Codex
255 lines
13 KiB
TypeScript
255 lines
13 KiB
TypeScript
import { readFileSync } from "node:fs";
|
|
import { rootPath } from "./src/config";
|
|
|
|
type JsonRecord = Record<string, unknown>;
|
|
type Environment = "dev" | "prod";
|
|
|
|
const reviewedSourceBuildServices = new Set([
|
|
"backend-core",
|
|
"frontend",
|
|
"baidu-netdisk",
|
|
"decision-center",
|
|
"project-manager",
|
|
"oa-event-flow",
|
|
"todo-note",
|
|
"code-queue-mgr",
|
|
"findjob",
|
|
"pipeline",
|
|
"met-nonlinear",
|
|
"k3sctl-adapter",
|
|
"mdtodo",
|
|
"claudeqq",
|
|
"code-queue",
|
|
]);
|
|
|
|
const reviewedArtifactConsumers = new Set([
|
|
"backend-core",
|
|
"frontend",
|
|
"baidu-netdisk",
|
|
"decision-center",
|
|
"project-manager",
|
|
"oa-event-flow",
|
|
"todo-note",
|
|
"code-queue-mgr",
|
|
"findjob",
|
|
"pipeline",
|
|
"met-nonlinear",
|
|
"k3sctl-adapter",
|
|
"mdtodo",
|
|
"claudeqq",
|
|
"code-queue",
|
|
]);
|
|
|
|
const plannedDeployJsonFields = [
|
|
"artifact.kind",
|
|
"artifact.repository",
|
|
"artifact.tag",
|
|
"artifact.digestRef",
|
|
"consumer.kind",
|
|
"consumer.dev.enabled",
|
|
"consumer.prod.enabled",
|
|
"consumer.supportLevel",
|
|
"consumer.targetRef",
|
|
"consumer.noRuntimeSourceBuild",
|
|
"runtime.containerPort",
|
|
"runtime.healthPath",
|
|
"runtime.memory.request",
|
|
"runtime.memory.limit",
|
|
"health.deployMetadataRequired",
|
|
"runtime.requiredSecretKeys",
|
|
];
|
|
|
|
const phaseTwoExecutorContractServices = new Set(["dev/decision-center", "dev/mdtodo", "dev/code-queue"]);
|
|
|
|
function assertCondition(condition: unknown, message: string, detail: unknown = {}): void {
|
|
if (!condition) throw new Error(`${message}: ${JSON.stringify(detail)}`);
|
|
}
|
|
|
|
function asRecord(value: unknown, label: string): JsonRecord {
|
|
assertCondition(typeof value === "object" && value !== null && !Array.isArray(value), `${label} must be an object`, value);
|
|
return value as JsonRecord;
|
|
}
|
|
|
|
function asArray(value: unknown, label: string): unknown[] {
|
|
assertCondition(Array.isArray(value), `${label} must be an array`, value);
|
|
return value as unknown[];
|
|
}
|
|
|
|
function stringField(value: unknown, label: string): string {
|
|
assertCondition(typeof value === "string" && value.length > 0, `${label} must be a non-empty string`, value);
|
|
return value as string;
|
|
}
|
|
|
|
function loadJson(path: string): JsonRecord {
|
|
return asRecord(JSON.parse(readFileSync(rootPath(path), "utf8")) as unknown, path);
|
|
}
|
|
|
|
function isFullSha(value: string): boolean {
|
|
return /^[0-9a-f]{40}$/u.test(value);
|
|
}
|
|
|
|
function deployServicesByEnvironment(deploy: JsonRecord, environment: Environment): JsonRecord[] {
|
|
const environments = asRecord(deploy.environments, "deploy.json.environments");
|
|
const env = asRecord(environments[environment], `deploy.json.environments.${environment}`);
|
|
return asArray(env.services, `deploy.json.environments.${environment}.services`).map((item, index) => asRecord(item, `${environment}.services[${index}]`));
|
|
}
|
|
|
|
function serviceKey(environment: Environment, serviceId: string): string {
|
|
return `${environment}/${serviceId}`;
|
|
}
|
|
|
|
function artifactByService(ciCatalog: JsonRecord): Map<string, JsonRecord> {
|
|
const artifacts = asArray(ciCatalog.artifacts, "CI.json.artifacts").map((item, index) => asRecord(item, `CI.json.artifacts[${index}]`));
|
|
return new Map(artifacts.map((artifact) => [stringField(artifact.serviceId, "CI.json artifact serviceId"), artifact]));
|
|
}
|
|
|
|
function configByService(config: JsonRecord): Map<string, JsonRecord> {
|
|
const microservices = asArray(config.microservices, "config.json.microservices").map((item, index) => asRecord(item, `config.json.microservices[${index}]`));
|
|
return new Map(microservices.map((service) => [stringField(service.id, "config service id"), service]));
|
|
}
|
|
|
|
function assertDeployJsonReleaseIntent(deploy: JsonRecord): Array<{ environment: Environment; serviceId: string; repo: string; commitId: string }> {
|
|
assertCondition(deploy.schemaVersion === 2, "deploy.json must remain schemaVersion=2", deploy);
|
|
const seen = new Set<string>();
|
|
const services: Array<{ environment: Environment; serviceId: string; repo: string; commitId: string }> = [];
|
|
for (const environment of ["dev", "prod"] as const) {
|
|
for (const service of deployServicesByEnvironment(deploy, environment)) {
|
|
const serviceId = stringField(service.id, `${environment} service id`);
|
|
const key = serviceKey(environment, serviceId);
|
|
const keys = Object.keys(service).sort();
|
|
const allowedKeys = phaseTwoExecutorContractServices.has(key)
