Codex
737 lines
30 KiB
JavaScript
737 lines
30 KiB
JavaScript
import { createHash } from "node:crypto";
|
|
import { execFileSync } from "node:child_process";
|
|
import { existsSync, readFileSync } from "node:fs";
|
|
import http from "node:http";
|
|
import https from "node:https";
|
|
import { parseRuntimeReuseConfig, summarizeRuntimeReuseConfig } from "./reuse-config-summary.mjs";
|
|
|
|
const gate = requiredEnv("GATE");
|
|
const follower = requiredEnv("FOLLOWER_ID");
|
|
const repository = requiredEnv("REPOSITORY");
|
|
const repoPath = requiredEnv("REPO_PATH");
|
|
const sourceBranch = requiredEnv("SOURCE_BRANCH");
|
|
const snapshotPrefix = requiredEnv("SNAPSHOT_PREFIX").replace(/\/+$/u, "");
|
|
const selectedSource = process.env.SOURCE_COMMIT || "";
|
|
const gitopsBranch = process.env.GITOPS_BRANCH || "";
|
|
const tektonNamespace = process.env.TEKTON_NAMESPACE || "";
|
|
const pipelineRunPrefix = process.env.PIPELINE_RUN_PREFIX || "";
|
|
const argoNamespace = process.env.ARGO_NAMESPACE || "";
|
|
const argoApplication = process.env.ARGO_APPLICATION || "";
|
|
const runtimeNamespace = process.env.RUNTIME_NAMESPACE || "";
|
|
const workloads = parseWorkloads(process.env.WORKLOADS_B64 || "");
|
|
const healthUrl = process.env.HEALTH_URL || "";
|
|
const slowTaskSeconds = requiredPositiveIntEnv("SLOW_TASK_SECONDS");
|
|
const healthTimeoutMs = requiredPositiveIntEnv("HEALTH_TIMEOUT_MS");
|
|
|
|
const errors = [];
|
|
const branchCommit = rev(`refs/heads/${sourceBranch}`);
|
|
const sourceCommit = selectedSource || branchCommit || "";
|
|
const sourceStageRef = sourceCommit ? `${snapshotPrefix}/${sourceCommit}` : null;
|
|
const sourceSnapshot = sourceStageRef ? rev(sourceStageRef) : null;
|
|
const source = {
|
|
repository,
|
|
branch: sourceBranch,
|
|
sourceCommit: sourceCommit || null,
|
|
stageRef: sourceStageRef,
|
|
snapshotReady: Boolean(sourceCommit && sourceSnapshot === sourceCommit),
|
|
authority: "k8s-git-mirror-snapshot",
|
|
};
|
|
const gitMirror = gitMirrorSummary(sourceCommit);
|
|
|
|
let evidence;
|
|
if (gate === "reuse-plan") evidence = await reusePlanEvidence(sourceCommit);
|
|
else if (gate === "ci-taskrun-plan") evidence = await ciTaskRunEvidence(sourceCommit);
|
|
else if (gate === "cd-rollout-plan") evidence = await cdRolloutEvidence(sourceCommit);
|
|
else if (gate === "post-deploy-health") evidence = await postDeployHealthEvidence(sourceCommit);
|
|
else fail(`unsupported gate ${gate}`);
|
|
|
|
const ok = errors.length === 0 && evidence?.ok === true;
|
|
console.log(JSON.stringify({
|
|
ok,
|
|
gate,
|
|
follower,
|
|
source,
|
|
evidence,
|
|
policy: {
|
|
slowTaskSeconds,
|
|
healthTimeoutMs,
|
|
},
|
|
errors: errors.slice(0, 6),
|
|
statusAuthority: "kubernetes-api-serviceaccount",
|
|
parsedDownstreamCliOutput: false,
|
|
bounded: true,
|
|
}));
|
|
|
|
async function reusePlanEvidence(commit) {
|
|
const reuse = readReuseConfig(commit);
|
|
const decisions = reuse.present === true ? reusePlanDecisions(reuse) : [];
|
|
const summary = reusePlanDecisionSummary(decisions);
|
|
return {
|
|
ok: source.snapshotReady && gitMirror.ok === true && reuse.present === true && reuse.serviceCount > 0 && decisions.length > 0,
|
|
gitMirror: compactGitMirrorEvidence(gitMirror),
|
|
reuse: compactReuseEvidence(reuse),
|
|
decisions: boundedDecisions(decisions),
|
|
decisionSummary: summary,
|
|
contract: {
|
|
consumer: "adapter-ci",
|
|
fields: "serviceId sourceIdentity envIdentity runtimeReuse envReuse skipImageBuild buildDecision reusableImageRef reason",
|
|
expectation: "CI consumes skipImageBuild from this plan; it does not re-infer build/skip from TaskRun logs or source file scans.",
|
|
},
|
|
};
|
|
}
|
|
|
|
async function ciTaskRunEvidence(commit) {
|
|
if (!commit || !tektonNamespace || !pipelineRunPrefix) return notConfigured("tekton");
|
|
const pipelineRunName = `${pipelineRunPrefix}-${commit.slice(0, 12)}`;
|
|
