Sync from deal-sage/deal-sage@13a420d134
This commit is contained in:
DealSage template sync
@@ -0,0 +1,77 @@
|
|||||||
|
# ci-actions — the platform-owned custom-app pipeline
|
||||||
|
|
||||||
|
This directory is synced verbatim into the `dealsage-platform/ci-actions` repo on
|
||||||
|
each environment's Gitea by `infra/gitea/gitea-org.sh` (the same way
|
||||||
|
`templates/custom-app` is synced into the template repo), and tagged `v1` plus
|
||||||
|
`v<VERSION>` from the `VERSION` file. App repos call it from a one-step
|
||||||
|
workflow:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
- uses: https://git.dealsage.io/dealsage-platform/ci-actions/pipeline@v1
|
||||||
|
with:
|
||||||
|
publish-token: ${{ secrets.PUBLISH_TOKEN }}
|
||||||
|
```
|
||||||
|
|
||||||
|
Why it exists: an app repo receives its workflow once, when it is generated
|
||||||
|
from the template, and never again. Keeping the pipeline here means a fix ships
|
||||||
|
to every app on its next push, instead of being patched repo by repo.
|
||||||
|
|
||||||
|
## What `pipeline` does
|
||||||
|
|
||||||
|
| Step | Script | Notes |
|
||||||
|
|---|---|---|
|
||||||
|
| Tooling | `scripts/ensure-tools.sh` | curl + jq; AWS CLI only for the S3 upload path |
|
||||||
|
| Manifest | `scripts/manifest.sh` | validates `.dealsage/app.json`, exports `APP_ID`, `CHECKS_JSON` |
|
||||||
|
| Install | (action input) | `npm install --no-audit --no-fund` by default |
|
||||||
|
| Checks | `scripts/run-checks.sh` | runs each declared check, posts every result to `record-app-check`; a failed **required** check stops here |
|
||||||
|
| Build | `scripts/build.sh` | `npm run build` with `VITE_SUPABASE_URL/ANON_KEY` from org variables; recorded as the `build` check |
|
||||||
|
| Publish | `scripts/publish.sh` | allocate → upload → promote request; DealSage applies the app's publish policy |
|
||||||
|
|
||||||
|
The action never decides whether a build goes live. `record-app-version`'s
|
||||||
|
`promote` action does, from the app's `publish_policy` and default branch, and
|
||||||
|
answers `promoted: true|false` plus the channel the version landed on
|
||||||
|
(`live` or `branch/<name>`). Every build of every branch becomes a version, so
|
||||||
|
any of them can be opened by URL and promoted later.
|
||||||
|
|
||||||
|
## The manifest (`.dealsage/app.json`)
|
||||||
|
|
||||||
|
Owned by the app's team; schema in `manifest.schema.json`.
|
||||||
|
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"appId": "…",
|
||||||
|
"checks": [
|
||||||
|
{ "id": "typecheck", "name": "TypeScript", "run": "npm run typecheck" },
|
||||||
|
{ "id": "test", "name": "Unit tests", "run": "npm test -- --run", "required": true },
|
||||||
|
{ "id": "conventions", "uses": "conventions", "required": false }
|
||||||
|
],
|
||||||
|
"dependencies": { "objectTypes": [ { "apiName": "contract_agreement", "schemaVersion": 2 } ] }
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
`required` defaults to true. Platform checks (`uses`) live in `pipeline/checks/`
|
||||||
|
and run inside the same job; `conventions` verifies the repo still has the
|
||||||
|
shape the platform relies on.
|
||||||
|
|
||||||
|
## Environment the caller provides
|
||||||
|
|
||||||
|
From org variables: `DEALSAGE_FUNCTIONS_URL`, `SUPABASE_URL`,
|
||||||
|
`SUPABASE_ANON_KEY`, and either `CUSTOM_APPS_WORKER_URL` (bundles are PUT
|
||||||
|
through the serving Worker with the short-lived upload token from `allocate`,
|
||||||
|
so CI holds no R2 key) or `R2_ACCOUNT_ID` + `R2_BUCKET` with the
|
||||||
|
`R2_ACCESS_KEY_ID` / `R2_SECRET_ACCESS_KEY` secrets (S3 sync, the path prod
|
||||||
|
uses today). `PUBLISH_TOKEN` is the app's own repo secret.
|
||||||
|
|
||||||
|
## Testing locally
|
||||||
|
|
||||||
|
`test/run-local.sh` builds a throwaway app repo and runs the scripts against a
|
||||||
|
stub DealSage (`test/stub_server.py`) for three scenarios: auto policy, a
|
||||||
|
failing required check, and manual policy. Run it after any change here; it
|
||||||
|
needs bash, jq, git, node and python3.
|
||||||
|
|
||||||
|
## Releasing a change
|
||||||
|
|
||||||
|
Bump `VERSION` for anything user-visible. Non-breaking changes keep the `v1`
|
||||||
|
tag moving; a breaking change (new required input, different env contract)
|
||||||
|
gets `v2` and a stub update in the template plus a platform-files refresh for
|
||||||
|
existing apps.
