From e3951035f3fb3ea9e58d503cfdf708db34f006bb Mon Sep 17 00:00:00 2001 From: Codex Date: Wed, 8 Jul 2026 19:55:43 +0200 Subject: [PATCH] fix(cicd): add NC01 PaC status closeout --- .agents/skills/unidesk-cicd/SKILL.md | 8 +- .../unidesk-cicd/references/gitea-pac.md | 24 +-- config/agentrun.yaml | 14 +- config/platform-db/postgres-nc01.yaml | 124 ++++++++++++- docs/reference/agentrun.md | 4 +- docs/reference/platform-infra.md | 3 +- scripts/cli.ts | 2 +- scripts/src/agentrun-manifests.ts | 5 +- scripts/src/agentrun/control-plane.ts | 8 + scripts/src/agentrun/entry.ts | 8 +- scripts/src/agentrun/public-exposure.ts | 12 +- scripts/src/agentrun/yaml-lane.ts | 134 +++++++++++++- scripts/src/cicd-node-status.ts | 170 ++++++++++++++++++ scripts/src/cicd.ts | 11 +- scripts/src/help.ts | 9 +- .../src/platform-infra-pipelines-as-code.ts | 145 +++++++++++++++ 16 files changed, 644 insertions(+), 37 deletions(-) create mode 100644 scripts/src/cicd-node-status.ts diff --git a/.agents/skills/unidesk-cicd/SKILL.md b/.agents/skills/unidesk-cicd/SKILL.md index fb8c0b25..eaca8f15 100644 --- a/.agents/skills/unidesk-cicd/SKILL.md +++ b/.agents/skills/unidesk-cicd/SKILL.md @@ -10,6 +10,8 @@ HWLAB G14 和 AgentRun CI/CD 的受控入口。任何 PR 监控、Tekton/Argo、 ## 高频入口 ```bash +bun scripts/cli.ts cicd status --node NC01 +bun scripts/cli.ts cicd status --node bun scripts/cli.ts hwlab g14 monitor-prs --lane v02 --once --dry-run bun scripts/cli.ts hwlab g14 control-plane status --lane v02 bun scripts/cli.ts hwlab g14 control-plane trigger-current --lane v02 --confirm --wait @@ -27,6 +29,8 @@ bun scripts/cli.ts cicd branch-follower status bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel-master --step state-read ``` +节点级只读状态必须优先用 `cicd status --node `。它从 `config/platform-infra/pipelines-as-code.yaml` 找到该 node 的所有当前 PaC consumer，一次性汇总 PipelineRun、Argo/GitOps、runtime readiness 和诊断；不要再靠阅读源码或手动拼三条 consumer 命令来回答 “NC01 的 CI/CD 流水线情况”。`platform-infra pipelines-as-code status --target --consumer ` 只作为单 consumer drill-down。 + 按职责读取拆分后的 reference： - PR monitor 与自动合并: [references/pr-monitor.md](references/pr-monitor.md)。 @@ -41,8 +45,8 @@ bun scripts/cli.ts cicd branch-follower debug-step --follower web-probe-sentinel ## P0 边界 - CI/CD、GitOps、rollout、PipelineRun、Argo、git-mirror 和 AgentRun 部署必须走受控 CLI；不要用裸 `kubectl`、`argo`、`tkn`、`curl` 当正式控制入口。 -- CI/CD source authority 只能来自 YAML 声明的 Kubernetes 托管 source authority：legacy lane 使用 k8s git-mirror snapshot，JD01 migrated lane 使用 Gitea controlled mirror + immutable snapshot ref + Pipelines-as-Code。受控命令先在 k8s 内同步/创建不可变 `refs/unidesk/snapshots/.../` stage ref；build/status/publish 只消费该 snapshot，host worktree、本地 `git fetch/pull`、可变 branch ref 或 Pipeline 内直连 GitHub 都不能作为 authoritative source。 -- JD01 `agentrun-jd01-v02`、`sentinel-jd01-v03`、`hwlab-jd01-v03` 的正式 CI/CD closeout 入口是 `platform-infra pipelines-as-code closeout|status|history --target JD01`。`closeout` 是通用 consumer 引导入口，只读取/等待 PaC、Tekton、GitOps、Argo 和 runtime 对齐，不触发旧手动发布。`cicd branch-follower` 和 `cicd gitea-actions-poc` 对这三者只保留历史/迁移只读用途，不得作为当前交付判断入口。 +- CI/CD source authority 只能来自 YAML 声明的 Kubernetes 托管 source authority：legacy lane 使用 k8s git-mirror snapshot，Gitea/PaC migrated lane 使用 GitHub PR merge -> GitHub webhook bridge -> Gitea controlled mirror + immutable snapshot ref -> Pipelines-as-Code。受控命令先在 k8s 内同步/创建不可变 `refs/unidesk/snapshots/.../` stage ref；build/status/publish 只消费该 snapshot，host worktree、本地 `git fetch/pull`、可变 branch ref 或 Pipeline 内直连 GitHub 都不能作为 authoritative source。 +- JD01/NC01 `agentrun--v02`、`sentinel--v03`、`hwlab--v03` 的正式 CI/CD closeout 入口是 `cicd status --node ` 和 `platform-infra pipelines-as-code closeout|status|history --target --consumer `。`closeout` 是通用 consumer 引导入口，只读取/等待 PaC、Tekton、GitOps、Argo 和 runtime 对齐，不触发旧手动发布。`cicd branch-follower` 和 `cicd gitea-actions-poc` 对这些 consumer 只保留历史/迁移只读用途，不得作为当前交付判断入口。 - GitHub/Git 相关 egress 必须走 YAML-first host proxy/sourceRef：branch-follower controller 读 `config/cicd-branch-followers.yaml#controller.source.githubSsh`，runtime legacy git-mirror 读 owning lane/control-plane YAML 的 host proxy 和 `githubTransport`，Gitea/PaC 迁移 lane 读 `config/platform-infra/gitea.yaml` 与 `config/platform-infra/pipelines-as-code.yaml`；禁止依赖未声明 host env、trans proxy、裸直连 GitHub 或 CLI 输出解析。 - Gitea/PaC lane 的 GitHub -> Gitea 自动同步必须用 `platform-infra gitea mirror webhook apply|status|test`。该路径是单向同步，只更新 Gitea branch 和 immutable snapshot ref；不得引入 Gitea -> GitHub 回写、轮询 fallback、Gitea Actions/act_runner fallback 或第二套状态存储。 - Gitea webhook/FRPC/Caddy 变更的 closeout 必须看受控 CLI 的 rollout/status/test 证据；Secret 或 ConfigMap apply 成功不等于 connector Pod 已加载新 proxy/path。 diff --git a/.agents/skills/unidesk-cicd/references/gitea-pac.md b/.agents/skills/unidesk-cicd/references/gitea-pac.md index d0a4aa57..dfbb01a4 100644 --- a/.agents/skills/unidesk-cicd/references/gitea-pac.md +++ b/.agents/skills/unidesk-cicd/references/gitea-pac.md @@ -1,18 +1,19 @@ # Gitea + Pipelines-as-Code -JD01 migrated CI/CD uses one formal path: +Gitea/Pipelines-as-Code migrated CI/CD uses one formal path: ```text -GitHub push -> Gitea controlled mirror -> Pipelines-as-Code Repository webhook -> Tekton PipelineRun -> GitOps/Argo -> k8s runtime +GitHub PR merge -> GitHub webhook bridge -> Gitea controlled mirror and immutable snapshot refs -> Gitea Repository webhook -> Pipelines-as-Code -> Tekton PipelineRun -> GitOps/Argo -> k8s runtime ``` -Do not add Gitea Actions, `act_runner`, branch-follower, host worktree, direct GitHub-in-Pipeline, or custom script fallback for the migrated JD01 consumers. Gitea Actions material under `config/cicd-gitea-actions-poc.yaml` is archived read-only POC context only. +GitHub remains the upstream write authority. A delivery should be triggered by merging the GitHub PR into the consumer's YAML-declared source branch, then observing the target node's Gitea mirror, PaC, Tekton, GitOps, Argo and runtime status. Do not replace this with Gitea Actions, `act_runner`, branch-follower, host worktree, direct GitHub-in-Pipeline, direct Gitea pushes, manual PipelineRun creation, `trigger-current`, `webhook-test`, or custom script fallback. Gitea Actions material under `config/cicd-gitea-actions-poc.yaml` is archived read-only POC context only; `webhook-test` is only a connectivity diagnostic. ## Source Of Truth - Gitea source authority, GitHub webhook bridge, public exposure and source snapshots: `config/platform-infra/gitea.yaml`. - PaC controller, Repository CRs, consumer parameters, Tekton pipeline names and Argo applications: `config/platform-infra/pipelines-as-code.yaml`. - Historical snapshot prefixes containing `gitea-actions` are retained only for existing refs. They do not mean Gitea Actions is the active trigger architecture. +- Node-level status for these consumers is `bun scripts/cli.ts cicd status --node `. Consumer drill-down is `platform-infra pipelines-as-code status|history|closeout --target --consumer `. ## Coverage Matrix @@ -21,17 +22,20 @@ Do not add Gitea Actions, `act_runner`, branch-follower, host worktree, direct G | `agentrun-jd01-v02` | `pikasTech/agentrun@v0.2` | `agentrun-ci` | `agentrun-jd01-v02-ci-image-publish` | `agentrun-jd01-v02` | `platform-infra pipelines-as-code closeout --target JD01 --consumer agentrun-jd01-v02 --source-commit --wait` | | `sentinel-jd01-v03` | `pikasTech/unidesk@master` | `devops-infra` | `hwlab-web-probe-sentinel-jd01-pac` | `hwlab-web-probe-sentinel-jd01` | `platform-infra pipelines-as-code closeout --target JD01 --consumer sentinel-jd01-v03 --source-commit --wait` | | `hwlab-jd01-v03` | `pikasTech/HWLAB@v0.3` | `hwlab-ci` | `hwlab-jd01-v03-ci-image-publish` | `hwlab-node-v03` | `platform-infra pipelines-as-code closeout --target