const reusePlan = await reusePlanEvidence(commit);
|
|
const pipelineRun = await getJson(`/apis/tekton.dev/v1/namespaces/${encodeURIComponent(tektonNamespace)}/pipelineruns/${encodeURIComponent(pipelineRunName)}`, false);
|
|
const prStatus = pipelineRunStatus(pipelineRun);
|
|
const pipelineRef = str(pipelineRun?.spec?.pipelineRef?.name);
|
|
const pipeline = pipelineRef ? await getJson(`/apis/tekton.dev/v1/namespaces/${encodeURIComponent(tektonNamespace)}/pipelines/${encodeURIComponent(pipelineRef)}`, false) : null;
|
|
const taskRuns = await getJson(`/apis/tekton.dev/v1/namespaces/${encodeURIComponent(tektonNamespace)}/taskruns?labelSelector=${encodeURIComponent(`tekton.dev/pipelineRun=${pipelineRunName}`)}`, false);
|
|
const taskSummary = taskRunsSummary(taskRuns);
|
|
const planArtifacts = planArtifactsEvidence(pipelineRunName);
|
|
const buildTaskRunServices = buildTaskServices(taskRuns);
|
|
const ciConsumption = ciConsumptionSummary(reusePlan.decisions || [], planArtifacts, buildTaskRunServices);
|
|
return {
|
|
ok: prStatus.succeeded === true && taskSummary.failedCount === 0 && taskSummary.activeCount === 0 && ciConsumption.ok === true,
|
|
reusePlan: {
|
|
ok: reusePlan.ok,
|
|
decisionSummary: compactDecisionSummary(reusePlan.decisionSummary),
|
|
},
|
|
planArtifacts,
|
|
ciConsumption,
|
|
pipelineRun: prStatus,
|
|
pipeline: {
|
|
name: pipelineRef,
|
|
taskCount: Array.isArray(pipeline?.spec?.tasks) ? pipeline.spec.tasks.length : null,
|
|
tasks: Array.isArray(pipeline?.spec?.tasks) ? pipeline.spec.tasks.slice(0, 12).map((task) => ({ name: str(task?.name), runAfter: Array.isArray(task?.runAfter) ? task.runAfter.slice(0, 6) : [] })) : [],
|
|
tasksTruncated: Array.isArray(pipeline?.spec?.tasks) ? pipeline.spec.tasks.length > 12 : false,
|
|
},
|
|
taskRuns: compactCiTaskRuns(taskSummary),
|
|
};
|
|
}
|
|
|
|
function reusePlanDecisions(reuse) {
|
|
const baseRef = sourceStageRef ? parentRef(sourceStageRef) : null;
|
|
return (reuse.serviceSpecs || []).map((service) => {
|
|
const codePaths = service.runtimeReuse?.codeIdentityPaths || [];
|
|
const envPaths = uniqueStrings([...(service.runtimeReuse?.envIdentityPaths || []), ...(service.envReuse?.envIdentityFiles || [])]);
|
|
const sourceIdentity = identityComparison(sourceStageRef, baseRef, codePaths);
|
|
const envIdentity = identityComparison(sourceStageRef, baseRef, envPaths);
|
|
const runtimeEnabled = service.runtimeReuse?.enabled !== false;
|
|
const envEnabled = service.envReuse?.enabled !== false;
|
|
const runtimeHit = runtimeEnabled && sourceIdentity.hit === true && envIdentity.hit === true;
|
|
const envHit = envEnabled && envIdentity.hit === true;
|
|
const skipImageBuild = runtimeHit || envHit;
|
|
return {
|
|
serviceId: service.id,
|
|
sourceIdentity,
|
|
envIdentity,
|
|
runtimeReuse: {
|
|
enabled: runtimeEnabled,
|
|
hit: runtimeHit,
|
|
reason: runtimeHit ? "source-and-env-identity-hit" : missReason(sourceIdentity, envIdentity, runtimeEnabled),
|
|
},
|
|
envReuse: {
|
|
enabled: envEnabled,
|
|
hit: envHit,
|
|
reason: envHit ? "env-identity-hit" : missReason(null, envIdentity, envEnabled),
|
|
},
|
|
skipImageBuild,
|
|
buildDecision: skipImageBuild ? "skipImageBuild" : "buildImage",
|
|
reusableImageRef: null,
|
|
reusableImageRefKnown: false,
|
|
reason: decisionReason({ runtimeHit, envHit, runtimeEnabled, envEnabled, sourceIdentity, envIdentity }),
|
|
};
|
|
});
|
|
}
|
|
|
|
function reusePlanDecisionSummary(decisions) {
|
|
const skip = decisions.filter((item) => item.skipImageBuild === true).map((item) => item.serviceId).sort();
|
|
const build = decisions.filter((item) => item.skipImageBuild !== true).map((item) => item.serviceId).sort();
|
|
return {
|
|
serviceCount: decisions.length,
|
|
skipImageBuildCount: skip.length,
|
|
buildImageCount: build.length,
|
|
skipImageBuildServices: skip,
|
|
buildImageServices: build,
|
|
};
|
|
}
|
|
|
|
function compactDecisionSummary(summary) {
|
|
return {
