Codex
265 lines
14 KiB
JavaScript
265 lines
14 KiB
JavaScript
#!/usr/bin/env bun
|
|
import { createHash } from "node:crypto";
|
|
import { spawnSync } from "node:child_process";
|
|
import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
|
|
import { dirname, resolve } from "node:path";
|
|
import { pathToFileURL } from "node:url";
|
|
|
|
function option(name) {
|
|
const index = process.argv.indexOf(name);
|
|
if (index === -1) return null;
|
|
const value = process.argv[index + 1];
|
|
if (value === undefined || value.length === 0 || value.startsWith("--")) throw new Error(`${name} requires a value`);
|
|
return value;
|
|
}
|
|
|
|
function record(value, path) {
|
|
if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${path} must be an object`);
|
|
return value;
|
|
}
|
|
|
|
function required(value, path) {
|
|
if (typeof value !== "string" || value.length === 0 || value.includes("\n")) throw new Error(`${path} must be a non-empty single-line string`);
|
|
return value;
|
|
}
|
|
|
|
function fullCommit(value, path) {
|
|
const commit = required(value, path);
|
|
if (!/^[0-9a-f]{40}$/u.test(commit)) throw new Error(`${path} must be a full Git commit SHA`);
|
|
return commit;
|
|
}
|
|
|
|
function safeRelativePath(value, path) {
|
|
const result = required(value, path);
|
|
if (result.startsWith("/") || result.endsWith("/") || !/^[A-Za-z0-9._/-]+$/u.test(result) || result.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
|
|
throw new Error(`${path} must be a safe relative path`);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
function run(command, args, cwd, allowFailure = false) {
|
|
const result = spawnSync(command, args, { cwd, encoding: "utf8", maxBuffer: 8 * 1024 * 1024 });
|
|
if (result.error !== undefined) throw result.error;
|
|
if (result.status !== 0 && !allowFailure) {
|
|
const detail = `${result.stderr || result.stdout || "command failed"}`.trim().slice(-3000);
|
|
throw new Error(`${command} ${args.join(" ")} failed (${result.status}): ${detail}`);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
function digest(value) {
|
|
return createHash("sha256").update(value).digest("hex");
|
|
}
|
|
|
|
function validateDelivery(value) {
|
|
const delivery = record(value, "gitOpsDelivery");
|
|
if (delivery.enabled !== true) throw new Error("gitOpsDelivery.enabled must be true");
|
|
const application = record(delivery.application, "gitOpsDelivery.application");
|
|
const author = record(delivery.author, "gitOpsDelivery.author");
|
|
const cas = record(delivery.cas, "gitOpsDelivery.cas");
|
|
const maxAttempts = cas.maxAttempts;
|
|
if (!Number.isInteger(maxAttempts) || maxAttempts < 1 || maxAttempts > 5) throw new Error("gitOpsDelivery.cas.maxAttempts must be an integer from 1 to 5");
|
|
const parsed = {
|
|
enabled: true,
|
|
targetId: required(delivery.targetId, "gitOpsDelivery.targetId"),
|
|
readUrl: required(delivery.readUrl, "gitOpsDelivery.readUrl"),
|
|
writeUrl: required(delivery.writeUrl, "gitOpsDelivery.writeUrl"),
|
|
branch: required(delivery.branch, "gitOpsDelivery.branch"),
|
|
sourceSnapshotPrefix: required(delivery.sourceSnapshotPrefix, "gitOpsDelivery.sourceSnapshotPrefix").replace(/\/+$/u, ""),
|
|
desiredManifestPath: safeRelativePath(delivery.desiredManifestPath, "gitOpsDelivery.desiredManifestPath"),
|
|
bootstrapApplicationPath: safeRelativePath(delivery.bootstrapApplicationPath, "gitOpsDelivery.bootstrapApplicationPath"),
|
|
releaseStatePath: safeRelativePath(delivery.releaseStatePath, "gitOpsDelivery.releaseStatePath"),
|
|
application: {
|
|
name: required(application.name, "gitOpsDelivery.application.name"),
