feat: harden HWLAB CD wrapper
This commit is contained in:
Codex
@@ -1,30 +1,43 @@
|
||||
import assert from "node:assert/strict";
|
||||
import { spawnSync } from "node:child_process";
|
||||
import { mkdirSync, writeFileSync } from "node:fs";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
import assert from "node:assert/strict";
|
||||
import { buildHwlabCdRemoteCommandForTest } from "./src/hwlab-cd";
|
||||
|
||||
type JsonRecord = Record<string, unknown>;
|
||||
|
||||
function dataOf(payload: JsonRecord): JsonRecord {
|
||||
return payload.data as JsonRecord;
|
||||
}
|
||||
|
||||
function runCli(args: string[], env: NodeJS.ProcessEnv = {}): JsonRecord {
|
||||
const result = spawnSync("bun", ["scripts/cli.ts", ...args], {
|
||||
cwd: process.cwd(),
|
||||
env: { ...process.env, ...env },
|
||||
env: {
|
||||
...process.env,
|
||||
UNIDESK_HWLAB_CD_TRANSPORT: "local",
|
||||
...env,
|
||||
},
|
||||
encoding: "utf8",
|
||||
timeout: 20_000,
|
||||
timeout: 25_000,
|
||||
});
|
||||
assert.equal(result.stderr, "", `stderr should be empty: ${result.stderr}`);
|
||||
assert.notEqual(result.stdout.trim(), "", "CLI must not produce empty output");
|
||||
const parsed = JSON.parse(result.stdout) as JsonRecord;
|
||||
if (result.status !== 0) {
|
||||
assert.equal(parsed.ok, false, `nonzero CLI should return ok=false: ${result.stdout}`);
|
||||
}
|
||||
if (result.status !== 0) assert.equal(parsed.ok, false, `nonzero CLI should return ok=false: ${result.stdout}`);
|
||||
return parsed;
|
||||
}
|
||||
|
||||
function writeJson(path: string, value: unknown): void {
|
||||
writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`);
|
||||
}
|
||||
|
||||
function makeFakeHwlabRepo(): string {
|
||||
const root = join(tmpdir(), `unidesk-hwlab-cd-wrapper-${process.pid}-${Date.now()}`);
|
||||
const root = join(tmpdir(), `unidesk-hwlab-cd-wrapper-${process.pid}-${Date.now()}-${Math.random().toString(16).slice(2)}`);
|
||||
mkdirSync(join(root, "scripts"), { recursive: true });
|
||||
mkdirSync(join(root, "deploy/k8s/base"), { recursive: true });
|
||||
mkdirSync(join(root, "reports/dev-gate"), { recursive: true });
|
||||
writeFileSync(join(root, "scripts/dev-cd-apply.mjs"), [
|
||||
"const kubeconfigIndex = process.argv.indexOf('--kubeconfig');",
|
||||
"process.stdout.write(JSON.stringify({",
|
||||
@@ -38,7 +51,7 @@ function makeFakeHwlabRepo(): string {
|
||||
" ref: 'origin/main',",
|
||||
" promotionCommit: 'abc1234567890abcdef',",
|
||||
" shortCommitId: 'abc1234',",
|
||||
" promotionSource: 'deploy-json',",
|
||||
" promotionSource: 'deploy/deploy.json',",
|
||||
" publishRequired: false,",
|
||||
" headCommitId: 'abc1234567890abcdef',",
|
||||
" headMatchesTarget: true,",
|
||||
@@ -50,40 +63,14 @@ function makeFakeHwlabRepo(): string {
|
||||
" artifactCatalog: { path: 'deploy/artifact-catalog.dev.json', commitId: 'abc1234', artifactState: 'published', ciPublished: true, registryVerified: true },",
|
||||
" artifactReport: { path: 'reports/dev-gate/dev-artifacts.json', commitId: 'abc1234' },",
|
||||