|
|
serviceCount: summary?.serviceCount ?? null,
|
|
skipImageBuildCount: summary?.skipImageBuildCount ?? null,
|
|
buildImageCount: summary?.buildImageCount ?? null,
|
|
};
|
|
}
|
|
|
|
function identityComparison(currentRef, baseRef, paths) {
|
|
const current = identityDigest(currentRef, paths);
|
|
const previous = baseRef ? identityDigest(baseRef, paths) : null;
|
|
const configured = paths.length > 0;
|
|
const hit = configured && previous !== null && current.sha256 !== null && previous.sha256 !== null && current.sha256 === previous.sha256;
|
|
return {
|
|
configured,
|
|
paths: paths.slice(0, 12),
|
|
pathsTruncated: paths.length > 12,
|
|
pathCount: paths.length,
|
|
current: current.sha256,
|
|
previous: previous?.sha256 ?? null,
|
|
currentMissingCount: current.missingCount,
|
|
previousMissingCount: previous?.missingCount ?? null,
|
|
hit,
|
|
status: !configured ? "not-configured" : previous === null ? "base-missing" : hit ? "hit" : "miss",
|
|
};
|
|
}
|
|
|
|
function identityDigest(ref, paths) {
|
|
if (!ref || paths.length === 0) return { sha256: null, missingCount: 0 };
|
|
const hash = createHash("sha256");
|
|
let missingCount = 0;
|
|
for (const path of paths) {
|
|
const entries = gitTreeEntries(ref, path);
|
|
if (entries.length === 0) missingCount += 1;
|
|
hash.update(path);
|
|
hash.update("\0");
|
|
for (const entry of entries) {
|
|
hash.update(entry);
|
|
hash.update("\0");
|
|
}
|
|
}
|
|
return { sha256: hash.digest("hex"), missingCount };
|
|
}
|
|
|
|
function gitTreeEntries(ref, path) {
|
|
try {
|
|
const out = execFileSync("git", [`--git-dir=${repoPath}`, "ls-tree", "-r", "-z", "--full-tree", ref, "--", path], { encoding: "utf8", maxBuffer: 1024 * 1024 });
|
|
return out.split("\0").filter(Boolean).sort();
|
|
} catch {
|
|
return [];
|
|
}
|
|
}
|
|
|
|
function parentRef(ref) {
|
|
try {
|
|
const out = execFileSync("git", [`--git-dir=${repoPath}`, "rev-parse", "--verify", `${ref}^`], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
|
|
return sha(out) ? out : null;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
function missReason(sourceIdentity, envIdentity, enabled) {
|
|
if (!enabled) return "reuse-disabled";
|
|
if (sourceIdentity?.configured === false || envIdentity?.configured === false) return "identity-not-configured";
|
|
if (sourceIdentity?.status === "base-missing" || envIdentity?.status === "base-missing") return "base-identity-missing";
|
|
if (sourceIdentity?.status === "miss") return "source-identity-miss";
|
|
if (envIdentity?.status === "miss") return "env-identity-miss";
|
|
return "identity-miss";
|
|
}
|
|
|
|
function decisionReason(input) {
|
|
if (input.runtimeHit) return "runtime-reuse-hit";
|
|
if (input.envHit) return "env-reuse-hit";
|
|
if (input.envIdentity.configured === false) return "env-identity-not-configured";
|
|
if (input.envIdentity.status === "base-missing") return "previous-env-identity-unavailable";
|
|
if (input.envIdentity.status === "miss") return "env-identity-changed";
|
|
if (!input.runtimeEnabled && !input.envEnabled) return "reuse-disabled";
|
|
return "reuse-miss";
|
|
}
|
|
|
|
function planArtifactsEvidence(pipelineRunName) {
|
|
if (!tektonNamespace || !pipelineRunName) return { ok: false, degradedReason: "tekton-not-configured" };
|
|
try {
|
|
const text = execFileSync("node", ["./plan-artifacts.mjs", tektonNamespace, pipelineRunName], { encoding: "utf8", maxBuffer: 512 * 1024 });
|
|
return JSON.parse(text);
|
|
} catch (error) {
|
|
return { ok: false, degradedReason: "plan-artifacts-query-failed", reason: shortText(error?.message || String(error)) };
|
|
}
|
|
}
|
|
|
|
function ciConsumptionSummary(decisions, planArtifacts, buildTaskRunServices) {
|
|
const skipExpected = decisions.filter((item) => item.skipImageBuild === true).map((item) => item.serviceId).sort();
|
|
const buildExpected = decisions.filter((item) => item.skipImageBuild !== true).map((item) => item.serviceId).sort();