|
|
namespace: required(application.namespace, "gitOpsDelivery.application.namespace"),
|
|
project: required(application.project, "gitOpsDelivery.application.project"),
|
|
repoUrl: required(application.repoUrl, "gitOpsDelivery.application.repoUrl"),
|
|
targetRevision: required(application.targetRevision, "gitOpsDelivery.application.targetRevision"),
|
|
path: safeRelativePath(application.path, "gitOpsDelivery.application.path"),
|
|
destinationNamespace: required(application.destinationNamespace, "gitOpsDelivery.application.destinationNamespace"),
|
|
automated: application.automated === true,
|
|
},
|
|
author: {
|
|
name: required(author.name, "gitOpsDelivery.author.name"),
|
|
email: required(author.email, "gitOpsDelivery.author.email"),
|
|
},
|
|
cas: { maxAttempts },
|
|
};
|
|
if (parsed.application.targetRevision !== parsed.branch) throw new Error("gitOpsDelivery.application.targetRevision must match branch");
|
|
if (parsed.application.repoUrl !== parsed.readUrl) throw new Error("gitOpsDelivery.application.repoUrl must match readUrl");
|
|
return parsed;
|
|
}
|
|
|
|
export function renderPlatformInfraGiteaApplication(deliveryValue) {
|
|
const delivery = validateDelivery(deliveryValue);
|
|
const application = {
|
|
apiVersion: "argoproj.io/v1alpha1",
|
|
kind: "Application",
|
|
metadata: {
|
|
name: delivery.application.name,
|
|
namespace: delivery.application.namespace,
|
|
labels: {
|
|
"app.kubernetes.io/managed-by": "unidesk",
|
|
"app.kubernetes.io/part-of": "platform-infra",
|
|
},
|
|
},
|
|
spec: {
|
|
project: delivery.application.project,
|
|
source: {
|
|
repoURL: delivery.application.repoUrl,
|
|
targetRevision: delivery.application.targetRevision,
|
|
path: delivery.application.path,
|
|
},
|
|
destination: {
|
|
server: "https://kubernetes.default.svc",
|
|
namespace: delivery.application.destinationNamespace,
|
|
},
|
|
syncPolicy: delivery.application.automated ? {
|
|
automated: { prune: true, selfHeal: true },
|
|
syncOptions: ["CreateNamespace=true"],
|
|
} : undefined,
|
|
},
|
|
};
|
|
return `${Bun.YAML.stringify(application).trim()}\n`;
|
|
}
|
|
|
|
function readReleaseState(path, delivery) {
|
|
if (!existsSync(path)) return null;
|
|
const value = record(JSON.parse(readFileSync(path, "utf8")), path);
|
|
if (value.version !== 1 || value.kind !== "PlatformInfraGiteaGitOpsState") throw new Error(`${path} must be a PlatformInfraGiteaGitOpsState v1 record`);
|
|
if (value.targetId !== delivery.targetId) throw new Error(`${path}.targetId must match gitOpsDelivery.targetId`);
|
|
const result = {
|
|
sourceCommit: fullCommit(value.sourceCommit, `${path}.sourceCommit`),
|
|
desiredManifestSha256: required(value.desiredManifestSha256, `${path}.desiredManifestSha256`),
|
|
bootstrapApplicationSha256: required(value.bootstrapApplicationSha256, `${path}.bootstrapApplicationSha256`),
|
|
};
|
|
if (!/^[0-9a-f]{64}$/u.test(result.desiredManifestSha256) || !/^[0-9a-f]{64}$/u.test(result.bootstrapApplicationSha256)) {
|
|
throw new Error(`${path} materialization hashes must be full SHA-256 hex values`);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
function sourceRelation(sourceRoot, delivery, existingCommit, sourceCommit) {
|
|
if (existingCommit === sourceCommit) return "same";
|
|
const refs = [existingCommit, sourceCommit].map((commit, index) => `+${delivery.sourceSnapshotPrefix}/${commit}:refs/unidesk/platform-infra-gitea-source-${index}`);
|
|
const fetchArgs = existsSync(resolve(sourceRoot, ".git", "shallow"))
|
|
? ["fetch", "--unshallow", "--filter=blob:none", "origin", ...refs]
|
|
: ["fetch", "--filter=blob:none", "origin", ...refs];