" lock: { status: 'absent' },",
|
||||
" liveDelta: { status: 'unknown' },",
|
||||
" liveDelta: { status: 'not_run', reason: '--skip-live-verify' },",
|
||||
" kubeconfig: kubeconfigIndex >= 0 ? process.argv[kubeconfigIndex + 1] : null",
|
||||
"}, null, 2));",
|
||||
].join("\n"));
|
||||
writeFileSync(join(root, "scripts/dev-deploy-apply.mjs"), [
|
||||
"const dryRun = process.argv.includes('--dry-run');",
|
||||
"const kubeconfigIndex = process.argv.indexOf('--kubeconfig');",
|
||||
"process.stdout.write(JSON.stringify({",
|
||||
" reportVersion: 'v1',",
|
||||
" status: dryRun ? 'pass' : 'blocked',",
|
||||
" commitId: 'abc1234',",
|
||||
" namespace: 'hwlab-dev',",
|
||||
" endpoint: 'http://74.48.78.17:16667',",
|
||||
" blockers: [],",
|
||||
" devDeployApply: {",
|
||||
" conclusion: { status: 'ready', blockerCount: 0 },",
|
||||
" artifactPlan: { expectedArtifactCommit: 'abc1234', deployCommitId: 'abc1234', catalogCommitId: 'abc1234', published: true, registryVerified: true, imageCount: 13, requiredServiceCount: 13, unpublishedServices: [] },",
|
||||
" applyBoundary: { currentMode: 'dry-run', defaultNoWrite: true, mutationAttempted: false, mutationAllowed: false, kubeconfigSource: 'flag:--kubeconfig', writeScope: 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl apply -k deploy/k8s/dev', noWriteScope: 'server-side dry-run only', forbiddenActions: ['prod-deploy'] },",
|
||||
" applyStep: { status: 'pass', command: 'KUBECONFIG=/etc/rancher/k3s/k3s.yaml kubectl apply --dry-run=server -k deploy/k8s/dev', mutationAttempted: false },",
|
||||
" manualCommands: { status: 'ready' }",
|
||||
" },",
|
||||
" kubeconfig: kubeconfigIndex >= 0 ? process.argv[kubeconfigIndex + 1] : null",
|
||||
"}, null, 2));",
|
||||
].join("\n"));
|
||||
writeFileSync(join(root, "scripts/deploy-desired-state-plan.mjs"), [
|
||||
"process.stdout.write(JSON.stringify({",
|
||||
" kind: 'hwlab-deploy-desired-state-plan',",
|
||||
" mode: 'read-only-plan',",
|
||||
" status: 'pass',",
|
||||
" source: { deploy: 'deploy/deploy.json', artifactCatalog: 'deploy/artifact-catalog.dev.json', workloads: 'deploy/k8s/base/workloads.yaml', optionalReport: 'reports/dev-gate/dev-artifacts.json' },",
|
||||
" promotionBoundary: { authoritativeDesiredState: ['deploy/deploy.json', 'deploy/artifact-catalog.dev.json', 'deploy/k8s/base/workloads.yaml'], nonAuthoritativeEvidence: ['reports/dev-gate/dev-artifacts.json'] },",
|
||||
" summary: { desiredCommitId: 'abc1234', desiredImageTag: 'abc1234', artifactState: 'published', ciPublished: true, registryVerified: true, services: 13, workloadContainers: 13, diagnostics: 0, blockers: 0, targetConvergence: 'not_requested' }",
|
||||
"}, null, 2));",
|
||||
].join("\n"));
|
||||
writeJson(join(root, "deploy/deploy.json"), { commitId: "abc1234", environment: "dev", namespace: "hwlab-dev", endpoint: "http://74.48.78.17:16667" });
|
||||
writeJson(join(root, "deploy/artifact-catalog.dev.json"), { commitId: "abc1234", artifactState: "published", publish: { ciPublished: true, registryVerified: true }, services: [{ id: "hwlab-cloud-api", digest: "sha256:" + "a".repeat(64) }] });