|
|
const buildObserved = uniqueStrings([...strings(planArtifacts?.buildServices), ...buildTaskRunServices]).sort();
|
|
const reusedObserved = strings(planArtifacts?.reusedServices).sort();
|
|
const skippedObserved = uniqueStrings(reusedObserved).sort();
|
|
const unexpectedBuild = skipExpected.filter((serviceId) => buildObserved.includes(serviceId) && !reusedObserved.includes(serviceId));
|
|
const missingBuild = buildExpected.filter((serviceId) => !buildObserved.includes(serviceId) && !reusedObserved.includes(serviceId));
|
|
const ok = planArtifacts?.ok === true && unexpectedBuild.length === 0 && missingBuild.length === 0;
|
|
return {
|
|
ok,
|
|
reason: unexpectedBuild.length > 0 || missingBuild.length > 0 ? "ci-consumption-mismatch" : planArtifacts?.ok === true ? "ci-consumed-reuse-plan" : "plan-artifacts-event-missing",
|
|
source: "reuse-plan-decisions-compared-to-plan-artifacts-g14-ci-plan",
|
|
expected: {
|
|
skipImageBuildCount: skipExpected.length,
|
|
buildImageCount: buildExpected.length,
|
|
},
|
|
observed: {
|
|
buildServicesCount: buildObserved.length,
|
|
buildTaskRunServices,
|
|
reusedServicesCount: reusedObserved.length,
|
|
skippedOrReusedServicesCount: skippedObserved.length,
|
|
buildSkippedCount: typeof planArtifacts?.buildSkippedCount === "number" ? planArtifacts.buildSkippedCount : null,
|
|
},
|
|
mismatches: compactCiMismatches(unexpectedBuild, missingBuild),
|
|
};
|
|
}
|
|
|
|
function compactCiMismatches(unexpectedBuild, missingBuild) {
|
|
return [
|
|
...(unexpectedBuild.length > 0 ? [{ reason: "expected-skipImageBuild-but-ci-buildServices-includes-service", serviceIds: unexpectedBuild }] : []),
|
|
...(missingBuild.length > 0 ? [{ reason: "expected-buildImage-but-ci-plan-has-no-build-or-reuse-service", serviceIds: missingBuild }] : []),
|
|
];
|
|
}
|
|
|
|
function buildTaskServices(list) {
|
|
const items = Array.isArray(list?.items) ? list.items : [];
|
|
return uniqueStrings(items.flatMap((item) => {
|
|
const taskName = str(item?.metadata?.labels?.["tekton.dev/pipelineTask"]) || str(item?.spec?.taskRef?.name) || "";
|
|
const match = /^build-(.+)$/u.exec(taskName);
|
|
return match ? [match[1]] : [];
|
|
})).sort();
|
|
}
|
|
|
|
function compactCiTaskRuns(summary) {
|
|
return {
|
|
count: summary.count,
|
|
slowThresholdSeconds: summary.slowThresholdSeconds,
|
|
failedCount: summary.failedCount,
|
|
activeCount: summary.activeCount,
|
|
slowCount: summary.slowCount,
|
|
failedItems: summary.failedItems.slice(0, 4).map(compactCiTaskItem),
|
|
activeItems: summary.activeItems.slice(0, 4).map(compactCiTaskItem),
|
|
slowItems: summary.slowItems.slice(0, 4).map(compactCiTaskItem),
|
|
timeline: summary.timeline.slice(0, 10),
|
|
timelineTruncated: summary.timeline.length > 10 || summary.timelineTruncated === true,
|
|
performance: summary.performance,
|
|
};
|
|
}
|
|
|
|
function compactCiTaskItem(item) {
|
|
return {
|
|
taskName: item.taskName,
|
|
status: item.status,
|
|
reason: item.reason,
|
|
durationSeconds: item.durationSeconds,
|
|
};
|
|
}
|
|
|
|
async function cdRolloutEvidence(commit) {
|
|
const argo = await argoSummary();
|
|
const runtime = await runtimeSummary(commit);
|
|
return {
|
|
ok: gitMirror.githubInSync !== false && argo.ready === true && runtime.ready === true && runtime.aligned === true,
|
|
gitMirror,
|
|
argo,
|
|
runtime,
|
|
};
|
|
}
|
|
|
|
async function postDeployHealthEvidence(commit) {
|
|
const runtime = await runtimeSummary(commit);
|
|
const health = await healthSummary();
|
|
return {
|
|
ok: runtime.ready === true && runtime.aligned === true && health.ok === true,
|
|
runtime,
|
|
health,
|
|
};
|
|
}
|
|
|
|
function readReuseConfig(commit) {
|
|
if (!commit || !sourceStageRef) return { present: false, reason: "source-commit-missing" };
|
|
try {
|
|
const text = execFileSync("git", [`--git-dir=${repoPath}`, "show", `${sourceStageRef}:gitops/reuse.ymal`], { encoding: "utf8", maxBuffer: 256 * 1024 });