JD01 --consumer hwlab-jd01-v03 --source-commit --wait` | +| `agentrun-nc01-v02` | `pikasTech/agentrun@v0.2` | `agentrun-ci` | `agentrun-nc01-v02-ci-image-publish` | `agentrun-nc01-v02` | `platform-infra pipelines-as-code closeout --target NC01 --consumer agentrun-nc01-v02 --source-commit --wait` | +| `sentinel-nc01-v03` | `pikasTech/unidesk@master` | `devops-infra` | `hwlab-web-probe-sentinel-nc01-pac` | `hwlab-web-probe-sentinel-nc01` | `platform-infra pipelines-as-code closeout --target NC01 --consumer sentinel-nc01-v03 --source-commit --wait` | +| `hwlab-nc01-v03` | `pikasTech/HWLAB@v0.3` | `hwlab-ci` | `hwlab-nc01-v03-ci-image-publish` | `hwlab-node-v03` | `platform-infra pipelines-as-code closeout --target NC01 --consumer hwlab-nc01-v03 --source-commit --wait` | -Use `bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --limit 10` for all-consumer trigger, timing and reuse audit. It must read live Gitea Repository CR plus Tekton PipelineRun/TaskRun objects on JD01, aggregate on the target side, and print `READ_ERRORS`. +Use `bun scripts/cli.ts platform-infra pipelines-as-code history --target --limit 10` for all-consumer trigger, timing and reuse audit. It must read live Gitea Repository CR plus Tekton PipelineRun/TaskRun objects on the target node, aggregate on the target side, and print `READ_ERRORS`. ## Closeout Order -1. `bun scripts/cli.ts platform-infra gitea mirror status --target JD01` -2. `bun scripts/cli.ts platform-infra gitea mirror webhook status --target JD01` -3. `bun scripts/cli.ts platform-infra pipelines-as-code closeout --target JD01 --consumer --source-commit --wait` -4. `bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01 --consumer ` -5. `bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --consumer --limit 10` -6. For ambiguous rows, drill into the PipelineRun with `bun scripts/cli.ts platform-infra pipelines-as-code history --target JD01 --id `. +1. `bun scripts/cli.ts platform-infra gitea mirror status --target ` +2. `bun scripts/cli.ts platform-infra gitea mirror webhook status --target ` +3. `bun scripts/cli.ts platform-infra pipelines-as-code closeout --target --consumer --source-commit --wait` +4. `bun scripts/cli.ts platform-infra pipelines-as-code status --target --consumer ` +5. `bun scripts/cli.ts platform-infra pipelines-as-code history --target --consumer --limit 10` +6. For ambiguous rows, drill into the PipelineRun with `bun scripts/cli.ts platform-infra pipelines-as-code history --target --id `. `closeout` is the common formal entry for all migrated JD01 consumers. It waits only for PaC/Tekton/GitOps/Argo/runtime observation from live target-side summaries and does not trigger legacy publish paths. Consumer-specific debug commands such as Web sentinel `publish-current` are recovery/test steps only and must not be shown as the normal next action for formal delivery. diff --git a/config/agentrun.yaml b/config/agentrun.yaml index c9ef92a8..8efbfd79 100644 --- a/config/agentrun.yaml +++ b/config/agentrun.yaml @@ -924,7 +924,7 @@ controlPlane: - fenced - late-write-rejected localPostgres: - enabled: true + enabled: false serviceName: agentrun-v02-postgres image: postgres:16-alpine storage: 5Gi @@ -962,11 +962,17 @@ controlPlane: repository: pikasTech/agent_skills sourceBranch: master database: - mode: local-postgres + mode: external-postgres + provider: NC01 + configRef: config/platform-db/postgres-nc01.yaml + database: agentrun_v02 + user: agentrun_v02 + sslmode: require + secretSourceRef: agentrun/nc01-v02-mgr-db.env secretRef: name: agentrun-v02-mgr-db key: DATABASE_URL - localPostgresExpectedAbsent: false + localPostgresExpectedAbsent: true secrets: - id: manager-api-key sourceRef: hwlab/nc01-v03-admin.env @@ -1357,4 +1363,4 @@ controlPlane: targetRef: namespace: agentrun-v02 name: agentrun-v01-tool-unidesk-ssh - key: UNIDESK_SSH_CLIENT_TOKEN \ No newline at end of file + key: UNIDESK_SSH_CLIENT_TOKEN diff --git a/config/platform-db/postgres-nc01.yaml b/config/platform-db/postgres-nc01.yaml index a00ea7c4..9735d0d2 100644 --- a/config/platform-db/postgres-nc01.yaml +++ b/config/platform-db/postgres-nc01.yaml @@ -3,8 +3,9 @@ kind: postgres-host-cluster metadata: id: nc01-host-postgres - description: NC01 host-native PostgreSQL 16 for local UniDesk/HWLAB runtime state + description: NC01 host-native PostgreSQL 16 for local UniDesk/HWLAB/AgentRun runtime state owner: unidesk + relatedIssues: [] cluster: role: primary @@ -17,23 +18,69 @@ node: route: NC01 mode: host-systemd osFamily: ubuntu + requiredHostFacts: + minCpu: 1 + minMemoryGiB: 1 + minDiskFreeGiB: 5 + requireSwap: false + swap: + ensure: false + size: 1G + path: /swapfile postgres: package: manager: apt version: "16" + repo: pgdg + repoUrl: https://apt.postgresql.org/pub/repos/apt + suite: trixie-pgdg + component: main + signingKeyUrl: https://www.postgresql.org/media/keys/ACCC4CF8.asc + signedBy: /usr/share/keyrings/postgresql-pgdg.gpg + sourceList: /etc/apt/sources.list.d/pgdg.list service: name: postgresql enabled: true state: running + paths: + dataDir: /var/lib/postgresql/16/main + configDir: /etc/postgresql/16/main + logDir: /var/log/postgresql network: port: 5432 listenAddresses: - 127.0.0.1 - 10.42.0.1 connectionHost: 10.42.0.1 + publicDns: nc01-host-postgres.local transport: postgres-native-tls sslmode: require + tls: + enabled: true + mode: self-signed-server-cert + commonName: nc01-host-postgres + certFile: /etc/postgresql/16/main/server.crt + keyFile: /etc/postgresql/16/main/server.key + futureClientSslmode: require + firewall: + mode: pg-hba-declared-sources + defaultDeny: true + allowSources: + - id: nc01-local + cidr: 127.0.0.1/32 + purpose: local-admin + - id: nc01-k3s-pods + cidr: 10.42.0.0/16 + purpose: node-local-k3s-workloads + tuning: + maxConnections: 100 + sharedBuffers: 128MB + effectiveCacheSize: 4GB + workMem: 4MB + maintenanceWorkMem: 64MB + walCompression: false + checkpointCompletionTarget: 0.9 auth: passwordEncryption: scram-sha-256 pgHba: @@ -46,11 +93,80 @@ postgres: user: all address: 127.0.0.1/32 method: scram-sha-256 - - type: host - database: all - user: all + - type: hostssl + database: agentrun_v02 + user: agentrun_v02 + address: 10.42.0.0/16 + method: scram-sha-256 + - type: hostssl + database: postgres + user: agentrun_v02 address: 10.42.0.0/16 method: scram-sha-256 secrets: + source: master-local root: /root/unidesk/.state/secrets + entries: + - name: agentrun-nc01-v02-db-credentials + sourceRef: platform-db/agentrun-nc01-v02-db.env + type: env + requiredKeys: + - AGENTRUN_NC01_V02_DB_USER + - AGENTRUN_NC01_V02_DB_PASSWORD + - AGENTRUN_NC01_V02_DB_NAME + createIfMissing: + enabled: true + values: + AGENTRUN_NC01_V02_DB_USER: agentrun_v02 + AGENTRUN_NC01_V02_DB_NAME: agentrun_v02 + randomHex: + AGENTRUN_NC01_V02_DB_PASSWORD: 32 + +objects: + roles: + - name: agentrun_v02 + passwordRef: + sourceRef: platform-db/agentrun-nc01-v02-db.env + key: AGENTRUN_NC01_V02_DB_PASSWORD + login: true + attributes: + createdb: false + createrole: false + superuser: false + databases: + - name: agentrun_v02 + owner: agentrun_v02 + encoding: UTF8 + locale: C.UTF-8 + extensions: [] + +exports: + connectionStrings: + - name: agentrun-nc01-v02-database-url + sourceSecretRef: platform-db/agentrun-nc01-v02-db.env + render: + envKey: DATABASE_URL + format: postgresql://$(AGENTRUN_NC01_V02_DB_USER):$(AGENTRUN_NC01_V02_DB_PASSWORD)@$(PGHOST):5432/$(AGENTRUN_NC01_V02_DB_NAME)?sslmode=require&uselibpqcompat=true + variables: + PGHOST: 10.42.0.1 + writeToSecretSource: + sourceRef: agentrun/nc01-v02-mgr-db.env + key: DATABASE_URL + mode: update-or-insert + consumers: + - scope: agentrun-v02 + secret: agentrun-v02-mgr-db + key: DATABASE_URL + +backup: + logicalDump: + enabled: false + schedule: "*-*-* 03:37:00" + database: agentrun_v02 + retentionDays: 7 + destination: + type: local-directory + path: /var/backups/unidesk/platform-db/nc01/agentrun-v02 + encryption: + enabled: false diff --git a/docs/reference/agentrun.md b/docs/reference/agentrun.md index 9b48f1e2..2958223f 100644 --- a/docs/reference/agentrun.md +++ b/docs/reference/agentrun.md @@ -98,9 +98,9 @@ bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01 `status` 只读观察 YAML 选中 lane 的 source authority、对应 PipelineRun、GitOps latest、Argo Application、runtime workload、manager source commit 和 git mirror/Gitea 摘要，并报告 Argo revision 是否对齐该 lane 的 GitOps latest。