|
|
? ["artifact", "commitId", "consumer", "id", "repo", "runtime"]
|
|
: ["commitId", "id", "repo"];
|
|
assertCondition(keys.join(",") === allowedKeys.join(","), "deploy.json service entries must stay in the reviewed phase-one/phase-two schema set", { environment, service, keys, allowedKeys });
|
|
const repo = stringField(service.repo, `${environment}/${serviceId}.repo`);
|
|
const commitId = stringField(service.commitId, `${environment}/${serviceId}.commitId`).toLowerCase();
|
|
assertCondition(isFullSha(commitId), "deploy.json phase-one commit pins must be full 40-character SHAs", { environment, serviceId, commitId });
|
|
assertCondition(!seen.has(key), "deploy.json service must not be duplicated within an environment", { key });
|
|
seen.add(key);
|
|
services.push({ environment, serviceId, repo, commitId });
|
|
}
|
|
}
|
|
return services;
|
|
}
|
|
|
|
function assertCiCatalogAlignment(services: Array<{ environment: Environment; serviceId: string; repo: string; commitId: string }>, ciCatalog: JsonRecord): void {
|
|
const artifacts = artifactByService(ciCatalog);
|
|
const defaults = asRecord(ciCatalog.defaults, "CI.json.defaults");
|
|
assertCondition(defaults.mutableTagsAllowed === false, "CI.json must continue rejecting mutable tags", defaults);
|
|
assertCondition(defaults.tagTemplate === "{{sourceCommit}}", "CI.json tag template must remain commit-pinned", defaults);
|
|
|
|
for (const service of services) {
|
|
const artifact = artifacts.get(service.serviceId);
|
|
assertCondition(artifact !== undefined, "every deploy.json service must have a CI catalog entry or a reviewed exception", service);
|
|
assertCondition(reviewedSourceBuildServices.has(service.serviceId), "deploy.json service must be in the reviewed source-build/drift set for phase one", service);
|
|
const kind = stringField(artifact?.kind, `${service.serviceId}.kind`);
|
|
const status = stringField(artifact?.status, `${service.serviceId}.status`);
|
|
assertCondition(kind === "source-build", "deploy.json source services must stay source-build in CI.json during phase one", { service, artifact });
|
|
assertCondition(status === "supported", "deploy.json source services must stay supported in CI.json during phase one", { service, artifact });
|
|
const source = asRecord(artifact?.source, `${service.serviceId}.source`);
|
|
const image = asRecord(artifact?.image, `${service.serviceId}.image`);
|
|
assertCondition(source.repo === service.repo, "deploy.json repo and CI.json source.repo must not drift", { service, source });
|
|
assertCondition(typeof source.dockerfile === "string" && source.dockerfile.length > 0, "CI.json must keep the producer Dockerfile until deploy.json owns artifact identity", { service, source });
|
|
assertCondition(image.repository === `unidesk/${service.serviceId}`, "CI image repository must remain service-id derived before deploy.json artifact.repository migration", { service, image });
|
|
}
|
|
}
|
|
|
|
function assertConfigCompatibility(services: Array<{ environment: Environment; serviceId: string; repo: string; commitId: string }>, config: JsonRecord): Array<{ environment: Environment; serviceId: string; deployCommitId: string; configCommitId: string }> {
|
|
const configs = configByService(config);
|
|
const commitMirrors: Array<{ environment: Environment; serviceId: string; deployCommitId: string; configCommitId: string }> = [];
|
|
for (const service of services) {
|
|
if (service.serviceId === "backend-core" || service.serviceId === "frontend") continue;
|
|
const configService = configs.get(service.serviceId);
|
|
assertCondition(configService !== undefined, "deploy.json service must exist in config.json until renderers replace config lookups", service);
|
|
const repository = asRecord(configService?.repository, `${service.serviceId}.repository`);
|
|
assertCondition(repository.url === service.repo, "deploy.json repo and config.json repository.url must not drift", { service, repository });
|
|
assertCondition(typeof repository.dockerfile === "string" && repository.dockerfile.length > 0, "config.json keeps Dockerfile target metadata in phase one", { service, repository });
|
|
assertCondition(typeof repository.composeService === "string" && repository.composeService.length > 0, "config.json keeps compose/k3s service name in phase one", { service, repository });
|
|
assertCondition(typeof repository.containerName === "string" && repository.containerName.length > 0, "config.json keeps container name in phase one", { service, repository });
|
|
const configCommitId = stringField(repository.commitId, `${service.serviceId}.repository.commitId`);
|
|
if (configCommitId === service.commitId) {