|
||||
writeJson(join(root, "reports/dev-gate/dev-artifacts.json"), { commitId: "abc1234", artifactPublish: { sourceCommitId: "abc1234", serviceCount: 1, ciPublished: true, registryVerified: true } });
|
||||
writeFileSync(join(root, "deploy/k8s/base/workloads.yaml"), "apiVersion: v1\nkind: List\nitems: []\n");
|
||||
spawnSync("git", ["init", "-b", "main"], { cwd: root, encoding: "utf8" });
|
||||
spawnSync("git", ["config", "user.email", "test@example.invalid"], { cwd: root, encoding: "utf8" });
|
||||
spawnSync("git", ["config", "user.name", "HWLAB CD Test"], { cwd: root, encoding: "utf8" });
|
||||
@@ -95,19 +82,19 @@ function makeFakeHwlabRepo(): string {
|
||||
return root;
|
||||
}
|
||||
|
||||
function makeFakeBin(mode: "native" | "desktop" | "stale-default" | "wrong-node" | "missing-secret"): string {
|
||||
const bin = join(tmpdir(), `unidesk-hwlab-cd-bin-${process.pid}-${Date.now()}-${mode}`);
|
||||
function makeFakeBin(mode: "native" | "desktop" | "stale-default" | "wrong-node" | "missing-secret" | "second-plane"): string {
|
||||
const bin = join(tmpdir(), `unidesk-hwlab-cd-bin-${process.pid}-${Date.now()}-${mode}-${Math.random().toString(16).slice(2)}`);
|
||||
mkdirSync(bin, { recursive: true });
|
||||
const explicitContext = mode === "desktop" ? "docker-desktop" : "default";
|
||||
const explicitServer = mode === "desktop" ? "https://127.0.0.1:11700" : "https://127.0.0.1:6443";
|
||||
const explicitNodes = mode === "desktop" ? "desktop-control-plane" : mode === "wrong-node" ? "d602" : "d601";
|
||||
const defaultContext = mode === "stale-default" ? "docker-desktop" : explicitContext;
|
||||
const defaultServer = mode === "stale-default" ? "https://127.0.0.1:11700" : explicitServer;
|
||||
const defaultContext = mode === "stale-default" ? "docker-desktop" : mode === "second-plane" ? "other-k3s" : explicitContext;
|
||||
const defaultServer = mode === "stale-default" ? "https://127.0.0.1:11700" : mode === "second-plane" ? "https://10.0.0.2:6443" : explicitServer;
|
||||
const defaultNodes = mode === "stale-default" ? "desktop-control-plane" : explicitNodes;
|
||||
const defaultNamespaceOk = mode === "second-plane";
|
||||
writeFileSync(join(bin, "kubectl"), [
|
||||
"#!/usr/bin/env bash",
|
||||
"set -euo pipefail",
|
||||
"printf 'KUBECONFIG=%s\\n' \"${KUBECONFIG:-}\" >&2",
|
||||
"context=" + JSON.stringify(explicitContext),
|
||||
"server=" + JSON.stringify(explicitServer),
|
||||
"nodes=" + JSON.stringify(explicitNodes),
|
||||
@@ -119,33 +106,56 @@ function makeFakeBin(mode: "native" | "desktop" | "stale-default" | "wrong-node"
|
||||
"if [[ \"$*\" == 'config current-context' ]]; then printf '%s\\n' \"$context\"; exit 0; fi",
|
||||
"if [[ \"$*\" == 'config view --minify -o jsonpath={.clusters[0].cluster.server}' ]]; then printf '%s' \"$server\"; exit 0; fi",
|
||||
"if [[ \"$*\" == 'get nodes -o jsonpath={range .items[*]}{.metadata.name}{\"\\n\"}{end}' ]]; then printf '%s\\n' \"$nodes\"; exit 0; fi",
|
||||