|
|
run("git", fetchArgs, sourceRoot);
|
|
if (run("git", ["merge-base", "--is-ancestor", existingCommit, sourceCommit], sourceRoot, true).status === 0) return "forward";
|
|
if (run("git", ["merge-base", "--is-ancestor", sourceCommit, existingCommit], sourceRoot, true).status === 0) return "superseded";
|
|
return "diverged";
|
|
}
|
|
|
|
function checkoutGitOpsBranch(delivery, sourceRoot, worktree) {
|
|
rmSync(worktree, { recursive: true, force: true });
|
|
run("git", ["clone", "--no-checkout", delivery.readUrl, worktree], sourceRoot);
|
|
run("git", ["remote", "set-url", "--push", "origin", delivery.writeUrl], worktree);
|
|
const fetched = run("git", ["fetch", "origin", `+refs/heads/${delivery.branch}:refs/remotes/origin/${delivery.branch}`], worktree, true).status === 0;
|
|
if (fetched) {
|
|
run("git", ["checkout", "-B", delivery.branch, `refs/remotes/origin/${delivery.branch}`], worktree);
|
|
return run("git", ["rev-parse", `refs/remotes/origin/${delivery.branch}`], worktree).stdout.trim();
|
|
}
|
|
run("git", ["checkout", "--orphan", delivery.branch], worktree);
|
|
run("git", ["rm", "-rf", "."], worktree, true);
|
|
return null;
|
|
}
|
|
|
|
function writeDesiredFiles(worktree, delivery, desiredManifest, applicationManifest, state) {
|
|
const entries = [
|
|
[delivery.desiredManifestPath, desiredManifest],
|
|
[delivery.bootstrapApplicationPath, applicationManifest],
|
|
[delivery.releaseStatePath, `${JSON.stringify(state, null, 2)}\n`],
|
|
];
|
|
for (const [relativePath, content] of entries) {
|
|
const target = resolve(worktree, relativePath);
|
|
if (!target.startsWith(`${worktree}/`)) throw new Error(`${relativePath} escaped the GitOps worktree`);
|
|
mkdirSync(dirname(target), { recursive: true });
|
|
writeFileSync(target, content, { encoding: "utf8", mode: 0o644 });
|
|
}
|
|
run("git", ["add", "--", ...entries.map(([relativePath]) => relativePath)], worktree);
|
|
}
|
|
|
|
export function publishPlatformInfraGiteaGitOps({
|
|
delivery: deliveryValue,
|
|
desiredManifest,
|
|
sourceRoot,
|
|
sourceCommit: sourceCommitValue,
|
|
worktree,
|
|
beforePush = null,
|
|
}) {
|
|
const delivery = validateDelivery(deliveryValue);
|
|
const sourceCommit = fullCommit(sourceCommitValue, "sourceCommit");
|
|
const resolvedSourceRoot = resolve(sourceRoot);
|
|
const resolvedWorktree = resolve(worktree);
|
|
const checkedOutCommit = run("git", ["rev-parse", "HEAD"], resolvedSourceRoot).stdout.trim();
|
|
if (checkedOutCommit !== sourceCommit) throw new Error(`source checkout ${checkedOutCommit} does not match requested sourceCommit ${sourceCommit}`);
|
|
if (typeof desiredManifest !== "string" || !desiredManifest.includes("kind: Deployment") || !desiredManifest.includes("kind: PersistentVolumeClaim") || !desiredManifest.includes("kind: ServiceAccount")) {
|
|
throw new Error("desired manifest must contain the durable bridge Deployment, PersistentVolumeClaim and ServiceAccount");
|
|
}
|
|
const applicationManifest = renderPlatformInfraGiteaApplication(delivery);
|
|
const state = {
|
|
version: 1,
|
|
kind: "PlatformInfraGiteaGitOpsState",
|
|
targetId: delivery.targetId,
|
|
sourceCommit,
|
|
desiredManifestSha256: digest(desiredManifest),
|
|
bootstrapApplicationSha256: digest(applicationManifest),
|
|
};
|
|
let lastPushError = "";
|
|
for (let attempt = 1; attempt <= delivery.cas.maxAttempts; attempt += 1) {
|
|
const baseCommit = checkoutGitOpsBranch(delivery, resolvedSourceRoot, resolvedWorktree);
|
|
const statePath = resolve(resolvedWorktree, delivery.releaseStatePath);
|
|
const existingState = readReleaseState(statePath, delivery);
