Codex
349 lines
16 KiB
JavaScript
349 lines
16 KiB
JavaScript
import { createHash } from "node:crypto";
|
|
import { execFileSync } from "node:child_process";
|
|
import { readFileSync } from "node:fs";
|
|
|
|
const provenanceKeys = {
|
|
configRef: "unidesk.ai/owning-config-ref",
|
|
effectiveConfigSha256: "unidesk.ai/effective-config-sha256",
|
|
renderer: "unidesk.ai/source-artifact-renderer",
|
|
mode: "unidesk.ai/source-artifact-mode",
|
|
};
|
|
|
|
const sourceCommitKeys = [
|
|
"pipelinesascode.tekton.dev/sha",
|
|
"pipelinesascode.tekton.dev/commit",
|
|
"agentrun.pikastech.local/source-commit",
|
|
"unidesk.ai/source-commit",
|
|
"hwlab.pikastech.local/source-commit",
|
|
];
|
|
|
|
const knownDriftPathKeys = new Set([
|
|
"accessModes", "annotations", "apiVersion", "args", "command", "computeResources", "default", "description", "dnsPolicy", "env", "envFrom",
|
|
"executionMode", "finally", "fsGroup", "generateName", "hostNetwork", "image", "kind", "labels", "length", "metadata", "mode", "mountPath", "name", "namespace", "onError", "operator",
|
|
"optional", "params", "pipeline", "pipelineRef", "pipelineSpec", "podTemplate", "readinessProbe", "readOnly", "requests", "resources",
|
|
"results", "retries", "runAfter", "script", "secret", "secretName", "securityContext", "serviceAccountName", "sidecars", "spec", "steps",
|
|
"storage", "subPath", "taskRunTemplate", "taskSpec", "tasks", "timeout", "timeouts", "type", "value", "values", "volumeClaimTemplate",
|
|
"volumeMounts", "volumes", "when", "workspaces", "workingDir", "wrapper",
|
|
]);
|
|
|
|
function record(value) {
|
|
return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
|
|
}
|
|
|
|
function stableValue(value) {
|
|
if (Array.isArray(value)) return value.map(stableValue);
|
|
if (value !== null && typeof value === "object") {
|
|
return Object.fromEntries(Object.keys(value).sort().map((key) => [key, stableValue(value[key])]));
|
|
}
|
|
if (value === undefined) return { __type: "undefined" };
|
|
if (typeof value === "bigint") return { __type: "bigint", value: String(value) };
|
|
return value;
|
|
}
|
|
|
|
function valueEvidence(value) {
|
|
const type = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
|
|
const serialized = JSON.stringify(stableValue(value));
|
|
const text = serialized === undefined ? String(value) : serialized;
|
|
const length = typeof value === "string"
|
|
? Buffer.byteLength(value, "utf8")
|
|
: Array.isArray(value)
|
|
? value.length
|
|
: value !== null && typeof value === "object"
|
|
? Object.keys(value).length
|
|
: Buffer.byteLength(text, "utf8");
|
|
const sha256 = createHash("sha256").update(text).digest("hex");
|
|
return `type=${type},length=${length},sha256=${sha256}`;
|
|
}
|
|
|
|
function safeRuntimeReason(reason) {
|
|
const text = typeof reason === "string" ? reason : String(reason);
|
|
const fixed = new Set([
|
|
"source-commit-not-specified",
|
|
"source-commit-run-not-found",
|
|
"source-commit-identity-conflict",
|
|
"pipeline-get-not-found",
|
|
"pipelinerun-list-not-found",
|
|
"pipelinerun-list-invalid-shape",
|
|
]);
|
|
if (fixed.has(text)) return text;
|
|
if (/^source-commit-run-conflict:\d+$/u.test(text)) return text;
|
|
if (/^(?:pipeline-get|pipelinerun-list)-command-failed:(?:unknown|\d+):type=string,length=\d+,sha256=[0-9a-f]{64}$/u.test(text)) return text;