"if [[ \"$*\" == '-n hwlab-dev get lease hwlab-dev-cd-lock -o json' ]]; then printf 'Error from server (NotFound): leases.coordination.k8s.io \"hwlab-dev-cd-lock\" not found\\n' >&2; exit 1; fi",
|
||||
"if [[ \"$*\" == '-n hwlab-dev get deploy -o jsonpath={range .items[*]}{.metadata.name}{\"\\t\"}{range .spec.template.spec.containers[*]}{.name}{\"=\"}{.image}{\",\"}{end}{\"\\n\"}{end}' ]]; then printf 'hwlab-cloud-api\\thwlab-cloud-api=127.0.0.1:5000/hwlab/hwlab-cloud-api:abc1234,\\n'; exit 0; fi",
|
||||
"if [[ \"$*\" == 'get namespace hwlab-dev -o name' ]]; then",
|
||||
" if [[ \"${KUBECONFIG:-}\" == '' && " + JSON.stringify(defaultNamespaceOk ? "yes" : "no") + " == 'yes' ]]; then printf 'namespace/hwlab-dev\\n'; exit 0; fi",
|
||||
" if [[ \"${KUBECONFIG:-}\" != '' ]]; then printf 'namespace/hwlab-dev\\n'; exit 0; fi",
|
||||
" printf 'Error from server (NotFound): namespaces \"hwlab-dev\" not found\\n' >&2; exit 1",
|
||||
"fi",
|
||||
"if [[ \"$*\" =~ ^-n[[:space:]]+hwlab-dev[[:space:]]+get[[:space:]]+lease[[:space:]]+hwlab-dev-cd-lock[[:space:]]+-o[[:space:]]+json$ ]]; then printf 'Error from server (NotFound): leases.coordination.k8s.io \"hwlab-dev-cd-lock\" not found\\n' >&2; exit 1; fi",
|
||||
"if [[ \"$*\" == '-n hwlab-dev get secret hwlab-code-agent-provider -o name' && " + JSON.stringify(mode) + " == 'missing-secret' ]]; then printf 'Error from server (NotFound): secrets \"hwlab-code-agent-provider\" not found\\n' >&2; exit 1; fi",
|
||||
"if [[ \"$*\" =~ ^-n\\ hwlab-dev\\ get\\ secret\\ ([^[:space:]]+)\\ -o\\ name$ ]]; then printf 'secret/%s\\n' \"${BASH_REMATCH[1]}\"; exit 0; fi",
|
||||
"if [[ \"$*\" == '-n hwlab-dev describe secret hwlab-cloud-api-dev-db' ]]; then printf 'Name: hwlab-cloud-api-dev-db\\nData\\n====\\ndatabase-url: 48 bytes\\n'; exit 0; fi",
|
||||
"if [[ \"$*\" == '-n hwlab-dev describe secret hwlab-cloud-api-dev-db-admin' ]]; then printf 'Name: hwlab-cloud-api-dev-db-admin\\nData\\n====\\nadmin-url: 48 bytes\\n'; exit 0; fi",
|
||||
"if [[ \"$*\" == '-n hwlab-dev describe secret hwlab-code-agent-provider' ]]; then printf 'Name: hwlab-code-agent-provider\\nData\\n====\\nopenai-api-key: 48 bytes\\n'; exit 0; fi",
|
||||
"printf '{}\\n'",
|
||||
"printf 'unexpected kubectl args: %s\\n' \"$*\" >&2; exit 99",
|
||||
].join("\n"));
|
||||
spawnSync("chmod", ["+x", join(bin, "kubectl")]);
|
||||
return bin;
|
||||
}
|
||||
|
||||
function scopes(data: JsonRecord): string[] {
|
||||
return ((data.blockers ?? []) as JsonRecord[]).map((blocker) => String(blocker.scope ?? ""));
|
||||
}
|
||||
|
||||
function withLocalTransport(args: string[]): string[] {
|
||||
return [...args, "--transport", "local"];
|
||||
}
|
||||
|
||||
const fakeRepo = makeFakeHwlabRepo();
|
||||
const nativeBin = makeFakeBin("native");
|
||||
const desktopBin = makeFakeBin("desktop");
|
||||
const staleDefaultBin = makeFakeBin("stale-default");
|
||||
const wrongNodeBin = makeFakeBin("wrong-node");
|
||||
const missingSecretBin = makeFakeBin("missing-secret");
|
||||
const liveBody = "data:application/json,%7B%22serviceId%22%3A%22hwlab-cloud-web%22%2C%22environment%22%3A%22dev%22%2C%22status%22%3A%22ok%22%2C%22revision%22%3A%22abc1234%22%7D";
