Codex
425 lines
17 KiB
TypeScript
425 lines
17 KiB
TypeScript
import { existsSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
|
|
import { tmpdir } from "node:os";
|
|
import { resolve } from "node:path";
|
|
import { spawnSync } from "node:child_process";
|
|
|
|
import {
|
|
resolveSelfMediaDeliveryTarget,
|
|
resolveSelfMediaDeliveryTargetByConfigRef,
|
|
selfMediaDeliveryConfigRef,
|
|
selfMediaEffectiveDeployment,
|
|
type SelfMediaDeliveryTarget,
|
|
} from "./selfmedia-config";
|
|
import { stableJsonSha256 } from "./stable-json";
|
|
|
|
export interface SelfMediaRendererBinding {
|
|
readonly consumer: {
|
|
readonly id: string;
|
|
readonly node: string;
|
|
readonly lane: string;
|
|
readonly namespace: string;
|
|
readonly pipeline: string;
|
|
readonly pipelineRunPrefix: string;
|
|
readonly sourceArtifact: {
|
|
readonly configRef: string;
|
|
readonly mode: string;
|
|
readonly renderer: string;
|
|
};
|
|
};
|
|
readonly repository: {
|
|
readonly id: string;
|
|
readonly params: Readonly<Record<string, string>>;
|
|
};
|
|
}
|
|
|
|
export interface SelfMediaRenderedPipeline {
|
|
readonly pipeline: Record<string, unknown>;
|
|
readonly configRef: string;
|
|
readonly effectiveConfigSha256: string;
|
|
readonly sourceWorktreeRemote: string;
|
|
}
|
|
|
|
export function renderSelfMediaDesiredPipeline(binding: SelfMediaRendererBinding, sourceWorktree: string): SelfMediaRenderedPipeline {
|
|
const target = resolveSelfMediaDeliveryTargetByConfigRef(binding.consumer.sourceArtifact.configRef);
|
|
const configRef = selfMediaDeliveryConfigRef(target.id);
|
|
if (binding.consumer.sourceArtifact.renderer !== "selfmedia-runtime" || binding.consumer.sourceArtifact.mode !== "embedded-pipeline-spec") {
|
|
throw new Error("selfmedia-runtime requires embedded-pipeline-spec");
|
|
}
|
|
if (binding.consumer.sourceArtifact.configRef !== configRef) {
|
|
throw new Error(`sourceArtifact.configRef must equal resolved owning selector ${configRef}; observed ${binding.consumer.sourceArtifact.configRef}`);
|
|
}
|
|
assertBinding(target, binding);
|
|
assertServiceRepositoryContract(sourceWorktree);
|
|
const effectiveDeployment = selfMediaEffectiveDeployment(target);
|
|
validateRuntimeRender(sourceWorktree, effectiveDeployment);
|
|
const effectiveDeploymentB64 = Buffer.from(`${Bun.YAML.stringify(effectiveDeployment).trim()}\n`, "utf8").toString("base64");
|
|
return {
|
|
pipeline: pipeline(target, effectiveDeploymentB64),
|
|
configRef,
|
|
effectiveConfigSha256: stableJsonSha256(target),
|
|
sourceWorktreeRemote: target.source.worktreeRemote,
|
|
};
|
|
}
|
|
|
|
export function selfMediaSourceWorktreeRemote(targetId: string): string {
|
|
return resolveSelfMediaDeliveryTarget(targetId).source.worktreeRemote;
|
|
}
|
|
|
|
function pipeline(target: SelfMediaDeliveryTarget, effectiveDeploymentB64: string): Record<string, unknown> {
|
|
const params = [
|
|
"revision",
|
|
"source-snapshot-prefix",
|
|
"git-read-url",
|