|
|
if (/^runtime-observer-input-error:type=string,length=\d+,sha256=[0-9a-f]{64}$/u.test(text)) return text;
|
|
return `runtime-observer-reason:${valueEvidence(text)}`;
|
|
}
|
|
|
|
function unavailable(reason, sourceCommit = null, candidateCount = 0) {
|
|
return {
|
|
status: "unavailable",
|
|
name: null,
|
|
canonicalSha256: null,
|
|
firstDrift: null,
|
|
provenanceAligned: false,
|
|
configRef: null,
|
|
effectiveConfigSha256: null,
|
|
sourceCommit,
|
|
reason: safeRuntimeReason(reason),
|
|
candidateCount,
|
|
};
|
|
}
|
|
|
|
function missing(reason, sourceCommit = null) {
|
|
return { ...unavailable(reason, sourceCommit, 0), status: "missing" };
|
|
}
|
|
|
|
function isAdmissionDefault(path, value) {
|
|
const normalized = path.map((segment) => typeof segment === "number" ? "*" : segment).join(".");
|
|
const emptyRecord = value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 0;
|
|
const atTaskSpec = (suffix) => [
|
|
`tasks.*.taskSpec.${suffix}`,
|
|
`spec.tasks.*.taskSpec.${suffix}`,
|
|
`spec.pipelineSpec.tasks.*.taskSpec.${suffix}`,
|
|
].includes(normalized);
|
|
if (atTaskSpec("metadata")) return emptyRecord;
|
|
if (atTaskSpec("spec")) return value === null;
|
|
if (atTaskSpec("params.*.type")) return value === "string";
|
|
if (atTaskSpec("results.*.type")) return value === "string";
|
|
if (atTaskSpec("steps.*.computeResources")) return emptyRecord;
|
|
if (atTaskSpec("sidecars.*.computeResources")) return emptyRecord;
|
|
return false;
|
|
}
|
|
|
|
export function canonicalizePacPipelineSpec(value, path = []) {
|
|
if (Array.isArray(value)) return value.map((item, index) => canonicalizePacPipelineSpec(item, [...path, index]));
|
|
if (value === null || typeof value !== "object") return value;
|
|
const output = {};
|
|
for (const key of Object.keys(value).sort()) {
|
|
const child = value[key];
|
|
const childPath = [...path, key];
|
|
if (isAdmissionDefault(childPath, child)) continue;
|
|
output[key] = canonicalizePacPipelineSpec(child, childPath);
|
|
}
|
|
return output;
|
|
}
|
|
|
|
export function canonicalPacPipelineSha256(value) {
|
|
return `sha256:${createHash("sha256").update(JSON.stringify(canonicalizePacPipelineSpec(value))).digest("hex")}`;
|
|
}
|
|
|
|
function firstCanonicalDrift(expected, actual, path = "$") {
|
|
if (Object.is(expected, actual)) return null;
|
|
if (Array.isArray(expected) || Array.isArray(actual)) {
|
|
if (!Array.isArray(expected) || !Array.isArray(actual)) return { path, expected: valueEvidence(expected), actual: valueEvidence(actual) };
|
|
if (expected.length !== actual.length) return { path: `${path}.length`, expected: valueEvidence(expected.length), actual: valueEvidence(actual.length) };
|
|
for (let index = 0; index < expected.length; index += 1) {
|
|
const drift = firstCanonicalDrift(expected[index], actual[index], `${path}[${index}]`);
|
|
if (drift !== null) return drift;
|
|
}
|
|
return null;
|
|
}
|
|
const expectedRecord = expected !== null && typeof expected === "object";
|
|
const actualRecord = actual !== null && typeof actual === "object";
|
|
if (expectedRecord || actualRecord) {
|
|
if (!expectedRecord || !actualRecord) return { path, expected: valueEvidence(expected), actual: valueEvidence(actual) };
|
|
const keys = [...new Set([...Object.keys(expected), ...Object.keys(actual)])].sort();
|
|
