Codex
266 lines
18 KiB
TypeScript
266 lines
18 KiB
TypeScript
import { readFileSync } from "node:fs";
|
|
import { rootPath } from "./src/config";
|
|
import { runArtifactRegistryCommand } from "./src/artifact-registry";
|
|
|
|
type Environment = "dev" | "prod";
|
|
type ServiceId = "mdtodo" | "claudeqq" | "todo-note";
|
|
type JsonRecord = Record<string, unknown>;
|
|
|
|
type ServiceContract = {
|
|
serviceId: ServiceId;
|
|
desiredCommit: string;
|
|
runtimeCommit: string | null;
|
|
runtimeCommitSource: string;
|
|
artifactExists: boolean;
|
|
devStatus: string;
|
|
prodStatus: string;
|
|
blockedScopes: string[];
|
|
recommendedAction: string;
|
|
sourceRepo: string;
|
|
dockerfile: string;
|
|
registryRepository: string;
|
|
consumerKind: "d601-k3s" | "compose";
|
|
};
|
|
|
|
const contracts: ServiceContract[] = [
|
|
{
|
|
serviceId: "mdtodo",
|
|
desiredCommit: "595de3d320b73ec006794440b32db48b3ad14d2b",
|
|
runtimeCommit: "75fb6757b2504ba86d61f2587fb34a9c9ed4019a",
|
|
runtimeCommitSource: "prod Deployment annotations; desired artifact target was advanced because 75fb6757 predates mdtodo /health.deploy metadata",
|
|
artifactExists: false,
|
|
devStatus: "missing-dev-service",
|
|
prodStatus: "healthy-prod-annotation-stale-after-health-metadata-repin",
|
|
blockedScopes: ["registry-artifact", "dev-service", "runtime-health-metadata-proof", "prod-runtime-commit-drift"],
|
|
recommendedAction: "Publish the desired artifact that includes mdtodo health deploy metadata, create/verify unidesk-dev/mdtodo-dev, then run focused dev smoke before deciding whether prod needs replacement.",
|
|
sourceRepo: "https://github.com/pikasTech/unidesk",
|
|
dockerfile: "src/components/microservices/mdtodo/Dockerfile",
|
|
registryRepository: "unidesk/mdtodo",
|
|
consumerKind: "d601-k3s",
|
|
},
|
|
{
|
|
serviceId: "claudeqq",
|
|
desiredCommit: "203b1f46684c91340ecbbd8a74502bd55e4f2011",
|
|
runtimeCommit: "203b1f46684c91340ecbbd8a74502bd55e4f2011",
|
|
runtimeCommitSource: "prod /health deploy.commit and deploy.requestedCommit",
|
|
artifactExists: false,
|
|
devStatus: "missing-dev-service",
|
|
prodStatus: "healthy-prod-health-aligned-event-api-unverified",
|
|
blockedScopes: ["registry-artifact", "dev-service", "event-api-surface"],
|
|
recommendedAction: "Publish the desired artifact, create/verify unidesk-dev/claudeqq-dev, then resolve or document the event API paths before prod artifact replacement.",
|
|
sourceRepo: "https://gitee.com/lyon1998/agent_skills",
|
|
dockerfile: "claudeqq/Dockerfile",
|
|
registryRepository: "unidesk/claudeqq",
|
|
consumerKind: "d601-k3s",
|
|
},
|
|
{
|
|
serviceId: "todo-note",
|
|
desiredCommit: "a14ce0eb855a685fa17b47adacd54623e72cd2ff",
|
|
runtimeCommit: null,
|
|
runtimeCommitSource: "prod health and container labels do not expose source commit",
|
|
artifactExists: false,
|
|
devStatus: "consumer-plan-only-no-live-dev",
|
|
prodStatus: "healthy-behavior-no-commit-proof",
|
|
blockedScopes: ["registry-artifact", "runtime-commit-proof", "health-deploy-metadata"],
|
|
recommendedAction: "Publish the desired artifact, then use the no-build Compose artifact consumer to recreate only todo-note and verify image labels plus health deploy metadata.",
|
|
sourceRepo: "https://gitee.com/Lyon1998/todo_note",
|
|
dockerfile: "Dockerfile",
|
|
registryRepository: "unidesk/todo-note",
|
|
consumerKind: "compose",
|
|
},
|
|
];
|
|
|
|
function assertCondition(condition: unknown, message: string, detail: unknown = {}): void {
|
|
if (!condition) throw new Error(`${message}: ${JSON.stringify(detail)}`);
|
|
}
|
|
|
|
function asRecord(value: unknown, label: string): JsonRecord {