|
"gitops-read-url",
|
|
"gitops-write-url",
|
|
"gitops-username",
|
|
"gitops-secret-name",
|
|
];
|
|
const taskParams = params.map((name) => ({ name, type: "string" }));
|
|
const taskParamBindings = params.map((name) => ({ name, value: `$(params.${name})` }));
|
|
return {
|
|
apiVersion: "tekton.dev/v1",
|
|
kind: "Pipeline",
|
|
metadata: {
|
|
name: target.ci.pipeline,
|
|
namespace: target.ci.namespace,
|
|
labels: {
|
|
"app.kubernetes.io/name": target.ci.pipeline,
|
|
"app.kubernetes.io/part-of": "selfmedia-factory",
|
|
"app.kubernetes.io/managed-by": "unidesk",
|
|
},
|
|
},
|
|
spec: {
|
|
params: taskParams,
|
|
tasks: [{
|
|
name: "build-and-publish",
|
|
params: taskParamBindings,
|
|
taskSpec: {
|
|
params: taskParams,
|
|
volumes: [
|
|
{ name: "workspace", emptyDir: { sizeLimit: target.ci.workspaceSize } },
|
|
{
|
|
name: "buildkit-state",
|
|
hostPath: { path: target.build.envReuse.statePath, type: "DirectoryOrCreate" },
|
|
},
|
|
{ name: "tmp", emptyDir: { sizeLimit: "4Gi" } },
|
|
{
|
|
name: "gitops-token",
|
|
secret: {
|
|
secretName: "$(params.gitops-secret-name)",
|
|
defaultMode: 288,
|
|
items: [{ key: target.gitops.credentialTokenKey, path: "token" }],
|
|
},
|
|
},
|
|
],
|
|
steps: [
|
|
sourceStep(target, effectiveDeploymentB64),
|
|
prepareBuildkitStep(target),
|
|
envReuseStep(target),
|
|
imageBuildStep(target),
|
|
gitOpsPublishStep(target),
|
|
],
|
|
},
|
|
}],
|
|
},
|
|
};
|
|
}
|
|
|
|
function sourceStep(target: SelfMediaDeliveryTarget, effectiveDeploymentB64: string): Record<string, unknown> {
|
|
const proxy = target.build.proxy;
|
|
return {
|
|
name: "immutable-source",
|
|
image: target.ci.toolImage,
|
|
imagePullPolicy: "IfNotPresent",
|
|
workingDir: "/workspace",
|
|
env: [
|
|
{ name: "HTTP_PROXY", value: requiredString(proxy.http, "build.proxy.http") },
|
|
{ name: "HTTPS_PROXY", value: requiredString(proxy.https, "build.proxy.https") },
|
|
{ name: "ALL_PROXY", value: requiredString(proxy.all, "build.proxy.all") },
|
|
{ name: "NO_PROXY", value: requiredStringArray(proxy.noProxy, "build.proxy.noProxy").join(",") },
|
|
],
|
|
script: `#!/bin/sh
|
|
set -eu
|
|
stage_started_seconds=$(date +%s)
|
|
source_commit="$(params.revision)"
|
|
snapshot_prefix="$(params.source-snapshot-prefix)"
|
|
rm -rf /workspace/source /workspace/release
|
|
askpass=/tmp/selfmedia-source-git-askpass
|
|
cat >"$askpass" <<'ASKPASS'
|
|
#!/bin/sh
|
|
case "$1" in
|
|
*Username*) printf '%s' "$SELFMEDIA_GIT_USERNAME" ;;
|
|
*Password*) cat /var/run/selfmedia-gitops/token ;;
|
|
*) exit 1 ;;
|
|
esac
|
|
ASKPASS
|
|
chmod 700 "$askpass"
|
|
export SELFMEDIA_GIT_USERNAME="$(params.gitops-username)"
|
|
export GIT_ASKPASS="$askpass"
|
|
export GIT_TERMINAL_PROMPT=0
|
|
git clone --filter=blob:none --no-checkout "$(params.git-read-url)" /workspace/source
|
|
cd /workspace/source
|
|
git fetch --depth=1 --filter=blob:none origin "+$snapshot_prefix/$source_commit:refs/remotes/origin/selfmedia-source-snapshot"