|
|
const parsed = parseRuntimeReuseConfig(text, { sourceCommit: commit, stageRef: sourceStageRef });
|
|
const summary = summarizeRuntimeReuseConfig(parsed);
|
|
return {
|
|
...summary,
|
|
serviceSpecs: parsed.services,
|
|
bytes: Buffer.byteLength(text, "utf8"),
|
|
sha256: summary.sha256 ?? createHash("sha256").update(text).digest("hex"),
|
|
};
|
|
} catch (error) {
|
|
return { present: false, path: "gitops/reuse.ymal", reason: shortText(error?.message || String(error)) };
|
|
}
|
|
}
|
|
|
|
function compactReuseEvidence(reuse) {
|
|
return {
|
|
ok: reuse.ok === true,
|
|
present: reuse.present === true,
|
|
path: reuse.path || "gitops/reuse.ymal",
|
|
sha256: shortFingerprint(reuse.sha256),
|
|
serviceCount: reuse.serviceCount ?? null,
|
|
errors: Array.isArray(reuse.errors) ? reuse.errors.slice(0, 3) : [],
|
|
bytes: reuse.bytes ?? null,
|
|
valuesRedacted: true,
|
|
};
|
|
}
|
|
|
|
function compactGitMirrorEvidence(value) {
|
|
return {
|
|
ok: value.ok === true,
|
|
sourceSnapshotReady: value.sourceSnapshotReady === true,
|
|
githubInSync: value.githubInSync,
|
|
pendingFlush: value.pendingFlush,
|
|
};
|
|
}
|
|
|
|
function boundedDecisions(decisions) {
|
|
return decisions.slice(0, 16).map((item) => ({
|
|
serviceId: item.serviceId,
|
|
sourceIdentity: compactIdentity(item.sourceIdentity),
|
|
envIdentity: compactIdentity(item.envIdentity),
|
|
runtimeReuse: compactReuseHit(item.runtimeReuse),
|
|
envReuse: compactReuseHit(item.envReuse),
|
|
skipImageBuild: item.skipImageBuild,
|
|
buildDecision: item.buildDecision,
|
|
reusableImageRef: item.reusableImageRef,
|
|
reusableImageRefKnown: item.reusableImageRefKnown,
|
|
reason: item.reason,
|
|
}));
|
|
}
|
|
|
|
function compactIdentity(value) {
|
|
return {
|
|
configured: value.configured,
|
|
pathCount: value.pathCount,
|
|
hit: value.hit,
|
|
status: value.status,
|
|
missing: {
|
|
current: value.currentMissingCount,
|
|
previous: value.previousMissingCount,
|
|
},
|
|
};
|
|
}
|
|
|
|
function compactReuseHit(value) {
|
|
return {
|
|
enabled: value.enabled,
|
|
hit: value.hit,
|
|
};
|
|
}
|
|
|
|
function gitMirrorSummary(commit) {
|
|
const localSource = rev(`refs/heads/${sourceBranch}`);
|
|
const githubSource = rev(`refs/mirror-stage/heads/${sourceBranch}`);
|
|
const localGitops = gitopsBranch ? rev(`refs/heads/${gitopsBranch}`) : null;
|
|
const githubGitops = gitopsBranch ? rev(`refs/mirror-stage/heads/${gitopsBranch}`) : null;
|
|
return {
|
|
ok: Boolean(localSource) && source.snapshotReady && (!gitopsBranch || !localGitops || localGitops === githubGitops),
|
|
localSource,
|
|
githubSource,
|
|
sourceStageRef,
|
|
sourceSnapshot,
|
|
sourceSnapshotReady: source.snapshotReady,
|
|
gitopsBranch: gitopsBranch || null,
|
|
localGitops,
|
|
githubGitops,
|
|
pendingFlush: gitopsBranch ? Boolean(localGitops && localGitops !== githubGitops) : null,
|
|
githubInSync: gitopsBranch ? Boolean(!localGitops || localGitops === githubGitops) : null,
|
|
};
|
|
}
|
|
|
|
async function argoSummary() {
|
|
if (!argoNamespace || !argoApplication) return { ready: null, reason: "argo-not-configured" };
|
|
const app = await getJson(`/apis/argoproj.io/v1alpha1/namespaces/${encodeURIComponent(argoNamespace)}/applications/${encodeURIComponent(argoApplication)}`, false);
|
|
const sync = app?.status?.sync || {};
|
|
const health = app?.status?.health || {};
|
|
const op = app?.status?.operationState || {};
|
|
return {
|
|
name: argoApplication,
|
|
namespace: argoNamespace,
|
|
syncStatus: str(sync.status),
|
|
healthStatus: str(health.status),
|
|
revision: str(sync.revision),
|
|
operationPhase: str(op.phase),
|
|
operationMessage: str(op.message),
|
|
ready: sync.status === "Synced" && health.status === "Healthy",
|
|
};
|
|
}
|
|
|
|
async function runtimeSummary(expected) {
|
|
if (!runtimeNamespace || workloads.length === 0) return { ready: null, aligned: null, reason: "runtime-not-configured" };