|
||||||
@@ -0,0 +1,65 @@
|
|||||||
|
{
|
||||||
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
||||||
|
"$id": "https://dealsage.io/schemas/custom-app-manifest.json",
|
||||||
|
"title": "DealSage custom app manifest (.dealsage/app.json)",
|
||||||
|
"description": "The per-app contract the platform pipeline reads: which app this repo is, which checks to run before a build is published, and which platform objects the app depends on. The pipeline itself is platform-owned (dealsage-platform/ci-actions); this file is owned by the app's team.",
|
||||||
|
"type": "object",
|
||||||
|
"additionalProperties": false,
|
||||||
|
"required": ["appId"],
|
||||||
|
"properties": {
|
||||||
|
"appId": {
|
||||||
|
"type": "string",
|
||||||
|
"description": "The custom_apps.id this repo belongs to. Stamped by provisioning; never edit.",
|
||||||
|
"pattern": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
|
||||||
|
},
|
||||||
|
"checks": {
|
||||||
|
"type": "array",
|
||||||
|
"description": "Checks the pipeline runs on every push, in order, before building. A failed required check stops the build; results are recorded in DealSage either way.",
|
||||||
|
"items": {
|
||||||
|
"type": "object",
|
||||||
|
"additionalProperties": false,
|
||||||
|
"required": ["id"],
|
||||||
|
"properties": {
|
||||||
|
"id": {
|
||||||
|
"type": "string",
|
||||||
|
"description": "Stable identifier, unique within the app (e.g. typecheck, test, lint).",
|
||||||
|
"pattern": "^[a-z][a-z0-9-]{0,39}$"
|
||||||
|
},
|
||||||
|
"name": { "type": "string", "description": "Label shown in DealSage. Defaults to the id." },
|
||||||
|
"run": { "type": "string", "description": "Shell command executed in the repo root. Exactly one of run or uses." },
|
||||||
|
"uses": {
|
||||||
|
"type": "string",
|
||||||
|
"description": "A platform-provided check to run instead of a command. Known values: conventions (validates this manifest and the repo layout).",
|
||||||
|
"enum": ["conventions"]
|
||||||
|
},
|
||||||
|
"required": {
|
||||||
|
"type": "boolean",
|
||||||
|
"default": true,
|
||||||
|
"description": "When true, a failure stops the build. When false, the result is recorded and the pipeline continues."
|
||||||
|
},
|
||||||
|
"timeoutMinutes": { "type": "integer", "minimum": 1, "maximum": 60, "default": 15 }
|
||||||
|
},
|
||||||
|
"oneOf": [{ "required": ["run"] }, { "required": ["uses"] }]
|
||||||
|
}
|
||||||
|
},
|
||||||
|
"dependencies": {
|
||||||
|
"type": "object",
|
||||||
|
"description": "Platform objects the app is built against. Recorded with every version so DealSage can flag drift when a dependency changes.",
|
||||||
|
"additionalProperties": false,
|
||||||
|
"properties": {
|
||||||
|
"objectTypes": {
|
||||||
|
"type": "array",
|
||||||
|
"items": {
|
||||||
|
"type": "object",
|
||||||
|
"additionalProperties": false,
|
||||||
|
"required": ["apiName"],
|
||||||
|
"properties": {
|
||||||
|
"apiName": { "type": "string" },
|
||||||
|
"schemaVersion": { "type": "integer", "minimum": 1, "description": "The schema version the app was written against." }
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -0,0 +1,80 @@
|
|||||||
|
name: DealSage custom app pipeline
|
||||||
|
description: >-
|
||||||
|
Runs the checks declared in .dealsage/app.json, builds the app with the
|
||||||
|
DealSage connection baked in, uploads the bundle, and asks DealSage to
|
||||||
|
release it under the app's publish policy. Platform-owned: app repos call
|
||||||
|
this action from a one-step workflow, so pipeline changes ship here, not in
|
||||||
|
every repo.
|
||||||
|
author: DealSage
|
||||||
|
|
||||||
|
inputs:
|
||||||
|
publish-token:
|
||||||
|
description: The app's PUBLISH_TOKEN repo secret (appId-scoped, minted by DealSage).
|
||||||
|
required: true
|
||||||
|
node-version:
|
||||||
|
description: Node.js version for install, checks and build.
|
||||||
|
required: false
|
||||||
|
default: "20"
|
||||||
|
install-command:
|
||||||
|
description: Dependency install command run in the repo root.
|
||||||
|
required: false
|
||||||
|
default: npm install --no-audit --no-fund
|
||||||
|
skip-publish:
|
||||||
|
description: Run checks and build only; do not allocate or upload a version.
|
||||||
|
required: false
|
||||||
|
default: "false"
|
||||||
|
|
||||||
|
outputs:
|
||||||
|
version:
|
||||||
|
description: The version number allocated for this build (empty when skip-publish).
|
||||||
|
value: ${{ steps.publish.outputs.version }}
|
||||||
|
promoted:
|
||||||
|
description: "true when DealSage promoted this version to live under the app's policy."
|
||||||
|
value: ${{ steps.publish.outputs.promoted }}
|
||||||
|
channel:
|
||||||
|
description: The channel the version landed on (live, or branch/<name>).