|
||||
const apiBody = "data:application/json,%7B%22serviceId%22%3A%22hwlab-cloud-api%22%2C%22environment%22%3A%22dev%22%2C%22status%22%3A%22ok%22%2C%22revision%22%3A%22abc1234%22%7D";
|
||||
const secondPlaneBin = makeFakeBin("second-plane");
|
||||
|
||||
const help = runCli(["hwlab", "help"]);
|
||||
assert.equal(help.ok, true);
|
||||
assert.equal((help.data as JsonRecord).command, "hwlab cd");
|
||||
|
||||
const runnerHistoryRepo = runCli([
|
||||
const remoteCommand = buildHwlabCdRemoteCommandForTest(withLocalTransport(["cd", "apply", "--env", "dev", "--dry-run"]));
|
||||
assert.equal(remoteCommand.includes("scripts/dev-cd-apply.mjs"), true);
|
||||
assert.equal(remoteCommand.includes("/etc/rancher/k3s/k3s.yaml"), true);
|
||||
assert.equal(remoteCommand.includes("kubectl rollout"), false);
|
||||
|
||||
const realApply = runCli(["hwlab", "cd", "apply", "--env", "dev", "--hwlab-repo", fakeRepo], {
|
||||
PATH: `${nativeBin}:${process.env.PATH ?? ""}`,
|
||||
});
|
||||
assert.equal(realApply.ok, false);
|
||||
assert.equal(dataOf(realApply).error, "host-commander-only-real-apply");
|
||||
assert.equal((dataOf(realApply).safety as JsonRecord).rolloutExecuted, false);
|
||||
|
||||
const runnerHistoryRepo = runCli(withLocalTransport([
|
||||
"hwlab",
|
||||
"cd",
|
||||
"status",
|
||||
@@ -153,15 +163,13 @@ const runnerHistoryRepo = runCli([
|
||||
"dev",
|
||||
"--hwlab-repo",
|
||||
"/home/ubuntu/hwlab",
|
||||
], {
|
||||
]), {
|
||||
PATH: `${nativeBin}:${process.env.PATH ?? ""}`,
|
||||
});
|
||||
assert.equal(runnerHistoryRepo.ok, false);
|
||||
const runnerHistoryCandidates = ((runnerHistoryRepo.data as JsonRecord).repo as JsonRecord).candidates as JsonRecord[];
|
||||
assert.equal(runnerHistoryCandidates[0]?.rejected, true);
|
||||
assert.equal(runnerHistoryCandidates[0]?.rejectionReason, "runner-history-directory-is-not-hwlab-cd-release-truth");
|
||||
assert.equal((dataOf(runnerHistoryRepo).repo as JsonRecord).rejected, true);
|
||||
|
||||
const applyDryRun = runCli([
|
||||
const applyDryRun = runCli(withLocalTransport([
|
||||
"hwlab",
|
||||
"cd",
|
||||
"apply",
|
||||
@@ -170,55 +178,30 @@ const applyDryRun = runCli([
|
||||
"--dry-run",
|
||||
"--hwlab-repo",
|
||||
fakeRepo,
|
||||
], {
|
||||
]), {
|
||||
PATH: `${nativeBin}:${process.env.PATH ?? ""}`,
|
||||
});
|
||||
assert.equal(applyDryRun.ok, true);
|
||||
const dryRunData = applyDryRun.data as JsonRecord;
|
||||
const dryRunData = dataOf(applyDryRun);
|
||||
assert.equal(dryRunData.dryRun, true);
|
||||
assert.equal(dryRunData.mutation, false);
|
||||
assert.equal(((dryRunData.d601NativeK3sGuard as JsonRecord).injectedEnv as JsonRecord).KUBECONFIG, "/etc/rancher/k3s/k3s.yaml");
|
||||
assert.equal((dryRunData.d601NativeK3sGuard as JsonRecord).requiredNodePresent, true);
|
||||
assert.equal((dryRunData.controlledDryRun as JsonRecord).commandOk, true);
|
||||
assert.equal((dryRunData.secretRefPreflight as JsonRecord).status, "pass");
|
||||
