||||
|
||||
function consumerRolloutStatusScript(target: DistributionTarget): string {
|
||||
const rollout = target.consumerRollout;
|
||||
if (rollout === null) throw new Error(`target ${target.id} does not declare consumerRollout`);
|
||||
const commands = rollout.deployments.map((deployment, index) => [
|
||||
`kubectl -n ${target.namespace} get deployment ${deployment} -o json >"$tmp/deployment.${index}.json" 2>"$tmp/deployment.${index}.err"`,
|
||||
`printf '%s' "$?" >"$tmp/deployment.${index}.rc"`,
|
||||
].join("\n")).join("\n");
|
||||
const expectedB64 = Buffer.from(JSON.stringify(rollout.deployments), "utf8").toString("base64");
|
||||
return `
|
||||
set -u
|
||||
tmp="$(mktemp -d)"
|
||||
trap 'rm -rf "$tmp"' EXIT
|
||||
${commands}
|
||||
python3 - "$tmp" <<'PY'
|
||||
import base64, json, os, sys
|
||||
tmp = sys.argv[1]
|
||||
expected = json.loads(base64.b64decode("${expectedB64}").decode("utf-8"))
|
||||
items = []
|
||||
ok = True
|
||||
for index, name in enumerate(expected):
|
||||
try:
|
||||
rc = int(open(os.path.join(tmp, f"deployment.{index}.rc"), encoding="utf-8").read() or "1")
|
||||
except FileNotFoundError:
|
||||
rc = 1
|
||||
try:
|
||||
observed = json.load(open(os.path.join(tmp, f"deployment.{index}.json"), encoding="utf-8"))
|
||||
except Exception:
|
||||
observed = None
|
||||
metadata = (observed or {}).get("metadata") or {}
|
||||
spec = (observed or {}).get("spec") or {}
|
||||
status = (observed or {}).get("status") or {}
|
||||
generation = int(metadata.get("generation") or 0)
|
||||
observed_generation = int(status.get("observedGeneration") or 0)
|
||||
desired = int(spec.get("replicas") or 0)
|
||||
updated = int(status.get("updatedReplicas") or 0)
|
||||
ready = int(status.get("readyReplicas") or 0)
|
||||
available = int(status.get("availableReplicas") or 0)
|
||||
item_ok = rc == 0 and desired > 0 and observed_generation >= generation and updated >= desired and ready >= desired and available >= desired
|
||||
ok = ok and item_ok
|
||||
items.append({
|
||||
"name": name,
|
||||
"exists": rc == 0,
|
||||
"generation": generation,
|
||||
"observedGeneration": observed_generation,
|
||||
"desiredReplicas": desired,
|
||||
"updatedReplicas": updated,
|
||||
"readyReplicas": ready,
|
||||
"availableReplicas": available,
|
||||
"ready": item_ok,
|
||||
})
|
||||
payload = {"ok": ok, "namespace": "${target.namespace}", "deployments": items, "valuesPrinted": False}
|
||||
print(json.dumps(payload, ensure_ascii=False, indent=2))
|
||||
sys.exit(0 if ok else 1)
|
||||
PY
|
||||
`;
|
||||
}
|
||||
|
||||
function statusSecretScript(target: DistributionTarget, secrets: DesiredSecret[]): string {
|
||||
const summaryB64 = Buffer.from(JSON.stringify(secrets.map(remoteSecretSummary)), "utf8").toString("base64");
|
||||
const commands = secrets.map((secret, index) => [
|
||||
@@ -761,6 +908,22 @@ function sourceSummary(sources: SourceInspection): Record<string, unknown> {
|
||||
return { ok: sources.ok, root: sources.root, entries: sources.entries, valuesPrinted: false };
|
||||
}
|
||||
|
||||
function compactSourceSummary(sources: SourceInspection): Record<string, unknown> {
|
||||
return {
|
||||
ok: sources.ok,
|
||||
entries: sources.entries.map((entry) => ({
|
||||
sourceRef: entry.sourceRef,
|
||||
type: entry.type,
|
||||
presence: entry.presence ?? entry.exists,
|
||||
missingKeys: entry.missingKeys ?? [],
|
||||
action: entry.action ?? "none",
|
||||
fingerprint: entry.fingerprint ?? null,
|
||||
valuesPrinted: false,
|
||||
})),
|
||||
valuesPrinted: false,
|
||||
};
|
||||
}
|
||||
|
||||
function desiredSecretSummary(secret: DesiredSecret): Record<string, unknown> {
|
||||
return {
|
||||
name: secret.name,
|
||||
@@ -775,6 +938,17 @@ function desiredSecretSummary(secret: DesiredSecret): Record<string, unknown> {
|
||||
};
|
||||
}
|
||||
|
||||
function compactDesiredSecretSummary(secret: DesiredSecret): Record<string, unknown> {
|
||||
return {
|
||||
name: secret.name,
|
||||
secretName: secret.secretName,
|
||||
keys: Object.keys(secret.data).sort(),
|
||||
missingKeys: secret.missingKeys,
|
||||
fingerprint: secret.fingerprint,
|
||||
valuesPrinted: false,
|
||||
};
|
||||
}
|
||||
|
||||
function remoteSecretSummary(secret: DesiredSecret): Record<string, unknown> {
|
||||
return {
|
||||
name: secret.name,
|
||||
@@ -786,7 +960,7 @@ function remoteSecretSummary(secret: DesiredSecret): Record<string, unknown> {
|
||||
}
|
||||
|
||||
function targetSummary(target: DistributionTarget): Record<string, unknown> {
|
||||
return { id: target.id, route: target.route, namespace: target.namespace, scope: target.scope };