|
||||||
|
value: ${{ steps.publish.outputs.channel }}
|
||||||
|
|
||||||
|
# Environment the caller provides (from org variables/secrets, see the template
|
||||||
|
# workflow): DEALSAGE_FUNCTIONS_URL, SUPABASE_URL, SUPABASE_ANON_KEY, and either
|
||||||
|
# CUSTOM_APPS_WORKER_URL (upload through the Worker) or R2_ACCOUNT_ID,
|
||||||
|
# R2_BUCKET, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY (S3 upload).
|
||||||
|
runs:
|
||||||
|
using: composite
|
||||||
|
steps:
|
||||||
|
- name: Tooling
|
||||||
|
shell: bash
|
||||||
|
run: bash "${{ github.action_path }}/scripts/ensure-tools.sh"
|
||||||
|
|
||||||
|
- name: Read the app manifest
|
||||||
|
shell: bash
|
||||||
|
run: bash "${{ github.action_path }}/scripts/manifest.sh"
|
||||||
|
|
||||||
|
- name: Set up Node.js
|
||||||
|
uses: actions/setup-node@v4
|
||||||
|
with:
|
||||||
|
node-version: ${{ inputs.node-version }}
|
||||||
|
|
||||||
|
- name: Install dependencies
|
||||||
|
shell: bash
|
||||||
|
run: ${{ inputs.install-command }}
|
||||||
|
|
||||||
|
- name: Checks
|
||||||
|
shell: bash
|
||||||
|
env:
|
||||||
|
PUBLISH_TOKEN: ${{ inputs.publish-token }}
|
||||||
|
run: bash "${{ github.action_path }}/scripts/run-checks.sh"
|
||||||
|
|
||||||
|
- name: Build
|
||||||
|
shell: bash
|
||||||
|
env:
|
||||||
|
PUBLISH_TOKEN: ${{ inputs.publish-token }}
|
||||||
|
run: bash "${{ github.action_path }}/scripts/build.sh"
|
||||||
|
|
||||||
|
- name: Publish
|
||||||
|
id: publish
|
||||||
|
if: inputs.skip-publish != 'true'
|
||||||
|
shell: bash
|
||||||
|
env:
|
||||||
|
PUBLISH_TOKEN: ${{ inputs.publish-token }}
|
||||||
|
run: bash "${{ github.action_path }}/scripts/publish.sh"
|
||||||
Executable
+54
@@ -0,0 +1,54 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Platform check "conventions": the repo still has the shape the platform relies
|
||||||
|
# on. Hard failures exit 1 (the check fails); soft findings print a warning and
|
||||||
|
# pass. Runs from the repo root. Kept dependency-free (bash + jq).
|
||||||
|
set -uo pipefail
|
||||||
|
fail=0
|
||||||
|
problem() { printf 'FAIL %s\n' "$*"; fail=1; }
|
||||||
|
note() { printf 'warn %s\n' "$*"; }
|
||||||
|
ok() { printf 'ok %s\n' "$*"; }
|
||||||
|
|
||||||
|
# 1. Manifest present and shaped (manifest.sh already validated the checks list).
|
||||||
|
if [ -f .dealsage/app.json ] && jq -e '.appId | test("^[0-9a-f-]{36}$")' .dealsage/app.json >/dev/null 2>&1; then
|
||||||
|
ok ".dealsage/app.json has an appId"
|
||||||
|
else
|
||||||
|
problem ".dealsage/app.json is missing or has no appId"
|
||||||
|
fi
|
||||||
|
if jq -e 'keys - ["appId","checks","dependencies"] | length == 0' .dealsage/app.json >/dev/null 2>&1; then
|
||||||
|
ok "manifest has only known keys"
|
||||||
|
else
|
||||||
|
problem "manifest has unknown top-level keys: $(jq -c 'keys - ["appId","checks","dependencies"]' .dealsage/app.json 2>/dev/null)"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 2. The workflow is the platform stub, so pipeline changes reach this repo.
|
||||||
|
wf=.gitea/workflows/publish.yml
|
||||||
|
if [ -f "$wf" ]; then
|
||||||
|
if grep -qE 'ci-actions/pipeline@' "$wf"; then
|
||||||
|
ok "workflow delegates to the platform pipeline"
|
||||||
|
else
|
||||||
|
note "workflow does not call ci-actions/pipeline; this repo will not receive pipeline updates"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
problem "$wf is missing"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 3. Build contract.
|
||||||
|
if jq -e '.scripts.build' package.json >/dev/null 2>&1; then ok "package.json has a build script"; else problem "package.json has no build script"; fi
|
||||||
|
|
||||||
|
# 4. Platform files the shell and the builder depend on.
|
||||||
|
for f in src/lib/dealsage.ts src/Root.tsx src/main.tsx; do
|
||||||
|
[ -f "$f" ] && ok "$f present" || problem "$f is missing (platform-owned file)"
|
||||||
|
done
|
||||||
|
|
||||||
|
# 5. Guidance for agents. Soft: older apps predate it.
|
||||||
|
[ -f AGENTS.md ] && ok "AGENTS.md present" || note "AGENTS.md missing; coding agents get no project guidance"
|
||||||
|
if [ -f AGENTS.md ] && ! grep -q 'dealsage:generated:start' AGENTS.md; then
|
||||||
|
note "AGENTS.md has no generated block markers; the builder will not preserve hand-written sections"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# 6. Nothing secret committed.
|
||||||
|
for f in .env .env.local .env.production; do
|
||||||
|
[ -f "$f" ] && problem "$f is committed; the pipeline bakes the Supabase connection from org variables instead"
|
||||||
|
done
|
||||||
|
|
||||||
|
exit $fail
|
||||||
Executable
+36
@@ -0,0 +1,36 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Build the app with the DealSage connection baked in from org variables, and
|
||||||
|
# record the build as a check so DealSage shows it beside the declared ones.
|
||||||
|
set -euo pipefail
|
||||||
|
. "$(dirname "$0")/lib.sh"
|
||||||
|
require_env APP_ID DEALSAGE_FUNCTIONS_URL PUBLISH_TOKEN SUPABASE_ANON_KEY SUPABASE_URL
|
||||||
|
git_context
|
||||||
|
|
||||||
|
logf="$(mktemp)"; started="$(iso_now)"; t0="$(now_ms)"
|
||||||
|
echo "::group::build"
|
||||||
|
set +e
|
||||||
|
VITE_SUPABASE_URL="$SUPABASE_URL" VITE_SUPABASE_ANON_KEY="$SUPABASE_ANON_KEY" \
|
||||||
|
npm run build 2>&1 | tee "$logf"
|
||||||
|
rc=${PIPESTATUS[0]}
|
||||||
|
set -e
|
||||||
|
echo "::endgroup::"
|
||||||
|
dur=$(( $(now_ms) - t0 ))
|
||||||
|
if [ "$rc" = 0 ] && [ ! -f dist/index.html ]; then
|
||||||
|
echo "build succeeded but dist/index.html is missing" | tee -a "$logf"; rc=2
|
||||||
|
fi
|
||||||
|
status=passed; summary="built in $(( dur / 1000 ))s"
|
||||||
|
[ "$rc" = 0 ] || { status=failed; summary="exit code $rc"; }
|
||||||
|
|
||||||
|
payload="$(jq -n \
|
||||||
|
--arg appId "$APP_ID" --arg sha "$COMMIT_SHA" --arg branch "$BRANCH" \
|
||||||
|
--arg status "$status" --argjson duration "$dur" --arg summary "$summary" --rawfile log "$logf" \
|
||||||
|
--arg started "$started" --arg finished "$(iso_now)" \
|
||||||
|
'{appId:$appId, commitSha:$sha, branch:$branch, checkId:"build", name:"Build", status:$status,
|
||||||
|
required:true, durationMs:$duration, summary:$summary,
|
||||||
|
logTail:($log | split("\n") | .[-80:] | join("\n")), reportedBy:"ci",
|
||||||
|
startedAt:$started, finishedAt:$finished}')"
|
||||||
|
ds_post record-app-check "$payload" >/dev/null || warn "could not record the build check in DealSage"
|
||||||
|
rm -f "$logf"
|
||||||
|
summary "- build: **$status** (${dur}ms)"
|
||||||
|
[ "$rc" = 0 ] || die "Build failed ($summary); nothing was published."