|
|
assertCondition(typeof value === "object" && value !== null && !Array.isArray(value), `${label} must be an object`, value);
|
|
return value as JsonRecord;
|
|
}
|
|
|
|
function asArray(value: unknown, label: string): unknown[] {
|
|
assertCondition(Array.isArray(value), `${label} must be an array`, value);
|
|
return value as unknown[];
|
|
}
|
|
|
|
function strings(value: unknown, label: string): string[] {
|
|
return asArray(value, label).map(String);
|
|
}
|
|
|
|
function manifestService(manifest: JsonRecord, environment: Environment, serviceId: ServiceId): JsonRecord {
|
|
const environments = asRecord(manifest.environments, "deploy.json.environments");
|
|
const env = asRecord(environments[environment], `deploy.json.environments.${environment}`);
|
|
const services = asArray(env.services, `deploy.json.environments.${environment}.services`);
|
|
const service = services.map((item, index) => asRecord(item, `${environment}.services[${index}]`)).find((item) => item.id === serviceId);
|
|
assertCondition(service !== undefined, `deploy.json ${environment} must include ${serviceId}`, env);
|
|
return service as JsonRecord;
|
|
}
|
|
|
|
function artifactCatalogEntry(catalog: JsonRecord, serviceId: ServiceId): JsonRecord {
|
|
const artifacts = asArray(catalog.artifacts, "CI.json.artifacts").map((item, index) => asRecord(item, `CI.json.artifacts[${index}]`));
|
|
const artifact = artifacts.find((item) => item.serviceId === serviceId);
|
|
assertCondition(artifact !== undefined, `CI.json must include ${serviceId}`, catalog);
|
|
return artifact as JsonRecord;
|
|
}
|
|
|
|
function assertDeployJson(): void {
|
|
const manifest = asRecord(JSON.parse(readFileSync(rootPath("deploy.json"), "utf8")) as unknown, "deploy.json");
|
|
assertCondition(manifest.schemaVersion === 2, "deploy.json must use schemaVersion=2", manifest);
|
|
for (const contract of contracts) {
|
|
for (const environment of ["dev", "prod"] as const) {
|
|
const service = manifestService(manifest, environment, contract.serviceId);
|
|
assertCondition(service.repo === contract.sourceRepo, `${contract.serviceId} ${environment} repo mismatch`, service);
|
|
assertCondition(service.commitId === contract.desiredCommit, `${contract.serviceId} ${environment} desired commit mismatch`, service);
|
|
}
|
|
}
|
|
}
|
|
|
|
function assertCiCatalog(): void {
|
|
const catalog = asRecord(JSON.parse(readFileSync(rootPath("CI.json"), "utf8")) as unknown, "CI.json");
|
|
for (const contract of contracts) {
|
|
const artifact = artifactCatalogEntry(catalog, contract.serviceId);
|
|
const source = asRecord(artifact.source, `${contract.serviceId} CI source`);
|
|
const image = asRecord(artifact.image, `${contract.serviceId} CI image`);
|
|
assertCondition(artifact.kind === "source-build", `${contract.serviceId} producer must be source-build`, artifact);
|
|
assertCondition(artifact.status === "supported", `${contract.serviceId} producer must be supported`, artifact);
|
|
assertCondition(artifact.producer === "ci publish-user-service", `${contract.serviceId} producer command mismatch`, artifact);
|
|
assertCondition(source.repo === contract.sourceRepo, `${contract.serviceId} source repo mismatch`, source);
|
|
assertCondition(source.dockerfile === contract.dockerfile, `${contract.serviceId} Dockerfile mismatch`, source);
|
|
assertCondition(image.repository === contract.registryRepository, `${contract.serviceId} registry repository mismatch`, image);
|
|
}
|
|
}
|
|
|
|
function assertNormalizedStatus(): void {
|
|
for (const contract of contracts) {
|
|
assertCondition(/^[0-9a-f]{40}$/u.test(contract.desiredCommit), `${contract.serviceId} desiredCommit must be a full sha`, contract);