|
|
git checkout --detach "$source_commit"
|
|
test "$(git rev-parse HEAD)" = "$source_commit"
|
|
rm -f "$askpass"
|
|
printf '%s' '${effectiveDeploymentB64}' | base64 -d > /workspace/effective-deployment.yaml
|
|
bun install --frozen-lockfile
|
|
bun deploy/scripts/prepare-build.ts \\
|
|
--config /workspace/effective-deployment.yaml \\
|
|
--source-root /workspace/source \\
|
|
--source-commit "$source_commit" \\
|
|
--source-snapshot-prefix "$snapshot_prefix" \\
|
|
--output-dir /workspace/release
|
|
stage_finished_seconds=$(date +%s)
|
|
printf '{"ok":true,"phase":"source-prepare","stageTimings":{"sourcePrepareSeconds":%s},"valuesPrinted":false}\n' "$((stage_finished_seconds-stage_started_seconds))"
|
|
`,
|
|
securityContext: nonRootSecurity(),
|
|
volumeMounts: [
|
|
{ name: "workspace", mountPath: "/workspace" },
|
|
{ name: "tmp", mountPath: "/tmp" },
|
|
{ name: "gitops-token", mountPath: "/var/run/selfmedia-gitops", readOnly: true },
|
|
],
|
|
};
|
|
}
|
|
|
|
function prepareBuildkitStep(target: SelfMediaDeliveryTarget): Record<string, unknown> {
|
|
return {
|
|
name: "prepare-buildkit-state",
|
|
image: target.ci.toolImage,
|
|
imagePullPolicy: "IfNotPresent",
|
|
script: "#!/bin/sh\nset -eu\nmkdir -p /home/user/.local/share/buildkit/.unidesk\nchown 1000:1000 /home/user/.local/share/buildkit /home/user/.local/share/buildkit/.unidesk\n",
|
|
securityContext: { runAsUser: 0, runAsGroup: 0 },
|
|
volumeMounts: [{ name: "buildkit-state", mountPath: "/home/user/.local/share/buildkit" }],
|
|
};
|
|
}
|
|
|
|
function envReuseStep(target: SelfMediaDeliveryTarget): Record<string, unknown> {
|
|
const identityFiles = target.build.envReuse.identityFiles.map((path) => `/workspace/source/${path}`);
|
|
const identityInputs = [...identityFiles, "/workspace/release/codex-version"]
|
|
.map(shellSingleQuote)
|
|
.join(" ");
|
|
return {
|
|
name: "env-reuse",
|
|
image: target.ci.toolImage,
|
|
imagePullPolicy: "IfNotPresent",
|
|
script: `#!/bin/sh
|
|
set -eu
|
|
stage_started_seconds=$(date +%s)
|
|
identity_file=/home/user/.local/share/buildkit/.unidesk/selfmedia-env-identity
|
|
for input in ${identityInputs}; do test -f "$input"; done
|
|
env_identity="sha256:$(sha256sum ${identityInputs} | sha256sum | awk '{print $1}')"
|
|
previous_identity=""
|
|
if [ -f "$identity_file" ]; then previous_identity=$(cat "$identity_file"); fi
|
|
if [ "$previous_identity" = "$env_identity" ]; then
|
|
reuse_status=hit
|
|
previous_present=true
|
|
else
|
|
reuse_status=miss
|
|
if [ -n "$previous_identity" ]; then previous_present=true; else previous_present=false; fi
|
|
fi
|
|
printf '%s\n' "$env_identity" > /workspace/env-identity
|
|
stage_finished_seconds=$(date +%s)
|
|
printf '{"ok":true,"phase":"env-reuse","envIdentity":"%s","envReuseStatus":"%s","envReuse":{"status":"%s","mode":"${target.build.envReuse.mode}","identitySource":"owning-yaml-source-artifact","previousIdentityPresent":%s},"stageTimings":{"envIdentitySeconds":%s},"valuesPrinted":false}\n' "$env_identity" "$reuse_status" "$reuse_status" "$previous_present" "$((stage_finished_seconds-stage_started_seconds))"