|
||||||
|
log "Build ok: $(find dist -type f | wc -l) files"
|
||||||
Executable
+23
@@ -0,0 +1,23 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Make sure the runner has what the pipeline shells out to: curl and jq always,
|
||||||
|
# the AWS CLI only when bundles go to R2 through the S3 API (no
|
||||||
|
# CUSTOM_APPS_WORKER_URL). Installs are apt-based, matching the runner image.
|
||||||
|
set -euo pipefail
|
||||||
|
. "$(dirname "$0")/lib.sh"
|
||||||
|
|
||||||
|
need_apt=()
|
||||||
|
command -v curl >/dev/null || need_apt+=(curl)
|
||||||
|
command -v jq >/dev/null || need_apt+=(jq)
|
||||||
|
if [ "${#need_apt[@]}" -gt 0 ]; then
|
||||||
|
log "Installing ${need_apt[*]}"
|
||||||
|
apt-get update -qq && apt-get install -y -qq --no-install-recommends "${need_apt[@]}" >/dev/null
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -z "${CUSTOM_APPS_WORKER_URL:-}" ] && ! command -v aws >/dev/null; then
|
||||||
|
log "Installing the AWS CLI (bundle upload goes to R2 over S3)"
|
||||||
|
command -v unzip >/dev/null || { apt-get update -qq && apt-get install -y -qq --no-install-recommends unzip >/dev/null; }
|
||||||
|
curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o /tmp/awscliv2.zip
|
||||||
|
unzip -q -o /tmp/awscliv2.zip -d /tmp
|
||||||
|
/tmp/aws/install >/dev/null
|
||||||
|
fi
|
||||||
|
echo "tools ready: curl $(curl --version | head -n1 | cut -d' ' -f2), jq $(jq --version)$( command -v aws >/dev/null && echo ", aws $(aws --version 2>&1 | cut -d' ' -f1)")"
|
||||||
Executable
+88
@@ -0,0 +1,88 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Shared helpers for the DealSage custom-app pipeline scripts. Sourced, not run.
|
||||||
|
#
|
||||||
|
# Conventions:
|
||||||
|
# * Every script is `set -euo pipefail` and sources this file first.
|
||||||
|
# * DealSage is reached only through DEALSAGE_FUNCTIONS_URL with the app's
|
||||||
|
# PUBLISH_TOKEN (appId-scoped, minted by DealSage). Nothing here holds a
|
||||||
|
# Supabase service key or an R2 account key.
|
||||||
|
# * Output meant for the job log goes through log(); machine-readable state
|
||||||
|
# is exchanged through $GITHUB_ENV / $GITHUB_OUTPUT like any other action.
|
||||||
|
|
||||||
|
log() { printf '::group::%s\n' "$*" >/dev/null; printf '\n== %s\n' "$*"; }
|
||||||
|
warn() { printf '::warning::%s\n' "$*"; }
|
||||||
|
die() { printf '::error::%s\n' "$*"; exit 1; }
|
||||||
|
|
||||||
|
# now_ms — wall clock in milliseconds (GNU date; falls back to seconds*1000).
|
||||||
|
now_ms() { date +%s%3N 2>/dev/null || echo $(( $(date +%s) * 1000 )); }
|
||||||
|
|
||||||
|
# iso_now — UTC timestamp for API payloads.
|
||||||
|
iso_now() { date -u +%Y-%m-%dT%H:%M:%SZ; }
|
||||||
|
|
||||||
|
# require_env NAME... — fail loudly when a required variable is missing.
|
||||||
|
require_env() {
|
||||||
|
local missing=0 v
|
||||||
|
for v in "$@"; do
|
||||||
|
if [ -z "${!v:-}" ]; then printf '::error::%s is not set\n' "$v"; missing=1; fi
|
||||||
|
done
|
||||||
|
[ "$missing" = 0 ] || exit 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# json_escape STRING — JSON string literal (with quotes) via jq.