for (const key of keys) {
|
|
const expectedOwnsKey = Object.prototype.hasOwnProperty.call(expected, key);
|
|
const actualOwnsKey = Object.prototype.hasOwnProperty.call(actual, key);
|
|
const childPath = knownDriftPathKeys.has(key) ? `${path}.${key}` : `${path}.[key:${valueEvidence(key)}]`;
|
|
if (!expectedOwnsKey || !actualOwnsKey) {
|
|
return { path: childPath, expected: valueEvidence(expected[key]), actual: valueEvidence(actual[key]) };
|
|
}
|
|
const drift = firstCanonicalDrift(expected[key], actual[key], childPath);
|
|
if (drift !== null) return drift;
|
|
}
|
|
return null;
|
|
}
|
|
return { path, expected: valueEvidence(expected), actual: valueEvidence(actual) };
|
|
}
|
|
|
|
function firstDrift(expected, actual) {
|
|
return firstCanonicalDrift(canonicalizePacPipelineSpec(expected), canonicalizePacPipelineSpec(actual));
|
|
}
|
|
|
|
function kubectlJson(args, label) {
|
|
try {
|
|
return {
|
|
kind: "ok",
|
|
value: JSON.parse(execFileSync("kubectl", args, { encoding: "utf8", timeout: 30_000, maxBuffer: 64 * 1024 * 1024 })),
|
|
};
|
|
} catch (error) {
|
|
const stderr = typeof error?.stderr === "string" ? error.stderr : Buffer.isBuffer(error?.stderr) ? error.stderr.toString("utf8") : "";
|
|
const stdout = typeof error?.stdout === "string" ? error.stdout : Buffer.isBuffer(error?.stdout) ? error.stdout.toString("utf8") : "";
|
|
const message = stderr.trim().split(/\r?\n/u)[0] || stdout.trim().split(/\r?\n/u)[0] || String(error?.message ?? "command failed");
|
|
if (/\bNotFound\b|\bnot found\b/u.test(message)) return { kind: "not-found", reason: `${label}-not-found` };
|
|
const status = Number.isInteger(error?.status) ? error.status : "unknown";
|
|
return { kind: "unavailable", reason: `${label}-command-failed:${status}:${valueEvidence(message)}` };
|
|
}
|
|
}
|
|
|
|
function manifestProvenance(manifest) {
|
|
const annotations = record(record(manifest?.metadata).annotations);
|
|
return {
|
|
configRef: typeof annotations[provenanceKeys.configRef] === "string" ? annotations[provenanceKeys.configRef] : null,
|
|
effectiveConfigSha256: typeof annotations[provenanceKeys.effectiveConfigSha256] === "string" ? annotations[provenanceKeys.effectiveConfigSha256] : null,
|
|
renderer: typeof annotations[provenanceKeys.renderer] === "string" ? annotations[provenanceKeys.renderer] : null,
|
|
mode: typeof annotations[provenanceKeys.mode] === "string" ? annotations[provenanceKeys.mode] : null,
|
|
};
|
|
}
|
|
|
|
function manifestSourceCommits(manifest) {
|
|
const metadata = record(manifest?.metadata);
|
|
const labels = record(metadata.labels);
|
|
const annotations = record(metadata.annotations);
|
|
return [...new Set(sourceCommitKeys.flatMap((key) => [labels[key], annotations[key]])
|
|
.filter((value) => typeof value === "string" && /^[0-9a-f]{40}$/iu.test(value))
|
|
.map((value) => value.toLowerCase()))];
|
|
}
|
|
|
|
function safeManifestName(value) {
|
|
return typeof value === "string"
|
|
&& value.length <= 253
|
|
&& /^[a-z0-9](?:[-a-z0-9.]*[a-z0-9])?$/u.test(value)
|
|
? value
|
|
: null;
|
|
}
|
|
|
|
function safeAlignedConfigRef(observed, expected) {
|
|
return observed === expected
|
|
&& typeof expected === "string"
|
|
&& expected.length <= 512
|
|
&& /^[A-Za-z0-9_./-]+#[A-Za-z0-9_.-]+$/u.test(expected)
|
|
? expected
|
|
: null;
|
|
}
|
|
|
|