assert.equal(((dryRunData.controlledDryRun as JsonRecord).controlledEntrypoint), "scripts/dev-cd-apply.mjs");
|
||||
assert.equal(((dryRunData.hostCommanderOnlyLiveApply as JsonRecord).commandShape as unknown[]).includes("scripts/dev-cd-apply.mjs"), true);
|
||||
assert.equal((dryRunData.safety as JsonRecord).kubectlApplyExecuted, false);
|
||||
assert.equal((dryRunData.safety as JsonRecord).rolloutExecuted, false);
|
||||
assert.equal((dryRunData.safety as JsonRecord).liveVerifyExecuted, false);
|
||||
assert.equal((dryRunData.safety as JsonRecord).cdLockMutated, false);
|
||||
assert.equal((dryRunData.safety as JsonRecord).secretValuesPrinted, false);
|
||||
assert.equal((dryRunData.remote as JsonRecord).providerId, "D601");
|
||||
assert.equal(((dryRunData.remote as JsonRecord).commandCalls as unknown[]).includes("scripts/dev-cd-apply.mjs"), true);
|
||||
assert.equal((dryRunData.kubeconfig as JsonRecord).path, "/etc/rancher/k3s/k3s.yaml");
|
||||
assert.equal((dryRunData.nodeGuard as JsonRecord).requiredNodePresent, true);
|
||||
assert.equal((dryRunData.worktreeGuard as JsonRecord).clean, true);
|
||||
assert.equal((dryRunData.secretPreflight as JsonRecord).status, "pass");
|
||||
assert.equal((dryRunData.controlledDevCd as JsonRecord).controlledEntrypoint, "scripts/dev-cd-apply.mjs");
|
||||
assert.equal(((dryRunData.target as JsonRecord).promotionCommit), "abc1234567890abcdef");
|
||||
assert.equal(((dryRunData.promotion as JsonRecord).source), "deploy/deploy.json");
|
||||
assert.equal(JSON.stringify(dryRunData).includes("sk-secret"), false);
|
||||
|
||||
const preflight = runCli([
|
||||
"hwlab",
|
||||
"cd",
|
||||
"preflight",
|
||||
"--env",
|
||||
"dev",
|
||||
"--hwlab-repo",
|
||||
fakeRepo,
|
||||
], {
|
||||
PATH: `${nativeBin}:${process.env.PATH ?? ""}`,
|
||||
UNIDESK_HWLAB_CD_TEST_FRONTEND_LIVE_URL: liveBody,
|
||||
UNIDESK_HWLAB_CD_TEST_API_LIVE_URL: apiBody,
|
||||
});
|
||||
assert.equal(preflight.ok, true);
|
||||
const preflightData = preflight.data as JsonRecord;
|
||||
assert.equal(preflightData.mutation, false);
|
||||
assert.equal((preflightData.secretRefPreflight as JsonRecord).status, "pass");
|
||||
assert.equal((preflightData.liveWorkloads as JsonRecord).status, "observed");
|
||||
|
||||
const realApply = runCli([
|
||||
"hwlab",
|
||||
"cd",
|
||||
"apply",
|
||||
"--env",
|
||||
"dev",
|
||||
"--hwlab-repo",
|
||||
fakeRepo,
|
||||
], {
|
||||
PATH: `${nativeBin}:${process.env.PATH ?? ""}`,
|
||||
});
|
||||
assert.equal(realApply.ok, false);
|
||||
assert.equal((realApply.data as JsonRecord).error, "host-commander-only-real-apply");
|
||||
|
||||
const status = runCli([
|
||||
const status = runCli(withLocalTransport([
|
||||
"hwlab",
|
||||
"cd",
|
||||
"status",
|
||||
@@ -226,18 +209,16 @@ const status = runCli([
|
||||
"dev",
|
||||
"--hwlab-repo",
|
||||
fakeRepo,
|
||||
], {
|
||||
]), {
|
||||
PATH: `${nativeBin}:${process.env.PATH ?? ""}`,
|
||||
UNIDESK_HWLAB_CD_TEST_FRONTEND_LIVE_URL: liveBody,
|
||||
UNIDESK_HWLAB_CD_TEST_API_LIVE_URL: apiBody,
|
||||
});
|
||||
assert.equal(status.ok, true);
|
||||