|
||||||
|
json_escape() { jq -Rn --arg s "$1" '$s'; }
|
||||||
|
|
||||||
|
# tail_file FILE [LINES] — last LINES lines of FILE (default 80), for log tails.
|
||||||
|
tail_file() { tail -n "${2:-80}" "$1" 2>/dev/null || true; }
|
||||||
|
|
||||||
|
# ds_post PATH JSON — POST JSON to a DealSage function with the publish token.
|
||||||
|
# Prints the response body; returns non-zero on HTTP failure (body still printed
|
||||||
|
# to stderr so the job log shows why).
|
||||||
|
ds_post() {
|
||||||
|
local path="$1" body="$2" out code
|
||||||
|
out="$(mktemp)"
|
||||||
|
code="$(curl -sS -o "$out" -w '%{http_code}' -X POST \
|
||||||
|
"${DEALSAGE_FUNCTIONS_URL%/}/${path}" \
|
||||||
|
-H "Authorization: Bearer ${PUBLISH_TOKEN}" \
|
||||||
|
-H "apikey: ${SUPABASE_ANON_KEY}" \
|
||||||
|
-H "content-type: application/json" \
|
||||||
|
--data-binary "$body")" || { cat "$out" >&2; rm -f "$out"; return 1; }
|
||||||
|
if [ "${code:0:1}" != "2" ]; then
|
||||||
|
printf 'DealSage %s returned HTTP %s: ' "$path" "$code" >&2; cat "$out" >&2; echo >&2
|
||||||
|
rm -f "$out"; return 1
|
||||||
|
fi
|
||||||
|
cat "$out"; rm -f "$out"
|
||||||
|
}
|
||||||
|
|
||||||
|
# git_context — export the commit/branch/author the pipeline is publishing.
|
||||||
|
# Gitea Actions provides the GITHUB_* variables; the event payload carries the
|
||||||
|
# head commit. Falls back to git itself (the checkout has the commit).
|
||||||
|
git_context() {
|
||||||
|
local ev="${GITHUB_EVENT_PATH:-}"
|
||||||
|
COMMIT_SHA="${GITHUB_SHA:-$(git rev-parse HEAD 2>/dev/null || echo unknown)}"
|
||||||
|
BRANCH="${GITHUB_REF_NAME:-}"
|
||||||
|
if [ -z "$BRANCH" ]; then
|
||||||
|
BRANCH="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo unknown)"
|
||||||
|
fi
|
||||||
|
COMMIT_MESSAGE=""; COMMIT_AUTHOR=""
|
||||||
|
if [ -n "$ev" ] && [ -f "$ev" ]; then
|
||||||
|
COMMIT_MESSAGE="$(jq -r '.head_commit.message // .commits[-1].message // empty' "$ev" 2>/dev/null || true)"
|
||||||
|
COMMIT_AUTHOR="$(jq -r '.head_commit.author.name // .pusher.login // .pusher.username // empty' "$ev" 2>/dev/null || true)"
|
||||||
|
fi
|
||||||
|
[ -n "$COMMIT_MESSAGE" ] || COMMIT_MESSAGE="$(git log -1 --pretty=%B 2>/dev/null | head -c 2000 || true)"
|
||||||
|
[ -n "$COMMIT_AUTHOR" ] || COMMIT_AUTHOR="$(git log -1 --pretty=%an 2>/dev/null || echo "${GITHUB_ACTOR:-}")"
|
||||||
|
# First line only for the summary field; the full message travels separately.
|
||||||
|
COMMIT_SUBJECT="$(printf '%s' "$COMMIT_MESSAGE" | head -n 1 | head -c 200)"
|
||||||
|
export COMMIT_SHA BRANCH COMMIT_MESSAGE COMMIT_AUTHOR COMMIT_SUBJECT
|
||||||
|
}
|
||||||
|
|
||||||
|
# persist_env NAME VALUE — make a value visible to later composite steps.
|
||||||
|
persist_env() {
|
||||||
|
if [ -n "${GITHUB_ENV:-}" ]; then
|
||||||
|
# Heredoc form handles multi-line values safely.
|
||||||
|
{ printf '%s<<__DS_EOF__\n' "$1"; printf '%s\n' "$2"; printf '__DS_EOF__\n'; } >> "$GITHUB_ENV"
|
||||||
|
fi
|
||||||
|
export "$1=$2"
|
||||||
|
}
|
||||||
|
|
||||||
|
# summary MARKDOWN — append to the run's step summary when the runner supports it.
|
||||||
|
summary() { [ -n "${GITHUB_STEP_SUMMARY:-}" ] && printf '%s\n' "$*" >> "$GITHUB_STEP_SUMMARY" || true; }
|
||||||
Executable
+49
@@ -0,0 +1,49 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Read and validate .dealsage/app.json, then export what later steps need:
|
||||||
|
# APP_ID the custom app this repo publishes
|
||||||
|
# MANIFEST_JSON the whole manifest, compacted (recorded with the version)
|
||||||
|
# CHECKS_JSON the checks array with defaults applied
|
||||||
|
# Validation is deliberately jq-only (no npm dependency) so a broken manifest
|
||||||
|
# fails fast, before install. The schema of record is ../manifest.schema.json.
|
||||||
|
set -euo pipefail
|
||||||
|
. "$(dirname "$0")/lib.sh"
|
||||||
|
|
||||||
|
MANIFEST_PATH="${MANIFEST_PATH:-.dealsage/app.json}"
|
||||||
|
[ -f "$MANIFEST_PATH" ] || die "Manifest not found at $MANIFEST_PATH"
|
||||||
|
jq -e . "$MANIFEST_PATH" >/dev/null 2>&1 || die "$MANIFEST_PATH is not valid JSON"
|
||||||
|
|
||||||
|
app_id="$(jq -r '.appId // empty' "$MANIFEST_PATH")"
|
||||||
|
[[ "$app_id" =~ ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$ ]] \
|
||||||
|
|| die "$MANIFEST_PATH: appId is missing or not a UUID (got '${app_id:-<empty>}'). Provisioning stamps it; do not edit by hand."