|
|
assertCondition(contract.runtimeCommit === null || /^[0-9a-f]{40}$/u.test(contract.runtimeCommit), `${contract.serviceId} runtimeCommit must be a full sha or null`, contract);
|
|
assertCondition(contract.artifactExists === false, `${contract.serviceId} desired artifact should remain recorded as missing`, contract);
|
|
assertCondition(contract.devStatus.length > 0, `${contract.serviceId} devStatus must be structured`, contract);
|
|
assertCondition(contract.prodStatus.length > 0, `${contract.serviceId} prodStatus must be structured`, contract);
|
|
assertCondition(contract.blockedScopes.length > 0, `${contract.serviceId} blockedScopes must not be empty`, contract);
|
|
assertCondition(contract.recommendedAction.length > 0, `${contract.serviceId} recommendedAction must not be empty`, contract);
|
|
}
|
|
}
|
|
|
|
function assertCommonDryRun(plan: JsonRecord, contract: ServiceContract, environment: Environment): void {
|
|
const source = asRecord(plan.source, `${contract.serviceId} ${environment} source`);
|
|
const registry = asRecord(plan.registry, `${contract.serviceId} ${environment} registry`);
|
|
const build = asRecord(plan.build, `${contract.serviceId} ${environment} build`);
|
|
const labels = asRecord(plan.requiredLabels, `${contract.serviceId} ${environment} labels`);
|
|
const registryProbe = asRecord(plan.registryProbe, `${contract.serviceId} ${environment} registryProbe`);
|
|
|
|
assertCondition(plan.ok === true && plan.supported === true, `${contract.serviceId} ${environment} dry-run must be supported`, plan);
|
|
assertCondition(plan.dryRun === true && plan.mutation === false, `${contract.serviceId} ${environment} dry-run must be non-mutating`, plan);
|
|
assertCondition(plan.environment === environment, `${contract.serviceId} ${environment} environment mismatch`, plan);
|
|
assertCondition(plan.providerId === "D601", `${contract.serviceId} ${environment} provider mismatch`, plan);
|
|
assertCondition(plan.serviceId === contract.serviceId, `${contract.serviceId} ${environment} service id mismatch`, plan);
|
|
assertCondition(plan.commit === contract.desiredCommit, `${contract.serviceId} ${environment} commit mismatch`, plan);
|
|
const deployRef = `deploy.json#environments.${environment}.services.${contract.serviceId}`;
|
|
const allowedDeployRefs = [deployRef, `origin/master:${deployRef}`];
|
|
assertCondition(allowedDeployRefs.includes(String(plan.deployRef)), `${contract.serviceId} ${environment} deployRef mismatch`, plan);
|
|
assertCondition(plan.sourceImage === `127.0.0.1:5000/${contract.registryRepository}:${contract.desiredCommit}`, `${contract.serviceId} ${environment} source image mismatch`, plan);
|
|
assertCondition(source.repo === contract.sourceRepo, `${contract.serviceId} ${environment} source repo mismatch`, source);
|
|
assertCondition(source.commit === contract.desiredCommit, `${contract.serviceId} ${environment} source commit mismatch`, source);
|
|
assertCondition(source.dockerfile === contract.dockerfile, `${contract.serviceId} ${environment} source dockerfile mismatch`, source);
|
|
assertCondition(registry.repository === contract.registryRepository, `${contract.serviceId} ${environment} registry repository mismatch`, registry);
|
|
assertCondition(registry.imageRef === plan.sourceImage, `${contract.serviceId} ${environment} registry image mismatch`, registry);
|
|
assertCondition(registry.digest === null, `${contract.serviceId} ${environment} dry-run must not fake a digest`, registry);
|
|
assertCondition(String(registry.digestSource ?? "").includes("live apply must read this digest"), `${contract.serviceId} ${environment} digest source mismatch`, registry);