|
|
const rows = [];
|
|
for (const workload of workloads) {
|
|
const resource = workload.kind === "StatefulSet" ? "statefulsets" : "deployments";
|
|
const item = await getJson(`/apis/apps/v1/namespaces/${encodeURIComponent(runtimeNamespace)}/${resource}/${encodeURIComponent(workload.name)}`, false);
|
|
rows.push(workloadSummary(workload, item, expected));
|
|
}
|
|
return {
|
|
namespace: runtimeNamespace,
|
|
expectedSha: shortSha(expected),
|
|
ready: rows.length > 0 && rows.every((row) => row.ready === true),
|
|
aligned: rows.length > 0 && rows.every((row) => row.aligned === true),
|
|
workloads: rows,
|
|
};
|
|
}
|
|
|
|
async function healthSummary() {
|
|
if (!healthUrl) return { ok: null, reason: "health-url-not-configured" };
|
|
const targets = healthProbeTargets(healthUrl);
|
|
const probes = [];
|
|
for (const url of targets) probes.push(await httpProbe(url));
|
|
return { ok: probes.every((probe) => probe.ok), probes };
|
|
}
|
|
|
|
function healthProbeTargets(value) {
|
|
const trimmed = value.replace(/\/+$/u, "");
|
|
try {
|
|
const parsed = new URL(trimmed);
|
|
const pathname = parsed.pathname.replace(/\/+$/u, "");
|
|
if (pathname.endsWith("/health") || pathname.endsWith("/api/health") || pathname.endsWith("/health/readiness") || pathname.endsWith("/health/live")) {
|
|
return [trimmed];
|
|
}
|
|
} catch {
|
|
// Fall back to the historical base-url contract when HEALTH_URL is not a full URL.
|
|
}
|
|
return [`${trimmed}/health/readiness`, `${trimmed}/health/live`];
|
|
}
|
|
|
|
function workloadSummary(spec, item, expected) {
|
|
const status = item?.status || {};
|
|
const desired = item?.spec?.replicas ?? 1;
|
|
const readyCount = spec.kind === "StatefulSet" ? status.readyReplicas ?? 0 : status.availableReplicas ?? 0;
|
|
const updated = status.updatedReplicas ?? readyCount;
|
|
const commit = workloadCommit(spec, item);
|
|
return {
|
|
kind: spec.kind,
|
|
name: spec.name,
|
|
ready: readyCount >= desired && updated >= desired,
|
|
desired,
|
|
readyReplicas: readyCount,
|
|
updatedReplicas: updated,
|
|
sourceCommit: shortSha(commit),
|
|
aligned: Boolean(expected && commit && commit === expected),
|
|
};
|
|
}
|
|
|
|
function workloadCommit(spec, item) {
|
|
const meta = item?.metadata || {};
|
|
const tmpl = item?.spec?.template || {};
|
|
const podMeta = tmpl.metadata || {};
|
|
for (const key of spec.sourceCommit.labels || []) if (sha(meta.labels?.[key])) return meta.labels[key];
|
|
for (const key of spec.sourceCommit.annotations || []) if (sha(meta.annotations?.[key])) return meta.annotations[key];
|
|
for (const key of spec.sourceCommit.podLabels || []) if (sha(podMeta.labels?.[key])) return podMeta.labels[key];
|
|
for (const key of spec.sourceCommit.podAnnotations || []) if (sha(podMeta.annotations?.[key])) return podMeta.annotations[key];
|
|
for (const envName of spec.sourceCommit.env || []) {
|
|
for (const container of tmpl.spec?.containers || []) {
|
|
for (const env of container.env || []) if (env?.name === envName && sha(env.value)) return env.value;
|
|
}
|
|
}
|
|
return null;
|
|
}
|
|
|
|
function pipelineRunStatus(value) {
|
|
const condition = (value?.status?.conditions || []).find((item) => item?.type === "Succeeded") || null;
|
|
return {
|
|
name: str(value?.metadata?.name),
|
|
namespace: str(value?.metadata?.namespace),
|
|
pipelineRefName: str(value?.spec?.pipelineRef?.name),
|
|
present: value !== null,
|
|
succeeded: condition?.status === "True" ? true : condition?.status === "False" ? false : null,
|
|
reason: str(condition?.reason),
|
|
startTime: str(value?.status?.startTime),
|
|
completionTime: str(value?.status?.completionTime),
|
|
durationSeconds: durationSeconds(value?.status?.startTime, value?.status?.completionTime),
|
|
};
|
|
}
|
|
|
|
function taskRunsSummary(list) {
|
|
const items = Array.isArray(list?.items) ? list.items : [];
|
|
const rows = items.map((item) => {