|
||||||
|
|
||||||
|
# Normalise checks: fill defaults, reject malformed entries with a clear message.
|
||||||
|
checks="$(jq -c '
|
||||||
|
def bad(msg): error("checks: " + msg);
|
||||||
|
(.checks // [])
|
||||||
|
| if type != "array" then bad("must be an array") else . end
|
||||||
|
| map(
|
||||||
|
if type != "object" then bad("each check must be an object") else . end
|
||||||
|
| if (.id|type) != "string" or ((.id|test("^[a-z][a-z0-9-]{0,39}$"))|not)
|
||||||
|
then bad("id must match ^[a-z][a-z0-9-]{0,39}$ (got " + (.id|tostring) + ")") else . end
|
||||||
|
| if ((.run|type) == "string") == ((.uses|type) == "string")
|
||||||
|
then bad("check " + .id + " needs exactly one of run or uses") else . end
|
||||||
|
| if (.uses? // "") != "" and ((.uses|IN("conventions"))|not)
|
||||||
|
then bad("check " + .id + " uses an unknown platform check " + .uses) else . end
|
||||||
|
| {
|
||||||
|
id: .id,
|
||||||
|
name: (.name // .id),
|
||||||
|
run: (.run // null),
|
||||||
|
uses: (.uses // null),
|
||||||
|
required: (if .required == null then true else .required end),
|
||||||
|
timeoutMinutes: (.timeoutMinutes // 15)
|
||||||
|
}
|
||||||
|
)
|
||||||
|
| if (map(.id) | unique | length) != length then bad("ids must be unique") else . end
|
||||||
|
' "$MANIFEST_PATH")" || exit 1
|
||||||
|
|
||||||
|
manifest="$(jq -c . "$MANIFEST_PATH")"
|
||||||
|
persist_env APP_ID "$app_id"
|
||||||
|
persist_env MANIFEST_JSON "$manifest"
|
||||||
|
persist_env CHECKS_JSON "$checks"
|
||||||
|
log "Manifest: app $app_id, $(jq 'length' <<<"$checks") check(s)"
|
||||||
|
jq -r '.[] | " - \(.id) (\(if .required then "required" else "advisory" end)): \(.run // ("platform:" + .uses))"' <<<"$checks"
|
||||||
Executable
+84
@@ -0,0 +1,84 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Publish dist/ as a new version of the app:
|
||||||
|
# 1. allocate — DealSage assigns version N for this commit/branch and returns
|
||||||
|
# where the bytes go plus a short-lived upload token.
|
||||||
|
# 2. upload — through the serving Worker when CUSTOM_APPS_WORKER_URL is set
|
||||||
|
# (no R2 key on CI), else `aws s3 sync` with the org's R2 keys.
|
||||||
|
# 3. promote — ask DealSage to release it. DealSage decides: a default-branch
|
||||||
|
# build under an "auto" policy goes live; anything else is kept
|
||||||
|
# as a built version on its branch channel for preview and a
|
||||||
|
# later, deliberate promotion. CI never knows the policy.
|
||||||
|
# The live pointer only ever moves after the bytes are in place.
|
||||||
|
set -euo pipefail
|
||||||
|
. "$(dirname "$0")/lib.sh"
|
||||||
|
require_env APP_ID DEALSAGE_FUNCTIONS_URL PUBLISH_TOKEN SUPABASE_ANON_KEY
|
||||||
|
git_context
|
||||||
|
[ -f dist/index.html ] || die "dist/index.html not found; run the build first"
|
||||||
|
|
||||||
|
# --- 1. allocate ------------------------------------------------------------
|
||||||
|
manifest_json="${MANIFEST_JSON:-{\}}"
|
||||||
|
checks_json="${CHECKS_RESULT_JSON:-[]}"
|
||||||
|
alloc_body="$(jq -n \
|
||||||
|
--arg appId "$APP_ID" --arg sha "$COMMIT_SHA" --arg branch "$BRANCH" \
|
||||||
|
--arg msg "$COMMIT_MESSAGE" --arg author "$COMMIT_AUTHOR" \
|
||||||
|
--argjson manifest "$manifest_json" --argjson checks "$checks_json" \
|
||||||
|
'{appId:$appId, action:"allocate", builtBy:"ci", commitSha:$sha, branch:$branch,
|
||||||
|
commitMessage:$msg, author:$author, manifest:$manifest, checks:$checks}')"
|
||||||
|
alloc="$(ds_post record-app-version "$alloc_body")" || die "allocate failed"
|
||||||
|
VERSION="$(jq -r '.version // empty' <<<"$alloc")"
|
||||||
|
PREFIX="$(jq -r '.r2Prefix // empty' <<<"$alloc")"
|
||||||
|
UPLOAD_TOKEN="$(jq -r '.uploadToken // empty' <<<"$alloc")"
|
||||||
|
[ -n "$VERSION" ] && [ -n "$PREFIX" ] || die "allocate returned no version/prefix: $alloc"
|
||||||
|
log "Allocated v$VERSION for $BRANCH@${COMMIT_SHA:0:7} -> $PREFIX"
|
||||||
|
|
||||||
|
mark_failed() {
|
||||||
|
ds_post record-app-version "$(jq -n --arg appId "$APP_ID" --argjson v "$VERSION" --arg reason "$1" \
|
||||||
|
'{appId:$appId, action:"fail", version:$v, reason:$reason}')" >/dev/null 2>&1 || true
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- 2. upload --------------------------------------------------------------
|
||||||
|
if [ -n "${CUSTOM_APPS_WORKER_URL:-}" ]; then
|
||||||
|
[ -n "$UPLOAD_TOKEN" ] || { mark_failed "no upload token"; die "allocate returned no uploadToken but CUSTOM_APPS_WORKER_URL is set"; }
|
||||||
|
log "Uploading through the Worker"
|
||||||
|
export WORKER="${CUSTOM_APPS_WORKER_URL%/}" UPLOAD_TOKEN APP_ID VERSION
|
||||||
|
upload_one() { # relative path under dist/
|
||||||
|
local rel="$1" code
|
||||||
|
code="$(curl -sS -o /dev/null -w '%{http_code}' -X PUT \
|
||||||
|
"$WORKER/__upload/$APP_ID/$VERSION/$rel" \
|
||||||
|
-H "Authorization: Bearer $UPLOAD_TOKEN" --data-binary "@dist/$rel")" || code=000
|
||||||
|
case "$code" in 2*) ;; *) echo "upload failed ($code): $rel" >&2; return 1 ;; esac
|
||||||
|
}
|
||||||
|
export -f upload_one
|
||||||
|
if ! (cd dist && find . -type f | sed 's|^\./||') | xargs -P 6 -n 1 bash -c 'upload_one "$0"'; then
|
||||||
|
mark_failed "upload failed"; die "Upload failed; v$VERSION marked failed and was not promoted."