|
|
`,
|
|
securityContext: nonRootSecurity(),
|
|
volumeMounts: [
|
|
{ name: "workspace", mountPath: "/workspace" },
|
|
{ name: "buildkit-state", mountPath: "/home/user/.local/share/buildkit" },
|
|
],
|
|
};
|
|
}
|
|
|
|
function imageBuildStep(target: SelfMediaDeliveryTarget): Record<string, unknown> {
|
|
return {
|
|
name: "image-build",
|
|
image: target.ci.buildkitImage,
|
|
imagePullPolicy: "IfNotPresent",
|
|
workingDir: "/workspace",
|
|
env: [
|
|
{ name: "SOURCE_COMMIT", value: "$(params.revision)" },
|
|
{ name: "BUILDKITD_FLAGS", value: "--oci-worker-no-process-sandbox --oci-worker-net=host --allow-insecure-entitlement network.host" },
|
|
],
|
|
script: `#!/bin/sh
|
|
set -eu
|
|
stage_started_seconds=$(date +%s)
|
|
/bin/sh /workspace/source/deploy/scripts/build-image.sh
|
|
cp /workspace/env-identity /home/user/.local/share/buildkit/.unidesk/selfmedia-env-identity
|
|
stage_finished_seconds=$(date +%s)
|
|
printf '{"ok":true,"phase":"image-build-complete","envIdentity":"%s","stageTimings":{"imageBuildSeconds":%s},"valuesPrinted":false}\n' "$(cat /workspace/env-identity)" "$((stage_finished_seconds-stage_started_seconds))"
|
|
`,
|
|
securityContext: { privileged: true, runAsUser: 1000, runAsGroup: 1000 },
|
|
volumeMounts: [
|
|
{ name: "workspace", mountPath: "/workspace" },
|
|
{ name: "buildkit-state", mountPath: "/home/user/.local/share/buildkit" },
|
|
{ name: "tmp", mountPath: "/tmp" },
|
|
],
|
|
};
|
|
}
|
|
|
|
function gitOpsPublishStep(target: SelfMediaDeliveryTarget): Record<string, unknown> {
|
|
return {
|
|
name: "gitops-publish",
|
|
image: target.ci.toolImage,
|
|
imagePullPolicy: "IfNotPresent",
|
|
workingDir: "/workspace",
|
|
env: [{ name: "SOURCE_COMMIT", value: "$(params.revision)" }],
|
|
script: `#!/bin/sh
|
|
set -eu
|
|
stage_started_seconds=$(date +%s)
|
|
askpass=/tmp/selfmedia-git-askpass
|
|
cat >"$askpass" <<'ASKPASS'
|
|
#!/bin/sh
|
|
case "$1" in
|
|
*Username*) printf '%s' "$SELFMEDIA_GIT_USERNAME" ;;
|
|
*Password*) cat /var/run/selfmedia-gitops/token ;;
|
|
*) exit 1 ;;
|
|
esac
|
|
ASKPASS
|
|
chmod 700 "$askpass"
|
|
export SELFMEDIA_GIT_USERNAME="$(params.gitops-username)"
|
|
export GIT_ASKPASS="$askpass"
|
|
export GIT_TERMINAL_PROMPT=0
|
|
bun /workspace/source/deploy/scripts/publish-gitops.ts \\
|
|
--config /workspace/effective-deployment.yaml \\
|
|
--source-root /workspace/source \\
|
|
--metadata /workspace/build-metadata.json \\
|
|
--source-commit "$SOURCE_COMMIT" \\
|
|
--worktree /workspace/selfmedia-gitops
|
|
rm -f "$askpass"
|
|
stage_finished_seconds=$(date +%s)
|
|
printf '{"ok":true,"phase":"gitops-stage","stageTimings":{"gitopsPublishSeconds":%s},"valuesPrinted":false}\n' "$((stage_finished_seconds-stage_started_seconds))"
|
|
`,
|
|
securityContext: nonRootSecurity(),
|
|
volumeMounts: [
|
|