|
|
commitMirrors.push({ environment: service.environment, serviceId: service.serviceId, deployCommitId: service.commitId, configCommitId });
|
|
}
|
|
}
|
|
return commitMirrors;
|
|
}
|
|
|
|
function assertConsumerCoverage(services: Array<{ environment: Environment; serviceId: string; repo: string; commitId: string }>): void {
|
|
for (const service of services) {
|
|
assertCondition(reviewedArtifactConsumers.has(service.serviceId), "deploy.json service must be covered by the phase-one consumer drift set", service);
|
|
if (service.environment === "prod" && service.serviceId === "code-queue") {
|
|
continue;
|
|
}
|
|
if (service.serviceId === "k3sctl-adapter" || service.serviceId === "met-nonlinear") {
|
|
continue;
|
|
}
|
|
assertCondition(
|
|
service.serviceId !== "code-agent-sandbox",
|
|
"code-agent-sandbox must not become a deploy.json artifact consumer before the schema contract is reviewed",
|
|
service,
|
|
);
|
|
}
|
|
}
|
|
|
|
function assertUpstreamImageBoundary(ciCatalog: JsonRecord, config: JsonRecord): void {
|
|
const artifacts = artifactByService(ciCatalog);
|
|
const configs = configByService(config);
|
|
for (const serviceId of ["filebrowser", "filebrowser-d601"]) {
|
|
const artifact = asRecord(artifacts.get(serviceId), `CI.json ${serviceId}`);
|
|
const upstream = asRecord(artifact.upstream, `CI.json ${serviceId}.upstream`);
|
|
const configService = asRecord(configs.get(serviceId), `config.json ${serviceId}`);
|
|
const repository = asRecord(configService.repository, `config.json ${serviceId}.repository`);
|
|
const artifactSource = asRecord(repository.artifactSource, `config.json ${serviceId}.repository.artifactSource`);
|
|
assertCondition(artifact.kind === "upstream-image", "File Browser services must stay upstream-image catalog entries", artifact);
|
|
assertCondition(artifact.status === "blocked", "File Browser upstream-image services must stay blocked until mirror consumer exists", artifact);
|
|
assertCondition(upstream.imageRef === artifactSource.imageRef, "CI upstream imageRef and config artifactSource imageRef must not drift", { serviceId, upstream, artifactSource });
|
|
assertCondition(artifactSource.ciDockerfileBuild === false, "File Browser must not be treated as a CI Dockerfile build", { serviceId, artifactSource });
|
|
assertCondition(artifactSource.pullOnlyCd === true, "File Browser must remain pull-only CD", { serviceId, artifactSource });
|
|
assertCondition(typeof upstream.digestRef === "string" && String(upstream.digestRef).includes("@sha256:"), "upstream image entry must keep a digest pin", { serviceId, upstream });
|
|
}
|
|
}
|
|
|
|
function assertDocsContract(): void {
|
|
const docs = readFileSync(rootPath("docs/reference/cicd-standardization.md"), "utf8");
|
|
for (const phrase of [
|
|
"Phase-One Deploy.json Consolidation Contract",
|
|
"dev/mdtodo",
|
|
"deploy-json-drift",
|
|
"bun scripts/issue-60-deploy-json-executor-preflight-contract-test.ts",
|
|
"Current duplicated configuration surfaces",
|
|
"Fields that stay outside `deploy.json` during phase one",
|
|
"The drift contract is:",
|
|
"bun scripts/issue-60-cicd-drift-contract-test.ts",
|
|
]) {
|
|
assertCondition(docs.includes(phrase), "CI/CD standardization docs must include the issue #60 phase-one contract", { phrase });
|
|
}
|
|
for (const field of plannedDeployJsonFields) {
|
|
assertCondition(docs.includes(field), "phase-one docs must name the planned deploy.json schema field", { field });
|
|
}
|
|
}
|
|
|
|
const deploy = loadJson("deploy.json");
|
|
const ciCatalog = loadJson("CI.json");
|
|
const config = loadJson("config.json");
|
|
const services = assertDeployJsonReleaseIntent(deploy);
|
|
assertCiCatalogAlignment(services, ciCatalog);
|
|
const configCommitMirrors = assertConfigCompatibility(services, config);
|
|
assertConsumerCoverage(services);
|
|
assertUpstreamImageBoundary(ciCatalog, config);
|
|
assertDocsContract();
|
|
|
|
process.stdout.write(`${JSON.stringify({
|
|
ok: true,
|
|
checks: [
|
|
"deploy.json remains the phase-one release-intent source with full commit pins",
|
|
"deploy.json repo values match CI.json source-build producer repos",
|
|
"CI.json keeps commit-tag producer policy and service-id image repositories",
|
|
"config.json runtime topology remains compatibility metadata and does not own env-ref commits",
|
|
"File Browser upstream-image entries stay blocked from Dockerfile CI",
|
|
"docs/reference/cicd-standardization.md names the phase-one schema and drift contract",
|
|
],
|
|
deployServicesChecked: services.length,
|
|
compatibilityCommitMirrors: configCommitMirrors,
|
|
plannedDeployJsonFields,
|
|
}, null, 2)}\n`);
|