function safeAlignedSha256(observed, expected) {
|
|
return observed === expected && typeof expected === "string" && /^sha256:[0-9a-f]{64}$/u.test(expected) ? expected : null;
|
|
}
|
|
|
|
function pipelineRunWrapper(manifest) {
|
|
const spec = record(manifest?.spec);
|
|
const hasPipelineSpec = Object.prototype.hasOwnProperty.call(spec, "pipelineSpec");
|
|
const hasPipelineRef = Object.prototype.hasOwnProperty.call(spec, "pipelineRef");
|
|
const observedMode = manifestProvenance(manifest).mode;
|
|
const mode = observedMode === "embedded-pipeline-spec" || observedMode === "remote-pipeline-annotation" ? observedMode : "invalid";
|
|
const executionMode = hasPipelineSpec && !hasPipelineRef ? "pipeline-spec" : "invalid";
|
|
const wrapperSpec = { ...spec };
|
|
delete wrapperSpec.pipelineSpec;
|
|
delete wrapperSpec.pipelineRef;
|
|
return { mode, executionMode, spec: wrapperSpec };
|
|
}
|
|
|
|
function observedItem(input, manifest, spec, sourceCommit = null, candidateCount = 0, wrapper = null) {
|
|
const observedProvenance = manifestProvenance(manifest);
|
|
const provenanceAligned = observedProvenance.configRef === input.provenance.configRef
|
|
&& observedProvenance.effectiveConfigSha256 === input.provenance.effectiveConfigSha256
|
|
&& observedProvenance.renderer === input.provenance.renderer
|
|
&& observedProvenance.mode === input.provenance.mode;
|
|
const comparePipelineSpec = wrapper === null || wrapper.executionMode === "pipeline-spec";
|
|
const specDrift = comparePipelineSpec ? firstDrift(input.desiredSpec, spec) : null;
|
|
const wrapperDrift = wrapper === null || input.desiredWrapper === null
|
|
? null
|
|
: firstDrift(input.desiredWrapper, wrapper);
|
|
const drift = specDrift ?? wrapperDrift;
|
|
return {
|
|
status: drift === null ? "aligned" : "drifted",
|
|
name: safeManifestName(record(manifest.metadata).name),
|
|
canonicalSha256: canonicalPacPipelineSha256(
|
|
wrapper === null
|
|
? spec
|
|
: wrapper.executionMode === "pipeline-spec"
|
|
? { pipelineSpec: spec, wrapper }
|
|
: { wrapper },
|
|
),
|
|
firstDrift: drift,
|
|
provenanceAligned,
|
|
configRef: safeAlignedConfigRef(observedProvenance.configRef, input.provenance.configRef),
|
|
effectiveConfigSha256: safeAlignedSha256(observedProvenance.effectiveConfigSha256, input.provenance.effectiveConfigSha256),
|
|
renderer: observedProvenance.renderer === input.provenance.renderer ? input.provenance.renderer : null,
|
|
mode: observedProvenance.mode === input.provenance.mode ? input.provenance.mode : null,
|
|
sourceCommit,
|
|
reason: null,
|
|
candidateCount,
|
|
};
|
|
}
|
|
|
|
export function selectPipelineRunBySourceCommit(items, pipelineRunPrefix, sourceCommit) {
|
|
if (sourceCommit === null) return { kind: "unavailable", reason: "source-commit-not-specified", run: null, candidates: [] };
|
|
const candidates = items.filter((run) => {
|
|
const name = String(record(run?.metadata).name ?? "");
|
|
return name.startsWith(pipelineRunPrefix) && manifestSourceCommits(run).includes(sourceCommit);
|
|
});
|
|
if (candidates.length === 0) return { kind: "missing", reason: "source-commit-run-not-found", run: null, candidates: [] };
|
|
if (candidates.some((run) => {
|
|
const commits = manifestSourceCommits(run);
|
|
return commits.length !== 1 || commits[0] !== sourceCommit;
|
|
})) return { kind: "unavailable", reason: "source-commit-identity-conflict", run: null, candidates };