|
|
const condition = (item?.status?.conditions || []).find((entry) => entry?.type === "Succeeded") || {};
|
|
return {
|
|
name: str(item?.metadata?.name),
|
|
taskName: str(item?.metadata?.labels?.["tekton.dev/pipelineTask"]) || str(item?.spec?.taskRef?.name),
|
|
status: str(condition.status) || "Unknown",
|
|
reason: str(condition.reason),
|
|
startTime: str(item?.status?.startTime),
|
|
completionTime: str(item?.status?.completionTime),
|
|
durationSeconds: durationSeconds(item?.status?.startTime, item?.status?.completionTime),
|
|
};
|
|
});
|
|
const failed = rows.filter((item) => item.status === "False");
|
|
const active = rows.filter((item) => item.status !== "True" && item.status !== "False");
|
|
const slow = rows
|
|
.filter((item) => typeof item.durationSeconds === "number" && item.durationSeconds >= slowTaskSeconds)
|
|
.sort((left, right) => (right.durationSeconds || 0) - (left.durationSeconds || 0));
|
|
const timeline = rows.slice().sort(compareTaskRunRows);
|
|
const performance = taskRunPerformance(rows);
|
|
return {
|
|
count: rows.length,
|
|
slowThresholdSeconds: slowTaskSeconds,
|
|
failedCount: failed.length,
|
|
activeCount: active.length,
|
|
slowCount: slow.length,
|
|
failedItems: failed.slice(0, 6).map(compactNamedTaskRunRow),
|
|
activeItems: active.slice(0, 6).map(compactNamedTaskRunRow),
|
|
slowItems: slow.slice(0, 6).map(compactNamedTaskRunRow),
|
|
timeline: timeline.slice(0, 16).map((item) => compactTimelineTaskRunRow(item, performance.firstStart)),
|
|
timelineTruncated: timeline.length > 16,
|
|
performance,
|
|
};
|
|
}
|
|
|
|
function taskRunPerformance(rows) {
|
|
const starts = rows.map((item) => Date.parse(item.startTime || "")).filter((value) => Number.isFinite(value));
|
|
const finishes = rows.map((item) => Date.parse(item.completionTime || "")).filter((value) => Number.isFinite(value));
|
|
const durations = rows.map((item) => item.durationSeconds).filter((value) => typeof value === "number");
|
|
const firstStart = starts.length === 0 ? null : new Date(Math.min(...starts)).toISOString();
|
|
const lastCompletion = finishes.length === 0 ? null : new Date(Math.max(...finishes)).toISOString();
|
|
return {
|
|
firstStart,
|
|
lastCompletion,
|
|
spanSeconds: firstStart && lastCompletion ? durationSeconds(firstStart, lastCompletion) : null,
|
|
taskDurationSumSeconds: durations.length === 0 ? null : Math.round(durations.reduce((sum, value) => sum + value, 0) * 10) / 10,
|
|
maxTaskDurationSeconds: durations.length === 0 ? null : Math.max(...durations),
|
|
};
|
|
}
|
|
|
|
function compareTaskRunRows(left, right) {
|
|
const leftTime = Date.parse(left.startTime || "");
|
|
const rightTime = Date.parse(right.startTime || "");
|
|
if (Number.isFinite(leftTime) && Number.isFinite(rightTime) && leftTime !== rightTime) return leftTime - rightTime;
|
|
if (Number.isFinite(leftTime)) return -1;
|
|
if (Number.isFinite(rightTime)) return 1;
|
|
return String(left.name || "").localeCompare(String(right.name || ""));
|
|
}
|
|
|
|
function compactNamedTaskRunRow(item) {
|
|
return {
|
|
name: item.name,
|
|
taskName: item.taskName,
|
|
status: item.status,
|
|
reason: item.reason,
|
|
durationSeconds: item.durationSeconds,
|
|
};
|
|
}
|
|
|
|
function compactTimelineTaskRunRow(item, firstStart) {
|
|
return {
|
|
taskName: item.taskName,
|
|
status: item.status,
|
|
startOffsetSeconds: firstStart && item.startTime ? durationSeconds(firstStart, item.startTime) : null,
|
|
durationSeconds: item.durationSeconds,
|
|
};
|
|
}
|
|
|
|
async function getJson(path, required) {
|
|
const host = process.env.KUBERNETES_SERVICE_HOST;
|
|
const port = Number(process.env.KUBERNETES_SERVICE_PORT || "443");
|
|
const tokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token";
|
|
const caPath = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt";
|
|
if (!host || !existsSync(tokenPath) || !existsSync(caPath)) fail("kubernetes serviceaccount is unavailable");