{ name: "workspace", mountPath: "/workspace" },
|
|
{ name: "tmp", mountPath: "/tmp" },
|
|
{ name: "gitops-token", mountPath: "/var/run/selfmedia-gitops", readOnly: true },
|
|
],
|
|
};
|
|
}
|
|
|
|
function assertBinding(target: SelfMediaDeliveryTarget, binding: SelfMediaRendererBinding): void {
|
|
const expected: Record<string, string> = {
|
|
node: target.node,
|
|
lane: target.lane,
|
|
namespace: target.ci.namespace,
|
|
pipeline: target.ci.pipeline,
|
|
pipelineRunPrefix: target.ci.pipelineRunPrefix,
|
|
};
|
|
const observed: Record<string, string> = {
|
|
node: binding.consumer.node,
|
|
lane: binding.consumer.lane,
|
|
namespace: binding.consumer.namespace,
|
|
pipeline: binding.consumer.pipeline,
|
|
pipelineRunPrefix: binding.consumer.pipelineRunPrefix,
|
|
};
|
|
for (const [key, value] of Object.entries(expected)) {
|
|
if (observed[key] !== value) throw new Error(`PaC ${binding.consumer.id} ${key}=${observed[key]} does not match selfmedia owner ${value}`);
|
|
}
|
|
const requiredParams: Readonly<Record<string, string>> = {
|
|
node: target.node,
|
|
source_branch: target.source.branch,
|
|
source_snapshot_prefix: target.source.snapshotPrefix,
|
|
git_read_url: target.source.readUrl,
|
|
gitops_read_url: target.gitops.readUrl,
|
|
gitops_write_url: target.gitops.writeUrl,
|
|
gitops_branch: target.gitops.branch,
|
|
gitops_username: target.gitops.credentialUsername,
|
|
gitops_secret_name: target.gitops.credentialSecretName,
|
|
pipeline_name: target.ci.pipeline,
|
|
pipeline_run_prefix: target.ci.pipelineRunPrefix,
|
|
service_account: target.ci.serviceAccountName,
|
|
image_repository: target.build.imageRepository,
|
|
pipeline_timeout: target.ci.pipelineTimeout,
|
|
};
|
|
for (const [key, value] of Object.entries(requiredParams)) {
|
|
if (binding.repository.params[key] !== value) throw new Error(`PaC ${binding.consumer.id} repository params.${key} must match selfmedia owner`);
|
|
}
|
|
}
|
|
|
|
function assertServiceRepositoryContract(sourceWorktree: string): void {
|
|
const required = [
|
|
"deploy/Dockerfile",
|
|
"deploy/scripts/prepare-build.ts",
|
|
"deploy/scripts/build-image.sh",
|
|
"deploy/scripts/publish-gitops.ts",
|
|
"deploy/scripts/render-runtime.ts",
|
|
];
|
|
for (const file of required) {
|
|
if (!existsSync(resolve(sourceWorktree, file))) throw new Error(`selfmedia source repository is missing renderer contract file ${file}`);
|
|
}
|
|
}
|
|
|
|
function validateRuntimeRender(sourceWorktree: string, effectiveDeployment: Record<string, unknown>): void {
|
|
const temporary = mkdtempSync(resolve(tmpdir(), "unidesk-selfmedia-render-"));
|
|
const configPath = resolve(temporary, "effective-deployment.yaml");
|
|
try {
|
|
writeFileSync(configPath, `${Bun.YAML.stringify(effectiveDeployment).trim()}\n`, "utf8");
|
|
const result = spawnSync("bun", [
|
|
"deploy/scripts/render-runtime.ts",
|
|
"--config", configPath,
|
|
"--image", `127.0.0.1:5000/selfmedia/newsroom@sha256:${"a".repeat(64)}`,