|
|
const ordered = [...candidates].sort((left, right) => {
|
|
const time = String(record(right?.metadata).creationTimestamp ?? "").localeCompare(String(record(left?.metadata).creationTimestamp ?? ""));
|
|
return time !== 0 ? time : String(record(right?.metadata).name ?? "").localeCompare(String(record(left?.metadata).name ?? ""));
|
|
});
|
|
return { kind: "ok", reason: null, run: ordered[0], candidates: ordered };
|
|
}
|
|
|
|
export function observePacSourceArtifactRuntime(input, readKubectlJson = kubectlJson) {
|
|
const liveResult = readKubectlJson(["get", "pipeline", input.pipeline, "-n", input.namespace, "-o", "json"], "pipeline-get");
|
|
const live = liveResult.kind === "ok"
|
|
? observedItem(input, liveResult.value, record(liveResult.value.spec))
|
|
: liveResult.kind === "not-found"
|
|
? missing(liveResult.reason)
|
|
: unavailable(liveResult.reason);
|
|
|
|
let embedded;
|
|
if (input.sourceCommit === null) {
|
|
embedded = unavailable("source-commit-not-specified");
|
|
} else {
|
|
const runsResult = readKubectlJson(["get", "pipelinerun", "-n", input.namespace, "-o", "json"], "pipelinerun-list");
|
|
if (runsResult.kind !== "ok") {
|
|
embedded = runsResult.kind === "not-found" ? missing(runsResult.reason, input.sourceCommit) : unavailable(runsResult.reason, input.sourceCommit);
|
|
} else {
|
|
const items = Array.isArray(runsResult.value?.items) ? runsResult.value.items : null;
|
|
if (items === null) {
|
|
embedded = unavailable("pipelinerun-list-invalid-shape", input.sourceCommit);
|
|
} else {
|
|
const selected = selectPipelineRunBySourceCommit(items, input.pipelineRunPrefix, input.sourceCommit);
|
|
if (selected.kind === "ok") {
|
|
const signatures = selected.candidates.map((run) => JSON.stringify({
|
|
canonicalSha256: (() => {
|
|
const wrapper = pipelineRunWrapper(run);
|
|
return canonicalPacPipelineSha256(wrapper.executionMode === "pipeline-spec"
|
|
? { pipelineSpec: record(record(run.spec).pipelineSpec), wrapper }
|
|
: { wrapper });
|
|
})(),
|
|
provenance: manifestProvenance(run),
|
|
}));
|
|
embedded = new Set(signatures).size === 1
|
|
? observedItem(
|
|
input,
|
|
selected.run,
|
|
record(record(selected.run.spec).pipelineSpec),
|
|
input.sourceCommit,
|
|
selected.candidates.length,
|
|
pipelineRunWrapper(selected.run),
|
|
)
|
|
: unavailable(`source-commit-run-conflict:${selected.candidates.length}`, input.sourceCommit, selected.candidates.length);
|
|
} else {
|
|
embedded = selected.kind === "missing"
|
|
? missing(selected.reason, input.sourceCommit)
|
|
: unavailable(selected.reason, input.sourceCommit, selected.candidates.length);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
return { live, embedded };
|
|
}
|
|
|
|
if (typeof process.env.PAC_SOURCE_ARTIFACT_INPUT_FILE === "string") {
|
|
try {
|
|
const inputText = readFileSync(process.env.PAC_SOURCE_ARTIFACT_INPUT_FILE, "utf8");
|
|
const input = JSON.parse(inputText);
|
|
process.stdout.write(JSON.stringify(observePacSourceArtifactRuntime(input)));
|
|
} catch (error) {
|
|
const evidence = valueEvidence(String(error?.message ?? error));
|
|
process.stdout.write(JSON.stringify({
|
|
live: unavailable(`runtime-observer-input-error:${evidence}`),
|
|
embedded: unavailable(`runtime-observer-input-error:${evidence}`),
|
|
}));
|
|
}
|
|
}
|