未迁移的 legacy `v0.2` lane source authority 只来自 k8s git-mirror snapshot：受控 sync 先为 branch tip 创建 `refs/unidesk/snapshots/agentrun-yaml-lane//`，`status` / `trigger-current` / build 只读取该 snapshot 和 `sourceStageRef`，不得把 host source workspace、本地 fetch/pull、可变 branch ref 或 Pipeline 直连 GitHub 当 authoritative source。默认输出是 compact commander 视图：`target` 只保留 node/lane/source/runtime/CI/GitOps/git-mirror/database 摘要，关键结论在 `summary` 和 `alignment`，成功 probe 的 stdout/stderr tail、完整 YAML target、原始 `source`、`runtime`、`gitMirror` payload 默认省略；需要完整展开时使用返回的 `disclosure.fullCommand` 或显式加 `--full`，需要原始调试视图时加 `--raw`。`status` 额外支持 `--pipeline-run ` 与 `--source-commit ` 定点查询；`--pipeline-run` 会读取 PipelineRun `revision` 参数作为 pinned source commit，并在 `alignment.branchDrift` / `summary.branchDrift` 中同时披露当前 snapshot tip、目标 source commit、PipelineRun source commit、是否已被当前 snapshot supersede 以及 `triggerLatest` 下一步。`status` 会向 stderr 输出 `agentrun.control-plane.status.progress` 阶段事件，覆盖 `source`、`runtime` 和 `git-mirror`，避免长时间聚合时无可见进展。legacy `trigger-current` 会先执行 k8s git-mirror sync 并以 snapshot commit 创建 commit-pinned PipelineRun；同名 PipelineRun 正在运行或已经成功时必须拒绝重复触发，只允许在失败态或不存在时创建。该命令只提交 CI/CD 工作，不等待完整 PipelineRun 或 rollout 完成，后续用 `job status` 和 `status --pipeline-run ` 轮询。`refresh` 只对 YAML 声明的 Argo Application 执行 hard refresh，用于 GitOps promotion 已完成但 Argo 仍停留旧 revision 时的受控同步入口；它不直接 patch runtime workload。 -JD01 `agentrun-jd01-v02` 已迁移为 Gitea webhook -> Pipelines-as-Code -> Tekton -> GitOps/Argo -> k8s runtime 的单一路径。该 lane 不再使用 branch-follower、Gitea Actions、act_runner 或自维护 `trigger-current` 作为 CI 触发器；对应 source authority、repo visibility、public exposure 和 mirror credentials 属于 `config/platform-infra/gitea.yaml`，PaC controller/Repository/webhook/Tekton 参数属于 `config/platform-infra/pipelines-as-code.yaml`。Gitea 的公开 Web UI 是 `https://gitea.pikapython.com`，但 CI、Argo 和 runtime 内部读取必须使用 `gitea-http.devops-infra.svc.cluster.local:3000` 的 ClusterIP URL，避免公网回环和 legacy git-mirror commit 缺失。 +JD01/NC01 `agentrun--v02` PaC 迁移 lane 的正式触发链路是：GitHub PR 合并到 `pikasTech/agentrun@v0.2` -> GitHub webhook bridge 同步到 Gitea controlled mirror 和 immutable snapshot refs -> Gitea repository push webhook 触发 Pipelines-as-Code -> Tekton PipelineRun -> GitOps/Argo -> k8s runtime。该 lane 不再使用 branch-follower、Gitea Actions、act_runner 或自维护 `trigger-current` 作为正式 CI 触发器；对应 source authority、repo visibility、public exposure 和 mirror credentials 属于 `config/platform-infra/gitea.yaml`，PaC controller/Repository/webhook/Tekton 参数属于 `config/platform-infra/pipelines-as-code.yaml`。Gitea 的公开 Web UI 是 `https://gitea.pikapython.com`，但 CI、Argo 和 runtime 内部读取必须使用 `gitea-http.devops-infra.svc.cluster.local:3000` 的 ClusterIP URL，避免公网回环和 legacy git-mirror commit 缺失。 -JD01 v0.2 PaC closeout 以 `bun scripts/cli.ts platform-infra pipelines-as-code status --target JD01` 为首选状态入口。默认输出必须能直接看到 webhook 是否存在、最新 PipelineRun/TaskRun duration、image status、env identity、digest、GitOps commit、Argo revision/health 和 runtime source/env annotation。env reuse 的通过证据是 `IMAGE_STATUS=reused`、同一 env identity 和稳定 digest；首次 cache miss 可以作为冷启动事实记录，但不能替代后续 env-reuse 秒级收口。 +AgentRun PaC lane 的 closeout 以 `bun scripts/cli.ts cicd status --node ` 或 `bun scripts/cli.ts platform-infra pipelines-as-code status --target --consumer agentrun--v02` 为首选状态入口。默认输出必须能直接看到 webhook 是否存在、最新 PipelineRun/TaskRun duration、image status、env identity、digest、GitOps commit、Argo revision/health、manager Deployment readiness 和 runtime source/env annotation。env reuse 的通过证据是 `IMAGE_STATUS=reused`、同一 env identity 和稳定 digest；首次 cache miss 可以作为冷启动事实记录，但不能替代后续 env-reuse 秒级收口。若 GitHub PR 已合并但没有新 PipelineRun，应先排查 `platform-infra gitea mirror webhook status|test` 与 `platform-infra pipelines-as-code history`，不得改用 `trigger-current`、直接创建 PipelineRun、手工 push Gitea 或裸 `kubectl` 作为正式补触发。 YAML-only lane 的 `trigger-current --confirm` 是受控长流程入口；k8s git-mirror snapshot sync、image build、GitOps publish、git-mirror flush 和 PipelineRun 创建必须拆成短提交与状态轮询，不得把 clone、build、push 或长时间 polling 放进一个顶层 `trans` 长连接。`trigger-current` 返回异步 job 时，先用 `bun scripts/cli.ts job status --tail-bytes 12000` 观察 `agentrun-yaml-lane-trigger` progress，再用 `agentrun control-plane status --node --lane --pipeline-run ` 观察 Tekton、GitOps 和 Argo 对齐。后台步骤的 `status` 与 `ok` 必须共同判定，`status=succeeded` 但 `ok=false` 是终态失败，不能继续轮询到超时。GitOps publish 必须使用隔离临时 clone/worktree，不能切换或污染任何固定 source workspace；`v0.2` 历史失败 publish 若留下 dirty/detached/GitOps branch 状态，不得通过 host workspace repair 恢复 source authority，只清理已知发布残留并从 git-mirror snapshot 重新触发。 diff --git a/docs/reference/platform-infra.md b/docs/reference/platform-infra.md index 3151ea29..6c468360 100644 --- a/docs/reference/platform-infra.md +++ b/docs/reference/platform-infra.md @@ -19,7 +19,8 @@ - Applying Gitea public exposure or webhook sync must roll the affected connector workloads after Secret or ConfigMap changes. A successful Secret apply is not sufficient evidence that `frpc` loaded a new proxy; closeout should use `platform-infra gitea apply` output plus `platform-infra gitea mirror webhook status|test` rather than assuming unchanged connector Pods picked up mounted config. - The canonical PaC entrypoints are `bun scripts/cli.ts platform-infra pipelines-as-code plan|apply|status|history|webhook-test --target `. PaC status is the operator-facing closeout surface for migrated CI lanes and must expose webhook count, latest PipelineRun/TaskRun duration, image status, env identity, digest, GitOps commit, Argo revision and runtime provenance without requiring raw `kubectl`, `tkn` or Gitea UI inspection. - PaC history is the trigger/timing audit surface for Gitea/PaC-managed lanes. It must query Gitea Repository CR and Tekton PipelineRun/TaskRun live objects on the target node, aggregate there, return Beijing-time display by YAML timezone, expose a detail id for drill-down, and report read errors explicitly; a large namespace or unreadable target object must never be rendered as a successful empty table. -- `config/platform-infra/pipelines-as-code.yaml` may declare multiple repositories and consumers. JD01 currently has `agentrun-jd01-v02`, `sentinel-jd01-v03` and `hwlab-jd01-v03`; use `history --target JD01` for all-consumer audit and `status --target JD01 --consumer ` for consumer-scoped closeout. Consumer-scoped status must not mix PipelineRuns or env reuse evidence across repositories. +- Formal delivery for a PaC-migrated consumer starts with merging the GitHub PR into that consumer's YAML-declared upstream branch. The GitHub webhook bridge then syncs GitHub to the controlled Gitea mirror and immutable snapshot refs; the Gitea repository push webhook triggers Pipelines-as-Code, which creates the Tekton PipelineRun. Operators must not replace this with `trigger-current`, `webhook-test`, a direct Gitea push, raw PipelineRun creation, or a local Git mirror edit. `webhook-test` is only a connectivity diagnostic. +- `config/platform-infra/pipelines-as-code.yaml` may declare multiple repositories and consumers. JD01 and NC01 both declare AgentRun, Web sentinel and