|
|
const token = readFileSync(tokenPath, "utf8").trim();
|
|
const ca = readFileSync(caPath);
|
|
return await new Promise((resolve, reject) => {
|
|
const req = https.request({ host, port, path, method: "GET", ca, headers: { authorization: `Bearer ${token}` } }, (res) => {
|
|
let body = "";
|
|
res.setEncoding("utf8");
|
|
res.on("data", (chunk) => { body += chunk; });
|
|
res.on("end", () => {
|
|
if (res.statusCode === 404 && !required) return resolve(null);
|
|
if ((res.statusCode || 0) < 200 || (res.statusCode || 0) >= 300) return reject(new Error(shortText(body || `kube api ${res.statusCode}`)));
|
|
try { resolve(JSON.parse(body)); } catch (error) { reject(error); }
|
|
});
|
|
});
|
|
req.on("error", reject);
|
|
req.end();
|
|
}).catch((error) => {
|
|
errors.push(`${path}: ${shortText(error?.message || String(error))}`);
|
|
return null;
|
|
});
|
|
}
|
|
|
|
async function httpProbe(url) {
|
|
const client = url.startsWith("https:") ? https : http;
|
|
const started = Date.now();
|
|
return await new Promise((resolve) => {
|
|
const req = client.get(url, { timeout: healthTimeoutMs }, (res) => {
|
|
res.resume();
|
|
res.on("end", () => resolve({ url, ok: (res.statusCode || 0) >= 200 && (res.statusCode || 0) < 300, statusCode: res.statusCode || null, elapsedMs: Date.now() - started }));
|
|
});
|
|
req.on("timeout", () => { req.destroy(); resolve({ url, ok: false, statusCode: null, elapsedMs: Date.now() - started, reason: "timeout" }); });
|
|
req.on("error", (error) => resolve({ url, ok: false, statusCode: null, elapsedMs: Date.now() - started, reason: shortText(error?.message || String(error)) }));
|
|
});
|
|
}
|
|
|
|
function parseWorkloads(value) {
|
|
if (!value) return [];
|
|
try {
|
|
const parsed = JSON.parse(Buffer.from(value, "base64").toString("utf8"));
|
|
return Array.isArray(parsed) ? parsed.filter((item) => item && typeof item === "object").slice(0, 8) : [];
|
|
} catch {
|
|
return [];
|
|
}
|
|
}
|
|
|
|
function rev(ref) {
|
|
try {
|
|
const out = execFileSync("git", [`--git-dir=${repoPath}`, "rev-parse", "--verify", `${ref}^{commit}`], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
|
|
return sha(out) ? out : null;
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|
|
|
|
function durationSeconds(start, finish) {
|
|
if (!start || !finish) return null;
|
|
const value = (Date.parse(finish) - Date.parse(start)) / 1000;
|
|
return Number.isFinite(value) && value >= 0 ? Math.round(value * 10) / 10 : null;
|
|
}
|
|
|
|
function notConfigured(name) {
|
|
return { ok: false, reason: `${name}-not-configured` };
|
|
}
|
|
|
|
function str(value) {
|
|
return typeof value === "string" && value.length > 0 ? value : null;
|
|
}
|
|
|
|
function strings(value) {
|
|
return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
|
|
}
|
|
|
|
function uniqueStrings(value) {
|
|
return [...new Set(value.filter((item) => typeof item === "string" && item.length > 0))];
|
|
}
|
|
|
|
function sha(value) {
|
|
return typeof value === "string" && /^[0-9a-f]{40}$/iu.test(value);
|
|
}
|
|
|
|
function shortSha(value) {
|
|
return sha(value) ? value.slice(0, 12) : null;
|
|
}
|
|
|
|
function shortFingerprint(value) {
|
|
return typeof value === "string" && value.length >= 12 ? value.slice(0, 12) : null;
|
|
}
|
|
|
|
function shortText(value) {
|
|
const text = String(value || "").replace(/\s+/gu, " ").trim();
|
|
return text.length <= 300 ? text : text.slice(0, 300);
|
|
}
|
|
|
|
function requiredEnv(name) {
|
|
const value = process.env[name];
|
|
if (!value) fail(`${name} is required`);
|
|
return value;
|
|
}
|
|
|
|
function requiredPositiveIntEnv(name) {
|
|
const value = requiredEnv(name);
|
|
const parsed = Number(value);
|
|
if (!Number.isInteger(parsed) || parsed <= 0) fail(`${name} must be a positive integer`);
|
|
return parsed;
|
|
}
|
|
|
|
function fail(message) {
|
|
console.error(message);
|
|
process.exit(1);
|
|
}
|