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
require_env R2_ACCOUNT_ID R2_BUCKET R2_ACCESS_KEY_ID R2_SECRET_ACCESS_KEY
|
||||||
|
log "Uploading with the AWS CLI to s3://$R2_BUCKET/${PREFIX%/}"
|
||||||
|
if ! AWS_ACCESS_KEY_ID="$R2_ACCESS_KEY_ID" AWS_SECRET_ACCESS_KEY="$R2_SECRET_ACCESS_KEY" \
|
||||||
|
AWS_DEFAULT_REGION=auto AWS_REQUEST_CHECKSUM_CALCULATION=when_required \
|
||||||
|
AWS_RESPONSE_CHECKSUM_VALIDATION=when_required \
|
||||||
|
aws s3 sync dist "s3://$R2_BUCKET/${PREFIX%/}" \
|
||||||
|
--endpoint-url "https://$R2_ACCOUNT_ID.r2.cloudflarestorage.com" --delete; then
|
||||||
|
mark_failed "upload failed"; die "Upload failed; v$VERSION marked failed and was not promoted."
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
log "Uploaded $(find dist -type f | wc -l) files"
|
||||||
|
|
||||||
|
# --- 3. promote (DealSage applies the app's publish policy) ------------------
|
||||||
|
promote="$(ds_post record-app-version "$(jq -n --arg appId "$APP_ID" --argjson v "$VERSION" \
|
||||||
|
'{appId:$appId, action:"promote", version:$v}')")" || die "promote request failed"
|
||||||
|
promoted="$(jq -r '.promoted // false' <<<"$promote")"
|
||||||
|
channel="$(jq -r '.channel // empty' <<<"$promote")"
|
||||||
|
current="$(jq -r '.currentVersion // empty' <<<"$promote")"
|
||||||
|
if [ "$promoted" = true ]; then
|
||||||
|
log "v$VERSION is live"
|
||||||
|
else
|
||||||
|
live_note="nothing is live yet"; [ -n "$current" ] && live_note="live stays at v$current"
|
||||||
|
log "v$VERSION built and kept on channel '${channel:-branch/$BRANCH}' ($live_note); promote it from DealSage when ready"
|
||||||
|
fi
|
||||||
|
{
|
||||||
|
echo "version=$VERSION"; echo "promoted=$promoted"; echo "channel=${channel}"
|
||||||
|
} >> "${GITHUB_OUTPUT:-/dev/null}"
|
||||||
|
summary "### Published"
|
||||||
|
summary "- **v$VERSION** from \`$BRANCH\` @ \`${COMMIT_SHA:0:7}\` — $( [ "$promoted" = true ] && echo "live" || echo "built, channel \`${channel:-branch/$BRANCH}\`" )"
|
||||||
Executable
+73
@@ -0,0 +1,73 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Run the checks declared in the manifest, record each result in DealSage, and
|
||||||
|
# stop the pipeline if a required check failed. Advisory checks never block.
|
||||||
|
#
|
||||||
|
# Every result is posted to record-app-check with the commit and branch, so
|
||||||
|
# DealSage can show checks per commit before a version exists and attach them
|
||||||
|
# to the version once it is allocated. A DealSage outage is a warning here, not
|
||||||
|
# a failure: the build should not be blocked by the dashboard being down.
|
||||||
|
set -euo pipefail
|
||||||
|
. "$(dirname "$0")/lib.sh"
|
||||||
|
require_env APP_ID CHECKS_JSON DEALSAGE_FUNCTIONS_URL PUBLISH_TOKEN SUPABASE_ANON_KEY
|
||||||
|
git_context
|
||||||
|
CHECKS_DIR="$(cd "$(dirname "$0")/../checks" && pwd)"
|
||||||
|
|
||||||
|
post_check() { # id name status required duration_ms summary logfile started finished
|
||||||
|
local payload
|
||||||
|
payload="$(jq -n \
|
||||||
|
--arg appId "$APP_ID" --arg sha "$COMMIT_SHA" --arg branch "$BRANCH" \
|
||||||
|
--arg id "$1" --arg name "$2" --arg status "$3" --argjson required "$4" \
|
||||||
|
--argjson duration "$5" --arg summary "$6" --rawfile log "$7" \
|
||||||
|
--arg started "$8" --arg finished "$9" \
|
||||||
|
'{appId:$appId, commitSha:$sha, branch:$branch, checkId:$id, name:$name, status:$status,
|
||||||
|
required:$required, durationMs:$duration, summary:$summary,
|
||||||
|
logTail:($log | split("\n") | .[-80:] | join("\n")), reportedBy:"ci",
|
||||||
|
startedAt:$started, finishedAt:$finished}')"
|
||||||
|
ds_post record-app-check "$payload" >/dev/null || warn "could not record check $1 in DealSage"
|
||||||
|
}
|
||||||
|
|
||||||
|
results='[]'
|
||||||
|
required_failed=()
|
||||||
|
count="$(jq 'length' <<<"$CHECKS_JSON")"
|
||||||
|
if [ "$count" = 0 ]; then
|
||||||
|
log "No checks declared in .dealsage/app.json"
|
||||||
|
persist_env CHECKS_RESULT_JSON '[]'
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
while IFS= read -r check; do
|
||||||
|
id="$(jq -r .id <<<"$check")"; name="$(jq -r .name <<<"$check")"
|
||||||
|
run="$(jq -r '.run // empty' <<<"$check")"; uses="$(jq -r '.uses // empty' <<<"$check")"
|
||||||
|