HWLAB consumers; use `cicd status --node ` for node-level status, `history --target ` for all-consumer audit, and `status --target --consumer ` for consumer-scoped closeout. Consumer-scoped status must not mix PipelineRuns or env reuse evidence across repositories. - Public Gitea UI may use the YAML-declared HTTPS hostname, but k8s-internal consumers must use the ClusterIP service URL from YAML. Internal CI/Argo/runtime reads must not loop through public DNS/Caddy/FRP, and migrated lanes must not fall back to legacy git-mirror read URLs when the commit exists only in Gitea. - A PaC-migrated lane must keep a single trigger path: Gitea webhook -> Pipelines-as-Code -> Tekton -> GitOps/Argo -> k8s runtime. Do not add Gitea Actions, `act_runner`, branch-follower or custom script fallback unless a later issue explicitly changes the architecture. `config/cicd-gitea-actions-poc.yaml` is archived POC context only; snapshot refs that still contain `gitea-actions` are historical names retained for compatibility, not evidence that Gitea Actions is active. - k8s runtime remains Docker-free from the point it pulls already built images. CI build steps may use YAML-declared native build tooling, but Docker socket/daemon access must not become part of the runtime plane. diff --git a/scripts/cli.ts b/scripts/cli.ts index f1b1474a..c7656f11 100644 --- a/scripts/cli.ts +++ b/scripts/cli.ts @@ -270,7 +270,7 @@ async function main(): Promise { if (top === "cicd") { const { runCicdCommand } = await import("./src/cicd"); - const result = await runCicdCommand(null, args.slice(1)); + const result = await runCicdCommand(readConfig(), args.slice(1)); const ok = (result as { ok?: unknown }).ok !== false; if (isRenderedCliResult(result)) { emitText(result.renderedText, result.command || commandName); diff --git a/scripts/src/agentrun-manifests.ts b/scripts/src/agentrun-manifests.ts index f73b08dd..09f71db0 100644 --- a/scripts/src/agentrun-manifests.ts +++ b/scripts/src/agentrun-manifests.ts @@ -649,8 +649,9 @@ function agentRunManagerManifests(spec: AgentRunLaneSpec, sourceCommit: string, imagePullPolicy: "IfNotPresent", ports: [{ name: "http", containerPort: 8080 }], env: managerEnv(spec, sourceCommit, imageRef, image.envIdentity), - readinessProbe: { httpGet: { path: "/health/readiness", port: "http" } }, - livenessProbe: { httpGet: { path: "/health/live", port: "http" } }, + readinessProbe: { httpGet: { path: "/health/readiness", port: "http" }, timeoutSeconds: 2 }, + livenessProbe: { httpGet: { path: "/health/live", port: "http" }, timeoutSeconds: 2 }, + startupProbe: { httpGet: { path: "/health/live", port: "http" }, periodSeconds: 10, timeoutSeconds: 2, failureThreshold: 90 }, resources: spec.deployment.manager.resources, }, ], diff --git a/scripts/src/agentrun/control-plane.ts b/scripts/src/agentrun/control-plane.ts index c30193a4..1bdb0b1a 100644 --- a/scripts/src/agentrun/control-plane.ts +++ b/scripts/src/agentrun/control-plane.ts @@ -378,6 +378,7 @@ export async function statusPipelinesAsCodeLane(config: UniDeskConfig, options: ...(expectedGitopsRevision === null || argoSyncedToGitops ? [] : ["argo-revision-stale"]), ...(runtimePayload.runtimeNamespaceExists === true ? [] : ["runtime-namespace-missing"]), ...(manager.deploymentExists === true ? [] : ["manager-deployment-missing"]), + ...(manager.deploymentExists === true && manager.ready !== true ? ["manager-not-ready"] : []), ...(manager.deploymentExists !== true || sourceCommit === null || managerSourceMatchesExpected ? [] : ["manager-source-stale"]), ...(manager.serviceExists === true ? [] : ["manager-service-missing"]), ...(spec.database.mode === "external-postgres" && database.secretPresent !== true ? ["database-secret-missing"] : []), @@ -446,9 +447,12 @@ export async function statusPipelinesAsCodeLane(config: UniDeskConfig, options: namespaceExists: runtimePayload.runtimeNamespaceExists ?? false, manager: { deploymentExists: manager.deploymentExists ?? false, + ready: manager.ready ?? false, serviceExists: manager.serviceExists ?? false, sourceCommit: stringOrNull(manager.sourceCommit), sourceMatchesExpected: managerSourceMatchesExpected, + replicas: manager.replicas ?? null, + conditions: manager.conditions ?? [], envIdentity: manager.envIdentity ?? null, }, databaseSecretPresent: database.secretPresent ?? null, @@ -590,6 +594,7 @@ export async function statusYamlLane(config: UniDeskConfig, options: StatusOptio ...(argo.exists !== true || expectedGitopsRevision === null || argoSyncedToGitops ? [] : ["argo-revision-stale"]), ...(runtimePayload.runtimeNamespaceExists === true ? [] : ["runtime-namespace-missing"]), ...(manager.deploymentExists === true ? [] : ["manager-deployment-missing"]), + ...(manager.deploymentExists === true && manager.ready !== true ? ["manager-not-ready"] : []), ...(manager.deploymentExists !== true || sourceCommit === null || managerSourceMatchesExpected ? [] : ["manager-source-stale"]), ...(manager.serviceExists === true ? [] : ["manager-service-missing"]), ...(spec.database.mode === "external-postgres" && database.secretPresent !== true ? ["database-secret-missing"] : []), @@ -678,9 +683,12 @@ export async function statusYamlLane(config: UniDeskConfig, options: StatusOptio namespaceExists: runtimePayload.runtimeNamespaceExists ?? false, manager: { deploymentExists: manager.deploymentExists ?? false, + ready: manager.ready ?? false, serviceExists: manager.serviceExists ?? false, sourceCommit: stringOrNull(manager.sourceCommit), sourceMatchesExpected: managerSourceMatchesExpected, + replicas: manager.replicas ?? null, + conditions: manager.conditions ?? [], }, databaseSecretPresent: database.secretPresent ?? null, secretsReady: secrets.ready ?? null, diff --git a/scripts/src/agentrun/entry.ts b/scripts/src/agentrun/entry.ts index af0a5f6b..3d8bed88 100644 --- a/scripts/src/agentrun/entry.ts +++ b/scripts/src/agentrun/entry.ts @@ -43,7 +43,7 @@ import { agentRunGetKindHelp, runAgentRunResourceCommand } from "./resource-acti import { runAgentRunRestCompatCommand, runGitMirrorJob, startAsyncAgentRunJob } from "./rest-bridge"; import { exposeAgentRun, restartYamlLane, secretSync, triggerCurrent } from "./trigger"; import { unsupported } from "./utils"; -import { cleanupReleasedPvs, cleanupRunners, cleanupRuns, cleanupSessionPvcs, refresh } from "./yaml-lane"; +import { cleanupLocalPostgres, cleanupReleasedPvs, cleanupRunners, cleanupRuns, cleanupSessionPvcs, refresh } from "./yaml-lane"; export function agentRunHelp(): unknown { return { @@ -92,6 +92,8 @@ export function agentRunHelp(): unknown { "bun scripts/cli.ts agentrun control-plane cleanup-runs --min-age-minutes 30 --limit 200 --confirm", "bun scripts/cli.ts agentrun control-plane cleanup-released-pvs --limit 200 --dry-run", "bun scripts/cli.ts agentrun control-plane cleanup-released-pvs --limit 200 --confirm", + "bun scripts/cli.ts agentrun control-plane cleanup-local-postgres --node NC01 --lane nc01-v02 --dry-run", + "bun scripts/cli.ts agentrun control-plane cleanup-local-postgres --node NC01 --lane nc01-v02 --confirm", "bun scripts/cli.ts agentrun git-mirror status", "bun scripts/cli.ts agentrun git-mirror status --full", "bun scripts/cli.ts agentrun git-mirror sync --confirm", @@ -147,6 +149,7 @@ export async function runAgentRunCommand(config: UniDeskConfig | null, args: str if (action === "cleanup-session-pvcs") { return await cleanupSessionPvcs(config, parseCleanupSessionPvcsOptions(actionArgs)); } + if (action === "cleanup-local-postgres") return await cleanupLocalPostgres(config, parseLaneConfirmOptions(actionArgs)); if (action === "cleanup-released-pvs") return await cleanupReleasedPvs(config, parseCleanupReleasedPvOptions(actionArgs)); } if (group === "git-mirror") { @@ -275,7 +278,7 @@ export function agentRunHelpText(args: string[]): string { return [ "Usage: bun scripts/cli.ts agentrun control-plane [options]", "", - "Actions: plan, apply, status, secret-sync, expose, trigger-current, refresh, cleanup-runners, cleanup-runs, cleanup-session-pvcs, cleanup-released-pvs", + "Actions: plan, apply, status, secret-sync, expose, trigger-current, refresh, cleanup-runners, cleanup-runs, cleanup-session-pvcs, cleanup-local-postgres, cleanup-released-pvs", "Examples:", " bun scripts/cli.ts agentrun control-plane plan --node D601 --lane v02", " bun scripts/cli.ts agentrun control-plane apply --node D601 --lane v02 --dry-run", @@ -288,6 +291,7 @@ export function agentRunHelpText(args: string[]): string { " bun scripts/cli.ts agentrun control-plane trigger-current --dry-run", " bun scripts/cli.ts agentrun control-plane cleanup-runners --node D601 --lane v02 --dry-run", " bun scripts/cli.ts agentrun control-plane cleanup-session-pvcs --node JD01 --lane jd01-v02 --dry-run", + " bun scripts/cli.ts agentrun control-plane cleanup-local-postgres --node NC01 --lane nc01-v02 --dry-run", " bun scripts/cli.ts agentrun control-plane cleanup-runs --min-age-minutes 30 --limit 200 --dry-run", ].join("\n"); } diff --git a/scripts/src/agentrun/public-exposure.ts b/scripts/src/agentrun/public-exposure.ts index bbdc5197..07058e62 100644 --- a/scripts/src/agentrun/public-exposure.ts +++ b/scripts/src/agentrun/public-exposure.ts @@ -50,6 +50,14 @@ export function agentRunControlPlaneStatusCommand(spec: AgentRunLaneSpec, option ].filter(Boolean).join(" "); } +function deploymentReplicaSummary(manager: Record): string { + const replicas = record(manager.replicas); + const desired = displayValue(replicas.desired); + const ready = displayValue(replicas.ready); + const available = displayValue(replicas.available); + return `${ready}/${desired} available=${available}`; +} + export function renderAgentRunControlPlaneStatusSummary(result: Record): RenderedCliResult { const summary = record(result.summary); const target = record(result.target); @@ -104,7 +112,7 @@ export function renderAgentRunControlPlaneStatusSummary(result: Record> { + const { configPath, spec } = resolveAgentRunLaneTarget(options); + const name = spec.deployment.localPostgres.serviceName; + const plan = { + namespace: spec.runtime.namespace, + statefulSet: name, + service: name, + pvcDisposition: "retained", + requiresDatabaseMode: "external-postgres", + valuesPrinted: false, + }; + if (spec.database.mode !== "external-postgres" || spec.deployment.localPostgres.enabled || name === null) { + return { + ok: false, + command: "agentrun control-plane cleanup-local-postgres", + mode: "blocked", + mutation: false, + configPath, + target: agentRunLaneSummary(spec), + degradedReason: "lane-is-not-external-postgres", + plan, + valuesPrinted: false, + }; + } + const confirmed = options.confirm && !options.dryRun; + const result = await capture(config, spec.nodeKubeRoute, ["sh", "--", cleanupLocalPostgresScript(spec.runtime.namespace, name, confirmed)]); + const payload = captureJsonPayload(result); + const base = { + ok: result.exitCode === 0 && payload.ok !== false, + command: "agentrun control-plane cleanup-local-postgres", + mode: confirmed ? "confirmed-cleanup" : "dry-run", + mutation: confirmed, + configPath, + target: agentRunLaneSummary(spec), + plan, + result: payload, + capture: compactCapture(result, { full: result.exitCode !== 0, stdoutTailChars: 3000, stderrTailChars: 3000 }), + valuesPrinted: false, + }; + if (!confirmed) { + return { + ...base, + next: { + confirm: `bun scripts/cli.ts agentrun control-plane cleanup-local-postgres --node ${spec.nodeId} --lane ${spec.lane} --confirm`, + status: `bun scripts/cli.ts agentrun control-plane status --node ${spec.nodeId} --lane ${spec.lane}`, + }, + }; + } + return { + ...base, + next: { + status: `bun scripts/cli.ts agentrun control-plane status --node ${spec.nodeId} --lane ${spec.lane}`, + }, + }; +} + +export function cleanupLocalPostgresScript(namespace: string, name: string, confirm: boolean): string { + return [ + "set +e", + `namespace=${shQuote(namespace)}`, + `name=${shQuote(name)}`, + `confirm=${confirm ? "true" : "false"}`, + "tmp_dir=$(mktemp -d)", + "trap 'rm -rf \"$tmp_dir\"' EXIT", + "kubectl -n \"$namespace\" get statefulset \"$name\" -o name > \"$tmp_dir/sts-before\" 2>/dev/null; sts_before=$?", + "kubectl -n \"$namespace\" get service \"$name\" -o name > \"$tmp_dir/svc-before\" 2>/dev/null; svc_before=$?", + "delete_sts_rc=0", + "delete_svc_rc=0", + "if [ \"$confirm\" = \"true\" ]; then", + " kubectl -n \"$namespace\" delete statefulset \"$name\" --ignore-not-found > \"$tmp_dir/delete-sts.out\" 2> \"$tmp_dir/delete-sts.err\"; delete_sts_rc=$?", + " kubectl -n \"$namespace\" delete service \"$name\" --ignore-not-found > \"$tmp_dir/delete-svc.out\" 2> \"$tmp_dir/delete-svc.err\"; delete_svc_rc=$?", + "else", + " : > \"$tmp_dir/delete-sts.out\"; : > \"$tmp_dir/delete-sts.err\"; : > \"$tmp_dir/delete-svc.out\"; : > \"$tmp_dir/delete-svc.err\"", + "fi", + "kubectl -n \"$namespace\" get statefulset \"$name\" -o name > \"$tmp_dir/sts-after\" 2>/dev/null; sts_after=$?", + "kubectl -n \"$namespace\" get service \"$name\" -o name > \"$tmp_dir/svc-after\" 2>/dev/null; svc_after=$?", + "NAMESPACE=\"$namespace\" NAME=\"$name\" CONFIRM=\"$confirm\" STS_BEFORE=\"$sts_before\" SVC_BEFORE=\"$svc_before\" STS_AFTER=\"$sts_after\" SVC_AFTER=\"$svc_after\" DELETE_STS_RC=\"$delete_sts_rc\" DELETE_SVC_RC=\"$delete_svc_rc\" TMP_DIR=\"$tmp_dir\" python3 - <<'PY'", + "import json, os, pathlib", + "base = pathlib.Path(os.environ['TMP_DIR'])", + "def present(name): return os.environ.get(name) == '0'", + "def text(name):", + " try: return (base / name).read_text().strip()", + " except Exception: return ''", + "payload = {", + " 'ok': os.environ.get('DELETE_STS_RC') == '0' and os.environ.get('DELETE_SVC_RC') == '0',", + " 'namespace': os.environ.get('NAMESPACE'),", + " 'name': os.environ.get('NAME'),", + " 'confirmed': os.environ.get('CONFIRM') == 'true',", + " 'before': {'statefulSetPresent': present('STS_BEFORE'), 'servicePresent': present('SVC_BEFORE')},", + " 'after': {'statefulSetPresent': present('STS_AFTER'), 'servicePresent': present('SVC_AFTER')},", + " 'deleted': {'statefulSet': text('delete-sts.out'), 'service': text('delete-svc.out')},", + " 'pvcDisposition': 'retained',", + " 'valuesPrinted': False,", + "}", + "print(json.dumps(payload, ensure_ascii=False))", + "PY", + ].join("\n"); +} + export function cleanupSessionPvcsScript(options: CleanupSessionPvcsOptions, spec: AgentRunLaneSpec): string { const retention = spec.deployment.runner.retention.sessionPvcRetention; const script = readFileSync(rootPath("scripts/src/agentrun/cleanup-session-pvcs.mjs"), "utf8"); @@ -573,6 +672,34 @@ export function yamlLaneRuntimeStatusScript(spec: AgentRunLaneSpec, pipelineRun: " for entry in envs:", " if entry.get('name') == name: return entry.get('value')", " return None", + "def int_value(value, default=0):", + " try: return int(value)", + " except Exception: return default", + "def deployment_replicas(deploy):", + " spec = (deploy or {}).get('spec') or {}", + " status = (deploy or {}).get('status') or {}", + " metadata = (deploy or {}).get('metadata') or {}", + " desired = int_value(spec.get('replicas'), 1)", + " return {", + " 'desired': desired,", + " 'ready': int_value(status.get('readyReplicas'), 0),", + " 'available': int_value(status.get('availableReplicas'), 0),", + " 'updated': int_value(status.get('updatedReplicas'), 0),", + " 'unavailable': int_value(status.get('unavailableReplicas'), 0),", + " 