|
|
assertCondition(registryProbe.method === "HEAD", `${contract.serviceId} ${environment} registry probe must be HEAD`, registryProbe);
|
|
assertCondition(labels["unidesk.ai/service-id"] === contract.serviceId, `${contract.serviceId} ${environment} service label mismatch`, labels);
|
|
assertCondition(labels["unidesk.ai/source-repo"] === contract.sourceRepo, `${contract.serviceId} ${environment} source repo label mismatch`, labels);
|
|
assertCondition(labels["unidesk.ai/source-commit"] === contract.desiredCommit, `${contract.serviceId} ${environment} commit label mismatch`, labels);
|
|
assertCondition(labels["unidesk.ai/dockerfile"] === contract.dockerfile, `${contract.serviceId} ${environment} Dockerfile label mismatch`, labels);
|
|
assertCondition(build.willCompile === false, `${contract.serviceId} ${environment} CD must not compile`, build);
|
|
assertCondition(build.willRunCargoBuild === false, `${contract.serviceId} ${environment} CD must not run cargo build`, build);
|
|
assertCondition(build.willRunDockerBuild === false, `${contract.serviceId} ${environment} CD must not run docker build`, build);
|
|
assertCondition(build.willRunDockerComposeBuild === false, `${contract.serviceId} ${environment} CD must not run docker compose build`, build);
|
|
assertCondition(build.producerBoundary === "ci publish-user-service", `${contract.serviceId} ${environment} producer boundary mismatch`, build);
|
|
assertCondition(String(plan.boundary ?? "").includes("artifact-consumer only"), `${contract.serviceId} ${environment} boundary must be artifact-only`, plan);
|
|
assertCondition(String(plan.boundary ?? "").includes("never builds source"), `${contract.serviceId} ${environment} boundary must forbid source builds`, plan);
|
|
}
|
|
|
|
function assertK3sDryRun(plan: JsonRecord, contract: ServiceContract, environment: Environment): void {
|
|
const target = asRecord(plan.target, `${contract.serviceId} ${environment} target`);
|
|
const validation = strings(plan.validation, `${contract.serviceId} ${environment} validation`);
|
|
const suffix = environment === "dev" ? "-dev" : "";
|
|
assertCondition(target.kind === "d601-k3s", `${contract.serviceId} ${environment} target kind mismatch`, target);
|
|
assertCondition(target.namespace === (environment === "dev" ? "unidesk-dev" : "unidesk"), `${contract.serviceId} ${environment} namespace mismatch`, target);
|
|
assertCondition(target.deployment === `${contract.serviceId}${suffix}`, `${contract.serviceId} ${environment} deployment mismatch`, target);
|
|
assertCondition(target.service === `${contract.serviceId}${suffix}`, `${contract.serviceId} ${environment} service mismatch`, target);
|
|
assertCondition(String(target.deployCommandShape ?? "").includes("kubectl set image"), `${contract.serviceId} ${environment} command must be k3s image update`, target);
|
|
assertCondition(validation.some((line) => line.includes("Kubernetes API service proxy") || line.includes("service health")), `${contract.serviceId} ${environment} validation should include k3s service health`, validation);
|
|
}
|
|
|
|
function assertComposeDryRun(plan: JsonRecord, contract: ServiceContract, environment: Environment): void {
|
|
const target = asRecord(plan.target, `${contract.serviceId} ${environment} target`);
|
|
const validation = strings(plan.validation, `${contract.serviceId} ${environment} validation`);
|
|
assertCondition(target.kind === "compose", `${contract.serviceId} ${environment} target kind mismatch`, target);
|
|
assertCondition(target.runtimeHost === "main-server", `${contract.serviceId} ${environment} runtime host mismatch`, target);
|