|
||||
return { id: target.id, route: target.route, namespace: target.namespace, scope: target.scope, consumerRollout: target.consumerRollout };
|
||||
}
|
||||
|
||||
function readOptionValue(args: string[], index: number, option: string): string {
|
||||
@@ -967,6 +1141,12 @@ function externalSourcePath(sourceRef: string): string {
|
||||
throw new Error(`external sourceRef ${sourceRef} must be an absolute path or a ~/ home path`);
|
||||
}
|
||||
|
||||
function sourcePathFor(root: string, source: SourceFileConfig): string {
|
||||
return source.sourceRef.startsWith("~/") || isAbsolute(source.sourceRef)
|
||||
? externalSourcePath(source.sourceRef)
|
||||
: join(root, source.sourceRef);
|
||||
}
|
||||
|
||||
function sourceDataKeyField(obj: Record<string, unknown>, key: string, path: string): string {
|
||||
const value = stringField(obj, key, path);
|
||||
if (!/^[A-Za-z_][A-Za-z0-9._-]*$/u.test(value)) throw new Error(`${path}.${key} must be a source data key`);
|
||||
@@ -982,6 +1162,10 @@ function kubernetesNameField(obj: Record<string, unknown>, key: string, path: st
|
||||
return yamlKubernetesNameField(obj, key, path, "");
|
||||
}
|
||||
|
||||
function kubernetesNameValue(value: string, path: string): string {
|
||||
return yamlKubernetesNameField({ value }, "value", path, "");
|
||||
}
|
||||
|
||||
function kubernetesSecretKeyField(obj: Record<string, unknown>, key: string, path: string): string {
|
||||
const value = stringField(obj, key, path);
|
||||
if (!/^[A-Za-z0-9._-]+$/u.test(value)) throw new Error(`${path}.${key} must be a Kubernetes Secret key`);
|
||||
|
||||
@@ -158,6 +158,7 @@ function parseDeliveryTarget(id: string, value: Record<string, unknown>): SelfMe
|
||||
if (boolean(ci.serviceAccountAutomount, `${path}.ci.serviceAccountAutomount`) !== false) throw new Error(`${path}.ci.serviceAccountAutomount must be false`);
|
||||
if (boolean(publicExposure.enabled, `${path}.deployment.publicExposure.enabled`) !== true) throw new Error(`${path}.deployment.publicExposure.enabled must be true`);
|
||||
if (integer(publicExposure.hostPort, `${path}.deployment.publicExposure.hostPort`) !== 4317) throw new Error(`${path}.deployment.publicExposure.hostPort must be 4317`);
|
||||
validateAccessSecret(deployment, `${path}.deployment`);
|
||||
const gitopsWriteUrl = text(gitops.writeUrl, `${path}.gitops.writeUrl`);
|
||||
if (!gitopsWriteUrl.startsWith("http://gitea-http.")) throw new Error(`${path}.gitops.writeUrl must use internal Gitea authority`);
|
||||
return {
|
||||
@@ -206,6 +207,29 @@ function parseDeliveryTarget(id: string, value: Record<string, unknown>): SelfMe
|
||||
};
|
||||
}
|
||||
|
||||
function validateAccessSecret(deployment: Record<string, unknown>, path: string): void {
|
||||
const secrets = record(deployment.secrets, `${path}.secrets`);
|
||||
const access = record(secrets.access, `${path}.secrets.access`);
|
||||
const target = record(access.target, `${path}.secrets.access.target`);
|
||||
absolutePath(access.sourceRef, `${path}.secrets.access.sourceRef`);
|
||||
kubernetesName(target.secretName, `${path}.secrets.access.target.secretName`);
|
||||
if (boolean(target.readOnly, `${path}.secrets.access.target.readOnly`) !== true) {
|
||||
throw new Error(`${selfMediaConfigRef}.${path}.secrets.access.target.readOnly must be true`);
|
||||
}
|
||||
if (!Array.isArray(target.files) || target.files.length === 0) throw new Error(`${selfMediaConfigRef}.${path}.secrets.access.target.files must be a non-empty array`);
|
||||
const targetKeys = new Set<string>();
|
||||
const mountPaths = new Set<string>();
|
||||
target.files.forEach((value, index) => {
|
||||
const file = record(value, `${path}.secrets.access.target.files[${index}]`);
|
||||
const targetKey = text(file.targetKey, `${path}.secrets.access.target.files[${index}].targetKey`);
|
||||
const mountPath = absolutePath(file.mountPath, `${path}.secrets.access.target.files[${index}].mountPath`);
|
||||
if (targetKeys.has(targetKey)) throw new Error(`${selfMediaConfigRef}.${path}.secrets.access.target.files contains duplicate targetKey ${targetKey}`);
|
||||
if (mountPaths.has(mountPath)) throw new Error(`${selfMediaConfigRef}.${path}.secrets.access.target.files contains duplicate mountPath ${mountPath}`);
|
||||
targetKeys.add(targetKey);
|
||||
mountPaths.add(mountPath);
|
||||
});
|
||||
}
|
||||
|
||||
function parseCutoverTarget(id: string, value: Record<string, unknown>): SelfMediaCutoverTarget {
|
||||
const path = `cutover.targets.${id}`;
|
||||
const source = record(value.source, `${path}.source`);
|
||||
|
||||
Reference in New Issue
Block a user