const statusData = status.data as JsonRecord;
|
||||
assert.equal(((statusData.d601NativeK3sGuard as JsonRecord).injectedEnv as JsonRecord).KUBECONFIG, "/etc/rancher/k3s/k3s.yaml");
|
||||
assert.equal((statusData.liveRevisions as JsonRecord).status, "observed");
|
||||
assert.ok(typeof statusData.dumpDir === "string" && String(statusData.dumpDir).includes(".state/hwlab-cd"));
|
||||
const statusData = dataOf(status);
|
||||
assert.equal((statusData.secretPreflight as JsonRecord).status, "skipped");
|
||||
assert.equal((statusData.lockState as JsonRecord).status, "absent");
|
||||
assert.ok(typeof statusData.reportDumpPath === "string");
|
||||
|
||||
const staleDefaultOk = runCli([
|
||||
const staleDefaultOk = runCli(withLocalTransport([
|
||||
"hwlab",
|
||||
"cd",
|
||||
"apply",
|
||||
@@ -246,18 +227,17 @@ const staleDefaultOk = runCli([
|
||||
"--dry-run",
|
||||
"--hwlab-repo",
|
||||
fakeRepo,
|
||||
], {
|
||||
]), {
|
||||
PATH: `${staleDefaultBin}:${process.env.PATH ?? ""}`,
|
||||
KUBECONFIG: "",
|
||||
});
|
||||
assert.equal(staleDefaultOk.ok, true);
|
||||
const staleDefaultGuard = (staleDefaultOk.data as JsonRecord).d601NativeK3sGuard as JsonRecord;
|
||||
const staleDefaultGuard = dataOf(staleDefaultOk).nodeGuard as JsonRecord;
|
||||
assert.equal(staleDefaultGuard.status, "pass");
|
||||
assert.equal(staleDefaultGuard.refusal, false);
|
||||
assert.equal((staleDefaultGuard.defaultKubectlDiagnostic as JsonRecord).status, "stale-forbidden-default");
|
||||
assert.deepEqual((staleDefaultGuard.defaultKubectlDiagnostic as JsonRecord).refusalSignals, ["docker-desktop", "desktop-control-plane", "127.0.0.1:11700"]);
|
||||
|
||||
const desktopRefusal = runCli([
|
||||
const desktopRefusal = runCli(withLocalTransport([
|
||||
"hwlab",
|
||||
"cd",
|
||||
"apply",
|
||||
@@ -266,14 +246,15 @@ const desktopRefusal = runCli([
|
||||
"--dry-run",
|
||||
"--hwlab-repo",
|
||||
fakeRepo,
|
||||
], {
|
||||
]), {
|
||||
PATH: `${desktopBin}:${process.env.PATH ?? ""}`,
|
||||
});
|
||||
assert.equal(desktopRefusal.ok, false);
|
||||
assert.equal((desktopRefusal.data as JsonRecord).error, "native-k3s-guard-refused");
|
||||
assert.deepEqual((desktopRefusal.data as JsonRecord).d601NativeK3sGuard && ((desktopRefusal.data as JsonRecord).d601NativeK3sGuard as JsonRecord).refusalSignals, ["docker-desktop", "desktop-control-plane", "127.0.0.1:11700"]);
|
||||
const desktopData = dataOf(desktopRefusal);
|
||||
assert.equal(desktopData.status, "refused");
|
||||
assert.deepEqual((desktopData.nodeGuard as JsonRecord).refusalSignals, ["docker-desktop", "desktop-control-plane", "127.0.0.1:11700"]);
|
||||
|
||||
const wrongNodeBlocked = runCli([
|
||||
const wrongNodeBlocked = runCli(withLocalTransport([
|
||||
"hwlab",
|
||||
"cd",
|
||||
"apply",
|
||||
@@ -282,16 +263,15 @@ const wrongNodeBlocked = runCli([
|
||||
"--dry-run",
|
||||
"--hwlab-repo",
|
||||
fakeRepo,
|
||||
], {
|
||||
]), {
|
||||
PATH: `${wrongNodeBin}:${process.env.PATH ?? ""}`,
|
||||
});
|
||||
assert.equal(wrongNodeBlocked.ok, false);
|
||||