|
|
"--source-commit", "b".repeat(40),
|
|
], {
|
|
cwd: sourceWorktree,
|
|
encoding: "utf8",
|
|
maxBuffer: 16 * 1024 * 1024,
|
|
timeout: 60_000,
|
|
});
|
|
if (result.error !== undefined) throw result.error;
|
|
if (result.status !== 0) {
|
|
const evidence = `${result.stderr || result.stdout || "render-runtime failed"}`.trim().slice(-2000);
|
|
throw new Error(`selfmedia effective deployment failed service renderer validation: ${evidence}`);
|
|
}
|
|
const output = result.stdout;
|
|
const publicExposure = requiredRecord(effectiveDeployment.publicExposure, "deployment.publicExposure");
|
|
const required = ["kind: Deployment", "kind: Service", "kind: PersistentVolumeClaim", "kind: NetworkPolicy", `hostPort: ${requiredInteger(publicExposure.hostPort, "deployment.publicExposure.hostPort")}`, "automountServiceAccountToken: false"];
|
|
for (const marker of required) {
|
|
if (!output.includes(marker)) throw new Error(`selfmedia service renderer output is missing ${marker}`);
|
|
}
|
|
const forbidden = ["kind: Secret", "kind: Role\n", "kind: RoleBinding", "kind: ClusterRole", "kind: ClusterRoleBinding"];
|
|
for (const marker of forbidden) {
|
|
if (output.includes(marker)) throw new Error(`selfmedia service renderer output contains forbidden ${marker.trim()}`);
|
|
}
|
|
if ((output.match(/kind: PersistentVolumeClaim/gu) ?? []).length !== 2) throw new Error("selfmedia service renderer must produce exactly two PVCs");
|
|
if ((output.match(/kind: NetworkPolicy/gu) ?? []).length < 3) throw new Error("selfmedia service renderer must produce at least three NetworkPolicies");
|
|
} finally {
|
|
rmSync(temporary, { recursive: true, force: true });
|
|
}
|
|
}
|
|
|
|
function nonRootSecurity(): Record<string, unknown> {
|
|
return {
|
|
runAsUser: 1000,
|
|
runAsGroup: 1000,
|
|
runAsNonRoot: true,
|
|
allowPrivilegeEscalation: false,
|
|
capabilities: { drop: ["ALL"] },
|
|
};
|
|
}
|
|
|
|
function requiredString(value: unknown, path: string): string {
|
|
if (typeof value !== "string" || value.length === 0) throw new Error(`${path} must be a non-empty string`);
|
|
return value;
|
|
}
|
|
|
|
function requiredStringArray(value: unknown, path: string): string[] {
|
|
if (!Array.isArray(value) || value.some((item) => typeof item !== "string" || item.length === 0)) throw new Error(`${path} must be an array of non-empty strings`);
|
|
return value as string[];
|
|
}
|
|
|
|
function requiredRecord(value: unknown, path: string): Record<string, unknown> {
|
|
if (value === null || typeof value !== "object" || Array.isArray(value)) throw new Error(`${path} must be an object`);
|
|
return value as Record<string, unknown>;
|
|
}
|
|
|
|
function requiredInteger(value: unknown, path: string): number {
|
|
if (!Number.isInteger(value)) throw new Error(`${path} must be an integer`);
|
|
return value as number;
|
|
}
|
|
|
|
function shellSingleQuote(value: string): string {
|
|
return `'${value.replaceAll("'", `'"'"'`)}'`;
|
|
}
|