'generation': int_value(metadata.get('generation'), 0),", + " 'observedGeneration': int_value(status.get('observedGeneration'), 0),", + " }", + "def deployment_conditions(deploy):", + " return [{'type': c.get('type'), 'status': c.get('status'), 'reason': c.get('reason')} for c in (((deploy or {}).get('status') or {}).get('conditions') or [])]", + "def deployment_ready(deploy):", + " if deploy is None: return False", + " replicas = deployment_replicas(deploy)", + " desired = replicas['desired']", + " if desired == 0: return True", + " observed = replicas['observedGeneration']", + " generation = replicas['generation']", + " generation_current = observed == 0 or generation == 0 or observed >= generation", + " return generation_current and replicas['ready'] >= desired and replicas['available'] >= desired and replicas['updated'] >= desired", "def pipeline_run_param(obj, name):", " for entry in (((obj or {}).get('spec') or {}).get('params') or []):", " if entry.get('name') == name: return entry.get('value')", @@ -589,6 +716,9 @@ export function yamlLaneRuntimeStatusScript(spec: AgentRunLaneSpec, pipelineRun: "ports = []", "for port in ((((manager_svc or {}).get('spec') or {}).get('ports')) or []):", " ports.append({'name': port.get('name'), 'port': port.get('port'), 'targetPort': port.get('targetPort')})", + "manager_replicas = deployment_replicas(manager_deploy)", + "manager_ready = exists('MANAGER_DEPLOY_EXIT') and deployment_ready(manager_deploy)", + "manager_conditions = deployment_conditions(manager_deploy)", "matching_postgres = [line for line in re.split(r'\\r?\\n', names) if re.search('postgres', line, re.I)][:20]", "print(json.dumps({", " 'ok': exists('RUNTIME_NS_EXIT') and exists('CI_NS_EXIT'),", @@ -598,7 +728,7 @@ export function yamlLaneRuntimeStatusScript(spec: AgentRunLaneSpec, pipelineRun: " 'pipeline': {'exists': exists('PIPELINE_EXIT'), 'name': os.environ.get('pipeline_name')},", " 'pipelineRun': {'exists': exists('PIPELINERUN_EXIT'), 'name': os.environ.get('pipeline_run') or None, 'status': c.get('status'), 'reason': c.get('reason'), 'sourceCommit': pipeline_run_param(pipeline_run, 'revision'), 'startTime': ((pipeline_run or {}).get('status') or {}).get('startTime'), 'completionTime': ((pipeline_run or {}).get('status') or {}).get('completionTime')},", " 'argo': {'exists': exists('ARGO_EXIT'), 'namespace': os.environ.get('argo_namespace'), 'application': os.environ.get('argo_application'), 'revision': (((argo or {}).get('status') or {}).get('sync') or {}).get('revision'), 'syncStatus': (((argo or {}).get('status') or {}).get('sync') or {}).get('status'), 'healthStatus': (((argo or {}).get('status') or {}).get('health') or {}).get('status')},", - " 'manager': {'deploymentExists': exists('MANAGER_DEPLOY_EXIT'), 'serviceExists': exists('MANAGER_SVC_EXIT'), 'deployment': os.environ.get('manager_deployment'), 'service': os.environ.get('manager_service'), 'image': ((((((manager_deploy or {}).get('spec') or {}).get('template') or {}).get('spec') or {}).get('containers') or [{}])[0]).get('image'), 'sourceCommit': env_value(manager_deploy, 'AGENTRUN_SOURCE_COMMIT'), 'servicePorts': ports},", + " 'manager': {'deploymentExists': exists('MANAGER_DEPLOY_EXIT'), 'serviceExists': exists('MANAGER_SVC_EXIT'), 'ready': manager_ready, 'deployment': os.environ.get('manager_deployment'), 'service': os.environ.get('manager_service'), 'image': ((((((manager_deploy or {}).get('spec') or {}).get('template') or {}).get('spec') or {}).get('containers') or [{}])[0]).get('image'), 'sourceCommit': env_value(manager_deploy, 'AGENTRUN_SOURCE_COMMIT'), 'servicePorts': ports, 'replicas': manager_replicas, 'conditions': manager_conditions},", " 'database': {'secretPresent': exists('DB_SECRET_EXIT'), 'secretName': os.environ.get('database_secret'), 'key': os.environ.get('database_key'), 'keyPresent': os.environ.get('database_key') in (((db_secret or {}).get('data') or {})), 'valuesPrinted': False},", " 'secrets': secrets,", " 'localPostgres': {'absent': len(matching_postgres) == 0, 'matchingObjects': matching_postgres},", diff --git a/scripts/src/cicd-node-status.ts b/scripts/src/cicd-node-status.ts new file mode 100644 index 00000000..779e958c --- /dev/null +++ b/scripts/src/cicd-node-status.ts @@ -0,0 +1,170 @@ +import type { UniDeskConfig } from "./config"; +import { renderMachine } from "./cicd-render"; +import type { RenderedCliResult } from "./output"; +import { getPlatformInfraPipelinesAsCodeNodeStatus } from "./platform-infra-pipelines-as-code"; + +interface NodeStatusOptions { + nodeId: string | null; + targetId: string | null; + full: boolean; + raw: boolean; + output: "text" | "json"; +} + +export function cicdNodeStatusHelp(): Record { + return { + command: "cicd status --node ", + description: "Read a node-level CI/CD closeout summary for every Pipelines-as-Code consumer on the node.", + usage: [ + "bun scripts/cli.ts cicd status --node NC01", + "bun scripts/cli.ts cicd status --node NC01 --full", + "bun scripts/cli.ts cicd status --node NC01 --json", + ], + output: "compact text by default; --json/--raw returns machine payload", + source: "config/platform-infra/pipelines-as-code.yaml consumers filtered by node", + }; +} + +export async function runCicdNodeStatusCommand(config: UniDeskConfig | null, args: string[]): Promise { + if (args[0] === undefined || args.some(isHelpToken)) { + return renderMachine("cicd status", cicdNodeStatusHelp(), "json"); + } + const options = parseNodeStatusOptions(args); + if (config === null) throw new Error("cicd status requires UniDesk config; run through bun scripts/cli.ts cicd status --node "); + const result = await getPlatformInfraPipelinesAsCodeNodeStatus(config, { + targetId: options.targetId, + nodeId: options.nodeId, + full: options.full, + raw: options.raw, + }); + if (options.output === "json" || options.raw) return renderMachine("cicd status", result, "json", result.ok !== false); + return renderNodeStatus(result, options.full); +} + +function parseNodeStatusOptions(args: string[]): NodeStatusOptions { + let nodeId: string | null = null; + let targetId: string | null = null; + let full = false; + let raw = false; + let output: "text" | "json" = "text"; + for (let index = 0; index < args.length; index += 1) { + const arg = args[index]; + if (arg === "status") continue; + if (arg === "--node" || arg === "--target") { + const value = args[index + 1]; + if (value === undefined || value.startsWith("--")) throw new Error(`${arg} requires a value`); + if (!/^[A-Za-z0-9._-]+$/u.test(value)) throw new Error(`${arg} must be a simple node id`); + if (arg === "--node") nodeId = value; + else targetId = value; + index += 1; + } else if (arg === "--full") { + full = true; + } else if (arg === "--raw" || arg === "-o=json" || (arg === "-o" && args[index + 1] === "json")) { + raw = true; + full = true; + output = "json"; + if (arg === "-o") index += 1; + } else if (arg === "--json") { + output = "json"; + } else if (isHelpToken(arg)) { + output = "json"; + } else { + throw new Error(`unsupported cicd status option: ${arg}`); + } + } + if (nodeId === null && targetId === null) throw new Error("cicd status requires --node "); + return { nodeId, targetId, full, raw, output }; +} + +function renderNodeStatus(result: Record, full: boolean): RenderedCliResult { + const target = record(result.target); + const summary = record(result.summary); + const consumers = arrayRecords(result.consumers); + const rows = consumers.map((row) => [ + stringValue(row.consumer), + boolText(row.ready), + stringValue(row.pipelineStatus), + `${stringValue(row.durationSeconds)}s`, + short(stringValue(row.sourceCommit)), + short(stringValue(row.gitopsCommit)), + `${stringValue(record(row.argo).sync)}/${stringValue(record(row.argo).health)}`, + runtimeText(record(row.runtime)), + stringValue(row.reason), + ]); + const detailRows = consumers.map((row) => [ + stringValue(row.consumer), + stringValue(row.latestPipelineRun), + short(stringValue(row.digest), 18), + stringValue(row.imageStatus), + compactLine(stringValue(record(row.diagnostics).hint)), + ]); + const lines = [ + "CI/CD NODE STATUS", + ...table(["NODE", "TARGET", "READY", "READY_COUNT", "BLOCKED", "ELAPSED_MS"], [[ + stringValue(result.node), + stringValue(target.id), + boolText(summary.ready), + `${stringValue(summary.readyCount)}/${stringValue(summary.total)}`, + stringValue(summary.blockedCount), + stringValue(summary.elapsedMs), + ]]), + "", + "CONSUMERS", + ...