const wrongNodeGuard = (wrongNodeBlocked.data as JsonRecord).d601NativeK3sGuard as JsonRecord;
|
||||
assert.equal(wrongNodeGuard.status, "blocked");
|
||||
assert.equal(wrongNodeGuard.requiredNodePresent, false);
|
||||
assert.equal(((wrongNodeBlocked.data as JsonRecord).blockers as JsonRecord[]).some((blocker) => blocker.scope === "d601-native-k3s-guard"), true);
|
||||
const wrongNodeData = dataOf(wrongNodeBlocked);
|
||||
assert.equal((wrongNodeData.nodeGuard as JsonRecord).requiredNodePresent, false);
|
||||
assert.equal(scopes(wrongNodeData).includes("d601-native-k3s-guard"), true);
|
||||
|
||||
const missingSecretBlocked = runCli([
|
||||
const missingSecretBlocked = runCli(withLocalTransport([
|
||||
"hwlab",
|
||||
"cd",
|
||||
"apply",
|
||||
@@ -300,14 +280,46 @@ const missingSecretBlocked = runCli([
|
||||
"--dry-run",
|
||||
"--hwlab-repo",
|
||||
fakeRepo,
|
||||
], {
|
||||
]), {
|
||||
PATH: `${missingSecretBin}:${process.env.PATH ?? ""}`,
|
||||
});
|
||||
assert.equal(missingSecretBlocked.ok, false);
|
||||
const missingSecretData = missingSecretBlocked.data as JsonRecord;
|
||||
assert.equal((missingSecretData.secretRefPreflight as JsonRecord).status, "blocked");
|
||||
assert.equal((missingSecretData.controlledDryRun as JsonRecord).status, "skipped");
|
||||
assert.equal((missingSecretData.blockers as JsonRecord[]).some((blocker) => blocker.scope === "secretref:hwlab-code-agent-provider/openai-api-key"), true);
|
||||
const missingSecretData = dataOf(missingSecretBlocked);
|
||||
assert.equal((missingSecretData.secretPreflight as JsonRecord).status, "blocked");
|
||||
assert.equal((missingSecretData.controlledDevCd as JsonRecord).status, "skipped");
|
||||
assert.equal(scopes(missingSecretData).includes("secretref:hwlab-code-agent-provider/openai-api-key"), true);
|
||||
assert.equal(JSON.stringify(missingSecretData).includes("sk-secret"), false);
|
||||
|
||||
const secondPlaneBlocked = runCli(withLocalTransport([
|
||||
"hwlab",
|
||||
"cd",
|
||||
"apply",
|
||||
"--env",
|
||||
"dev",
|
||||
"--dry-run",
|
||||
"--hwlab-repo",
|
||||
fakeRepo,
|
||||
]), {
|
||||
PATH: `${secondPlaneBin}:${process.env.PATH ?? ""}`,
|
||||
});
|
||||
assert.equal(secondPlaneBlocked.ok, false);
|
||||
assert.equal(((dataOf(secondPlaneBlocked).nodeGuard as JsonRecord).defaultKubectlDiagnostic as JsonRecord).secondControlPlaneRisk, true);
|
||||
assert.equal(scopes(dataOf(secondPlaneBlocked)).includes("second-hwlab-dev-control-plane"), true);
|
||||
|
||||
writeFileSync(join(fakeRepo, "dirty.txt"), "dirty\n");
|
||||
const dirtyBlocked = runCli(withLocalTransport([
|
||||
"hwlab",
|
||||
"cd",
|
||||
"apply",
|
||||
"--env",
|
||||
"dev",
|
||||
"--dry-run",
|
||||
"--hwlab-repo",
|
||||
fakeRepo,
|
||||
]), {
|
||||
PATH: `${nativeBin}:${process.env.PATH ?? ""}`,
|
||||
});
|
||||
assert.equal(dirtyBlocked.ok, false);
|
||||
assert.equal(scopes(dataOf(dirtyBlocked)).includes("hwlab-git-clean"), true);
|
||||
|
||||
console.log(JSON.stringify({ ok: true, checked: "hwlab-cd-wrapper-contract" }));
|
||||
|
||||
Reference in New Issue
Block a user