|
|
if (existingState !== null) {
|
|
const relation = sourceRelation(resolvedSourceRoot, delivery, existingState.sourceCommit, sourceCommit);
|
|
if (relation === "same" && (
|
|
existingState.desiredManifestSha256 !== state.desiredManifestSha256
|
|
|| existingState.bootstrapApplicationSha256 !== state.bootstrapApplicationSha256
|
|
)) {
|
|
throw new Error(`same source commit ${sourceCommit} has conflicting GitOps materialization state`);
|
|
}
|
|
if (relation === "superseded") {
|
|
return { ok: true, phase: "gitops-publish", status: "superseded", sourceCommit, authoritativeSourceCommit: existingState.sourceCommit, changed: false, pushAttempts: attempt - 1, valuesPrinted: false };
|
|
}
|
|
if (relation === "diverged") throw new Error(`source commit ${sourceCommit} diverges from authoritative GitOps source ${existingState.sourceCommit}`);
|
|
}
|
|
writeDesiredFiles(resolvedWorktree, delivery, desiredManifest, applicationManifest, state);
|
|
run("git", ["config", "user.name", delivery.author.name], resolvedWorktree);
|
|
run("git", ["config", "user.email", delivery.author.email], resolvedWorktree);
|
|
const changed = run("git", ["diff", "--cached", "--quiet"], resolvedWorktree, true).status !== 0;
|
|
if (!changed) {
|
|
return { ok: true, phase: "gitops-publish", status: "idempotent", sourceCommit, gitOpsCommit: baseCommit, changed: false, pushAttempts: attempt - 1, valuesPrinted: false };
|
|
}
|
|
run("git", ["commit", "-m", `platform-infra: deploy gitea bridge ${sourceCommit.slice(0, 12)}`], resolvedWorktree);
|
|
const gitOpsCommit = run("git", ["rev-parse", "HEAD"], resolvedWorktree).stdout.trim();
|
|
if (typeof beforePush === "function") beforePush({ attempt, baseCommit, gitOpsCommit, worktree: resolvedWorktree });
|
|
const lease = baseCommit === null
|
|
? `--force-with-lease=refs/heads/${delivery.branch}:`
|
|
: `--force-with-lease=refs/heads/${delivery.branch}:${baseCommit}`;
|
|
const push = run("git", ["push", "--porcelain", lease, "origin", `HEAD:refs/heads/${delivery.branch}`], resolvedWorktree, true);
|
|
if (push.status !== 0) {
|
|
lastPushError = `${push.stderr || push.stdout || "CAS push failed"}`.trim().slice(-2000);
|
|
continue;
|
|
}
|
|
const remoteCommit = run("git", ["ls-remote", delivery.writeUrl, `refs/heads/${delivery.branch}`], resolvedWorktree).stdout.trim().split(/\s+/u)[0] ?? "";
|
|
if (remoteCommit !== gitOpsCommit) throw new Error(`post-push GitOps ref proof failed: expected ${gitOpsCommit}, observed ${remoteCommit}`);
|
|
return { ok: true, phase: "gitops-publish", status: "published", sourceCommit, gitOpsCommit, changed: true, pushAttempts: attempt, valuesPrinted: false };
|
|
}
|
|
throw new Error(`GitOps CAS push failed after ${delivery.cas.maxAttempts} attempts: ${lastPushError || "unknown error"}`);
|
|
}
|
|
|
|
async function main() {
|
|
const sourceRoot = resolve(option("--source-root") ?? process.cwd());
|
|
const sourceCommit = fullCommit(option("--source-commit"), "--source-commit");
|
|
const worktree = resolve(option("--worktree") ?? "/workspace/platform-infra-gitea-gitops");
|
|
const moduleUrl = pathToFileURL(resolve(sourceRoot, "scripts", "src", "platform-infra-gitea.ts")).href;
|
|
const module = await import(moduleUrl);
|
|
const delivery = module.readGiteaWebhookGitOpsDelivery();
|
|
const desiredManifest = module.renderGiteaWebhookSyncDesiredManifest(delivery.targetId);
|
|
const result = publishPlatformInfraGiteaGitOps({ delivery, desiredManifest, sourceRoot, sourceCommit, worktree });
|
|
process.stdout.write(`${JSON.stringify(result)}\n`);
|
|
}
|
|
|
|
if (import.meta.main) await main();
|