(rows.length === 0 ? ["-"] : table(["CONSUMER", "READY", "PIPELINE", "DUR", "SOURCE", "GITOPS", "ARGO", "RUNTIME", "REASON"], rows)), + "", + ...(full ? [ + "DETAIL", + ...(detailRows.length === 0 ? ["-"] : table(["CONSUMER", "PIPELINERUN", "DIGEST", "IMAGE_STATUS", "HINT"], detailRows)), + "", + ] : []), + "NEXT", + ` refresh: ${stringValue(record(result.next).status)}`, + ` history: ${stringValue(record(result.next).history)}`, + ` closeout: ${stringValue(record(result.next).closeout)}`, + ]; + return { ok: result.ok !== false, command: "cicd status", renderedText: lines.join("\n"), contentType: "text/plain" }; +} + +function isHelpToken(value: string | undefined): boolean { + return value === "help" || value === "--help" || value === "-h"; +} + +function record(value: unknown): Record { + return typeof value === "object" && value !== null && !Array.isArray(value) ? value as Record : {}; +} + +function arrayRecords(value: unknown): Record[] { + return Array.isArray(value) ? value.filter((item) => typeof item === "object" && item !== null && !Array.isArray(item)) as Record[] : []; +} + +function stringValue(value: unknown, fallback = "-"): string { + if (typeof value === "string" && value.length > 0) return value; + if (typeof value === "number" || typeof value === "boolean") return String(value); + return fallback; +} + +function boolText(value: unknown): string { + return value === true ? "true" : "false"; +} + +function short(value: string, length = 12): string { + if (value === "-" || value.length <= length) return value; + return value.slice(0, length); +} + +function runtimeText(runtime: Record): string { + const ready = `${stringValue(runtime.readyReplicas)}/${stringValue(runtime.replicas)}`; + const digest = short(stringValue(runtime.digest), 18); + return digest === "-" ? ready : `${ready}:${digest}`; +} + +function compactLine(value: string): string { + const trimmed = value.replace(/\s+/gu, " ").trim(); + return trimmed.length > 0 ? trimmed.slice(0, 120) : "-"; +} + +function table(headers: string[], rows: string[][]): string[] { + const widths = headers.map((header, index) => Math.max(header.length, ...rows.map((row) => (row[index] ?? "").length))); + const format = (row: string[]) => row.map((cell, index) => cell.padEnd(widths[index])).join(" "); + return [format(headers), format(headers.map((header, index) => "-".repeat(Math.max(header.length, widths[index])))), ...rows.map(format)]; +} diff --git a/scripts/src/cicd.ts b/scripts/src/cicd.ts index e29e6261..a552343a 100644 --- a/scripts/src/cicd.ts +++ b/scripts/src/cicd.ts @@ -5,11 +5,16 @@ import { renderMachine } from "./cicd-render"; import type { RenderedCliResult } from "./output"; import { cicdHelp as branchFollowerHelp, runCicdCommand as runBranchFollowerCommand } from "./cicd-branch-follower"; import { cicdGiteaActionsPocHelp, runGiteaActionsPocCommand } from "./cicd-gitea-actions-poc"; +import { cicdNodeStatusHelp, runCicdNodeStatusCommand } from "./cicd-node-status"; export function cicdHelp(): unknown { return { - command: "cicd gitea-actions-poc|branch-follower", + command: "cicd status|gitea-actions-poc|branch-follower", output: "text by default for subcommands; top-level help is json", + nodeStatus: { + primary: "bun scripts/cli.ts cicd status --node NC01", + note: "Use this for node-level CI/CD status. It aggregates all current Pipelines-as-Code consumers for the node, including AgentRun, HWLAB and Web sentinel.", + }, migration: { issue: "https://github.com/pikasTech/unidesk/issues/1560", primary: "platform-infra pipelines-as-code", @@ -20,6 +25,7 @@ export function cicdHelp(): unknown { note: "JD01 CI/CD source/trigger authority is Gitea mirror -> Pipelines-as-Code -> Tekton -> Argo/k8s runtime. Gitea Actions POC and branch-follower are historical or migration-only surfaces.", }, subcommands: [ + cicdNodeStatusHelp(), cicdGiteaActionsPocHelp(), branchFollowerHelp(), ], @@ -29,7 +35,8 @@ export function cicdHelp(): unknown { export async function runCicdCommand(config: UniDeskConfig | null, args: string[]): Promise { const top = args[0]; if (top === undefined || top === "help" || top === "--help" || top === "-h") return renderMachine("cicd", cicdHelp(), "json"); + if (top === "status") return await runCicdNodeStatusCommand(config, args); if (top === "branch-follower") return await runBranchFollowerCommand(config, args); if (top === "gitea-actions-poc" || top === "gitea-builder-poc") return await runGiteaActionsPocCommand(config, args.slice(1), top); - throw new Error("cicd usage: cicd gitea-actions-poc|branch-follower"); + throw new Error("cicd usage: cicd status --node | cicd gitea-actions-poc|branch-follower"); } diff --git a/scripts/src/help.ts b/scripts/src/help.ts index 1f7407ac..183ea839 100644 --- a/scripts/src/help.ts +++ b/scripts/src/help.ts @@ -58,7 +58,8 @@ export function rootHelp(): unknown { { command: "decision requirement list|create|show|update|upsert [id|docNo] [--title text] [--body-file path] [--type external_goal|internal_goal|goal|decision|blocker|debt|experiment] [--doc-no DC-...] [--doc-type ...] [--doc-priority P0|P1|P2|P3] [--signer text] [--issued-at ISO]", description: "Manage productized requirement records over the PostgreSQL records model, excluding meeting records." }, { command: "decision show ", description: "Show one Decision Center record." }, { command: "deploy check|plan|apply [--file deploy.json|--env dev|prod] [--service id] [--commit full-sha] [--dry-run] [--force]", description: "Reconcile services from origin/master:deploy.json environments; --commit overrides one reviewed artifact consumer such as frontend for release/v1 validation or rollback. code-queue artifact consumption is dev-only." }, - { command: "cicd gitea-actions-poc plan|status", description: "Recommended CI/CD migration path for GH-1548/GH-1549: Gitea mirror and Gitea Actions driven orchestration with controlled Docker/BuildKit builder-plane, runtime plane 0 Docker and env reuse as a P0 no-regression contract." }, + { command: "cicd status --node ", description: "Show one node's CI/CD closeout summary across current Pipelines-as-Code consumers, including PipelineRun, Argo and runtime readiness." }, + { command: "cicd gitea-actions-poc plan|status", description: "Historical CI/CD migration path for GH-1548/GH-1549; current node status should use cicd status --node ." }, { command: "cicd branch-follower plan|apply|status|run-once|events|logs", description: "Deprecated migration-only Kubernetes branch follower controller; keep existing production status/debug during cutover, but do not add new self-maintained branch-following features." }, { command: "dev-env validate|prewarm-images", description: "Validate D601 unidesk-dev guardrails or prewarm dev foundation images into native k3s containerd through a bounded async job." }, { command: "artifact-registry plan|render|status|health|install|deploy-backend-core|deploy-service", description: "Manage the D601 host-managed CNCF Distribution registry and run pull-only artifact CD for supported services, including D601 direct, k3s-managed, and code-queue dev-only consumers." }, @@ -749,15 +750,17 @@ function webProbeHelpSummary(): unknown { function cicdHelpSummary(): unknown { return { - command: "cicd gitea-actions-poc plan|status | branch-follower ...", + command: "cicd status --node | gitea-actions-poc ... | branch-follower ...", output: "text by default; use --json, --raw, or -o json|yaml for machine output", usage: [ + "bun scripts/cli.ts cicd status --node NC01", + "bun scripts/cli.ts cicd status --node NC01 --full", "bun scripts/cli.ts cicd gitea-actions-poc plan", "bun scripts/cli.ts cicd gitea-actions-poc status", "bun scripts/cli.ts cicd branch-follower plan", "bun scripts/cli.ts cicd branch-follower status", ], - description: "Gitea Actions driven CI/CD migration path; branch-follower remains deprecated migration-only status/debug during cutover.", + description: "Node-level CI/CD status is the primary read path. Gitea Actions and branch-follower remain deprecated migration-only diagnostics.", }; } diff --git a/scripts/src/platform-infra-pipelines-as-code.ts b/scripts/src/platform-infra-pipelines-as-code.ts index 1af93d2c..02d404b6 100644 --- a/scripts/src/platform-infra-pipelines-as-code.ts +++ b/scripts/src/platform-infra-pipelines-as-code.ts @@ -130,6 +130,13 @@ interface CommonOptions { raw: boolean; } +export interface PipelinesAsCodeNodeStatusOptions { + targetId: string | null; + nodeId: string | null; + full: boolean; + raw: boolean; +} + interface HistoryOptions extends CommonOptions { limit: number; detailId: string | null; @@ -446,6 +453,75 @@ async function status(config: UniDeskConfig, options: CommonOptions): Promise> { + const pac = readPacConfig(); + const target = resolveTarget(pac, options.targetId ?? options.nodeId); + const nodeId = options.nodeId ?? target.id; + const consumers = pac.consumers.filter((consumer) => consumer.node.toLowerCase() === nodeId.toLowerCase()); + if (consumers.length === 0) { + throw new Error(`no Pipelines-as-Code consumers are configured for node ${nodeId}; known nodes: ${Array.from(new Set(pac.consumers.map((item) => item.node))).sort().join(", ")}`); + } + const startedAt = Date.now(); + const statuses = await Promise.all(consumers.map(async (consumer) => { + const repository = resolveRepository(pac, consumer.repositoryRef); + try { + const current = await status(config, { targetId: target.id, consumerId: consumer.id, full: false, raw: false }); + return nodeStatusRow(target.id, consumer, repository, current); + } catch (error) { + const message = error instanceof Error ? error.message : String(error); + return { + consumer: consumer.id, + node: consumer.node, + lane: consumer.lane, + repository: `${repository.owner}/${repository.repo}`, + namespace: consumer.namespace, + pipeline: consumer.pipeline, + argoApplication: consumer.argoApplication, + ready: false, + ciReady: false, + argoReady: false, + runtimeReady: false, + diagnosticsReady: false, + reason: "status-read-failed", + hint: message, + error: message, + valuesPrinted: false, + }; + } + })); + const ready = statuses.every((row) => row.ready === true); + return { + ok: ready, + action: "cicd-node-status", + mutation: false, + node: nodeId, + target: targetSummary(target), + config: { + path: configLabel, + source: "Gitea Repository CR + Tekton PipelineRun/TaskRun + Argo + runtime live objects.", + displayTimeZone: pac.display.timeZone, + valuesPrinted: false, + }, + consumers: statuses, + summary: { + ready, + total: statuses.length, + readyCount: statuses.filter((row) => row.ready === true).length, + blockedCount: statuses.filter((row) => row.ready !== true).length, + elapsedMs: Date.now() - startedAt, + valuesPrinted: false, + }, + next: { + status: `bun scripts/cli.ts cicd status --node ${nodeId}`, + history: `bun scripts/cli.ts platform-infra pipelines-as-code history --target ${target.id} --limit 10`, + closeout: `bun scripts/cli.ts platform-infra pipelines-as-code closeout --target ${target.id} --wait`, + valuesPrinted: false, + }, + details: options.full || options.raw ? statuses : undefined, + valuesPrinted: false, + }; +} + async function closeout(config: UniDeskConfig, options: CloseoutOptions): Promise> { const pac = readPacConfig(); const target = resolveTarget(pac, options.targetId); @@ -723,6 +799,75 @@ function statusSummary(payload: Record): Record): Record { + const summary = record(current.summary); + const latest = record(summary.latestPipelineRun); + const artifact = record(summary.artifact); + const argo = record(summary.argo); + const runtime = record(summary.runtime); + const diagnostics = record(summary.diagnostics); + const pipelineGate = record(summary.pipelineRunGate); + const desired = numericValue(runtime.replicas); + const readyReplicas = numericValue(runtime.readyReplicas); + const runtimeReady = desired !== null && desired > 0 && readyReplicas === desired; + const argoReady = stringValue(argo.sync) === "Synced" && stringValue(argo.health) === "Healthy"; + const ciReady = pipelineGate.ok === true; + const diagnosticsReady = diagnostics.ok !== false; + const ready = current.ok === true && ciReady && argoReady && runtimeReady && diagnosticsReady; + return { + consumer: consumer.id, + node: consumer.node, + lane: consumer.lane, + repository: `${repository.owner}/${repository.repo}`, + namespace: consumer.namespace, + pipeline: consumer.pipeline, + argoApplication: consumer.argoApplication, + ready, + ciReady, + argoReady, + runtimeReady, + diagnosticsReady, + latestPipelineRun: stringValue(latest.name), + pipelineStatus: statusText(latest), + durationSeconds: latest.durationSeconds ?? null, + sourceCommit: stringValue(latest.sourceCommit), + imageStatus: stringValue(artifact.imageStatus), + envReuse: envReuseText(record(artifact.envReuse)), + digest: stringValue(artifact.digest), + gitopsCommit: stringValue(artifact.gitopsCommit), + argo: { + sync: stringValue(argo.sync), + health: stringValue(argo.health), + revision: stringValue(argo.revision), + }, + runtime: { + deployment: stringValue(runtime.deployment), + readyReplicas: runtime.readyReplicas ?? null, + replicas: runtime.replicas ?? null, + digest: stringValue(runtime.digest), + image: stringValue(runtime.image), + }, + diagnostics: { + ok: diagnostics.ok !== false, + code: stringValue(diagnostics.code), + phase: stringValue(diagnostics.phase), + hint: compactLine(stringValue(diagnostics.hint)), + }, + reason: ready ? "ready" : nodeStatusReason({ ciReady, argoReady, runtimeReady, diagnosticsReady, pipelineStatus: statusText(latest), diagnostics }), + statusCommand: `bun scripts/cli.ts platform-infra pipelines-as-code status --target ${targetId} --consumer ${consumer.id}`, + historyCommand: `bun scripts/cli.ts platform-infra pipelines-as-code history --target ${targetId} --consumer ${consumer.id} --limit 10`, + valuesPrinted: false, + }; +} + +function nodeStatusReason(input: { ciReady: boolean; argoReady: boolean; runtimeReady: boolean; diagnosticsReady: boolean; pipelineStatus: string; diagnostics: Record }): string { + if (!input.ciReady) return `ci:${input.pipelineStatus}`; + if (!input.argoReady) return "argo-not-ready"; + if (!input.runtimeReady) return "runtime-not-ready"; + if (!input.diagnosticsReady) return stringValue(input.diagnostics.code, "diagnostics-not-ready"); + return "not-ready"; +} + function policyChecks(repository: PacRepository): Array> { return [ { name: "single-path", ok: true, detail: "Gitea webhook -> Pipelines-as-Code -> Tekton -> Argo/k8s runtime; no Gitea Actions/act_runner/branch-follower fallback." },