|
assertCondition(target.composeService === "todo-note", `${contract.serviceId} ${environment} compose service mismatch`, target);
|
|
assertCondition(target.containerName === "todo-note-backend", `${contract.serviceId} ${environment} container mismatch`, target);
|
|
assertCondition(target.deployCommandShape === "docker compose up -d --no-build --no-deps --force-recreate todo-note", `${contract.serviceId} ${environment} command shape mismatch`, target);
|
|
const runtimeProof = asRecord(plan.runtimeProof, `${contract.serviceId} ${environment} runtimeProof`);
|
|
const requiredEnvKeys = asArray(runtimeProof.requiredEnvKeys, `${contract.serviceId} ${environment} runtime proof env keys`).map(String);
|
|
assertCondition(runtimeProof.kind === "compose-container-runtime-metadata", `${contract.serviceId} ${environment} runtime proof kind mismatch`, runtimeProof);
|
|
assertCondition(runtimeProof.sourceDirectoryUsed === false, `${contract.serviceId} ${environment} runtime proof must not use source directory guesses`, runtimeProof);
|
|
assertCondition(requiredEnvKeys.includes("UNIDESK_DEPLOY_COMMIT"), `${contract.serviceId} ${environment} runtime proof must use generic commit env`, runtimeProof);
|
|
assertCondition(requiredEnvKeys.includes("UNIDESK_TODO_NOTE_DEPLOY_COMMIT"), `${contract.serviceId} ${environment} runtime proof must use service commit env`, runtimeProof);
|
|
assertCondition(validation.some((line) => line.includes("deploy.commit/deploy.requestedCommit") && line.includes("Compose container runtime metadata")), `${contract.serviceId} ${environment} validation must require synthetic health deploy metadata`, validation);
|
|
}
|
|
|
|
async function assertDryRuns(): Promise<void> {
|
|
for (const contract of contracts) {
|
|
for (const environment of ["dev", "prod"] as const) {
|
|
const plan = asRecord(await runArtifactRegistryCommand([
|
|
"deploy-service",
|
|
"--env",
|
|
environment,
|
|
"--service",
|
|
contract.serviceId,
|
|
"--commit",
|
|
contract.desiredCommit,
|
|
"--dry-run",
|
|
]), `${contract.serviceId} ${environment} artifact dry-run`);
|
|
assertCommonDryRun(plan, contract, environment);
|
|
if (contract.consumerKind === "d601-k3s") assertK3sDryRun(plan, contract, environment);
|
|
else assertComposeDryRun(plan, contract, environment);
|
|
}
|
|
}
|
|
}
|
|
|
|
async function main(): Promise<void> {
|
|
assertDeployJson();
|
|
assertCiCatalog();
|
|
assertNormalizedStatus();
|
|
await assertDryRuns();
|
|
|
|
process.stdout.write(`${JSON.stringify({
|
|
ok: true,
|
|
checks: [
|
|
"deploy.json dev/prod desired commits match the issue #9 service matrix",
|
|
"CI.json keeps mdtodo, claudeqq and todo-note on supported ci publish-user-service source-build producers",
|
|
"normalized status records expose desiredCommit, runtimeCommit, artifactExists, devStatus, prodStatus, blockedScopes and recommendedAction",
|
|
"dev/prod artifact-registry dry-runs are non-mutating, commit-pinned and no-build",
|
|
"mdtodo and claudeqq dry-runs target D601 k3s consumers",
|
|
"todo-note dry-runs target the main-server Compose consumer with no-build/no-deps recreate shape",
|
|
],
|
|
services: contracts.map((contract) => ({
|
|
serviceId: contract.serviceId,
|
|
desiredCommit: contract.desiredCommit,
|
|
runtimeCommit: contract.runtimeCommit,
|
|
runtimeCommitSource: contract.runtimeCommitSource,
|
|
artifactExists: contract.artifactExists,
|
|
devStatus: contract.devStatus,
|
|
prodStatus: contract.prodStatus,
|
|
blockedScopes: contract.blockedScopes,
|
|
recommendedAction: contract.recommendedAction,
|
|
})),
|
|
}, null, 2)}\n`);
|
|
}
|
|
|
|
if (import.meta.main) {
|
|
await main();
|
|
}
|