required="$(jq -r .required <<<"$check")"; timeout_min="$(jq -r .timeoutMinutes <<<"$check")"
|
||||||
|
logf="$(mktemp)"; started="$(iso_now)"; t0="$(now_ms)"
|
||||||
|
echo "::group::check: $name ($id)"
|
||||||
|
if [ -n "$uses" ]; then
|
||||||
|
printf '$ platform check %s\n' "$uses" | tee "$logf"
|
||||||
|
set +e; timeout "${timeout_min}m" bash "$CHECKS_DIR/$uses.sh" 2>&1 | tee -a "$logf"; rc=${PIPESTATUS[0]}; set -e
|
||||||
|
else
|
||||||
|
printf '$ %s\n' "$run" | tee "$logf"
|
||||||
|
set +e; timeout "${timeout_min}m" bash -o pipefail -c "$run" 2>&1 | tee -a "$logf"; rc=${PIPESTATUS[0]}; set -e
|
||||||
|
fi
|
||||||
|
echo "::endgroup::"
|
||||||
|
dur=$(( $(now_ms) - t0 ))
|
||||||
|
case "$rc" in
|
||||||
|
0) status=passed; summary="passed in $(( dur / 1000 ))s" ;;
|
||||||
|
124) status=error; summary="timed out after ${timeout_min} minutes" ;;
|
||||||
|
*) status=failed; summary="exit code $rc" ;;
|
||||||
|
esac
|
||||||
|
printf '%s: %s (%s)\n' "$name" "$status" "$summary"
|
||||||
|
post_check "$id" "$name" "$status" "$required" "$dur" "$summary" "$logf" "$started" "$(iso_now)"
|
||||||
|
results="$(jq -c --arg id "$id" --arg status "$status" --argjson d "$dur" --argjson req "$required" \
|
||||||
|
'. + [{id:$id, status:$status, durationMs:$d, required:$req}]' <<<"$results")"
|
||||||
|
if [ "$status" != passed ] && [ "$required" = true ]; then required_failed+=("$name"); fi
|
||||||
|
rm -f "$logf"
|
||||||
|
done < <(jq -c '.[]' <<<"$CHECKS_JSON")
|
||||||
|
|
||||||
|
persist_env CHECKS_RESULT_JSON "$results"
|
||||||
|
summary "### Checks"
|
||||||
|
summary "$(jq -r '.[] | "- \(.id): **\(.status)** (\(.durationMs)ms\(if .required then "" else ", advisory" end))"' <<<"$results")"
|
||||||
|
|
||||||
|
if [ "${#required_failed[@]}" -gt 0 ]; then
|
||||||
|
die "Required check(s) failed: ${required_failed[*]}. The build was not published."
|
||||||
|
fi
|
||||||
|
log "All required checks passed"
|
||||||
Executable
+105
@@ -0,0 +1,105 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
# Exercise the pipeline scripts end to end against a stub DealSage, without
|
||||||
|
# Gitea. Builds a throwaway app repo, then runs three scenarios:
|
||||||
|
# 1. auto policy: checks pass (one advisory fails), build, upload, promote → live
|
||||||
|
# 2. a required check fails: nothing is allocated
|
||||||
|
# 3. manual policy: built and kept on the branch channel, not promoted
|
||||||
|
# Usage: templates/ci-actions/test/run-local.sh
|
||||||
|
set -euo pipefail
|
||||||
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
||||||
|
SCRIPTS="$HERE/../pipeline/scripts"
|
||||||
|
PORT="${PORT:-8765}"
|
||||||
|
WORK="$(mktemp -d)"
|
||||||
|
trap 'kill ${STUB_PID:-} 2>/dev/null || true; rm -rf "$WORK"' EXIT
|
||||||
|
pass=0; fail=0
|
||||||
|
check() { if eval "$2"; then echo " ok $1"; pass=$((pass+1)); else echo " FAIL $1"; fail=$((fail+1)); fi; }
|
||||||
|
|
||||||
|
make_app() { # dir required_check_cmd
|
||||||
|
local d="$1" reqcmd="$2"
|
||||||
|
mkdir -p "$d/.dealsage" "$d/.gitea/workflows" "$d/src/lib"
|
||||||
|
cat > "$d/package.json" <<JSON
|
||||||
|
{ "name": "fixture-app", "private": true, "scripts": {
|
||||||
|
"build": "mkdir -p dist/assets && echo '<html>ok</html>' > dist/index.html && echo 'console.log(1)' > dist/assets/app.js",
|
||||||
|
"typecheck": "$reqcmd" } }
|
||||||
|
JSON
|
||||||
|
cat > "$d/.dealsage/app.json" <<JSON
|
||||||
|
{ "appId": "11111111-2222-4333-8444-555555555555",
|
||||||
|
"checks": [
|
||||||
|
{ "id": "typecheck", "name": "TypeScript", "run": "npm run --silent typecheck" },
|
||||||
|
{ "id": "lint", "name": "Lint", "run": "echo 'lint problem' && exit 3", "required": false },
|
||||||
|
{ "id": "conventions", "uses": "conventions" } ],
|
||||||
|
"dependencies": { "objectTypes": [ { "apiName": "contract_agreement", "schemaVersion": 2 } ] } }
|
||||||
|
JSON
|
||||||
|
printf 'name: dealsage\non: push\njobs:\n p:\n steps:\n - uses: https://git.example/dealsage-platform/ci-actions/pipeline@v1\n' > "$d/.gitea/workflows/publish.yml"
|
||||||
|
: > "$d/src/lib/dealsage.ts"; : > "$d/src/Root.tsx"; : > "$d/src/main.tsx"
|
||||||
|
printf '# Agent guide\n<!-- dealsage:generated:start -->\n<!-- dealsage:generated:end -->\n' > "$d/AGENTS.md"
|
||||||
|
git -C "$d" init -q -b feature/x && git -C "$d" -c user.name=t -c user.email=t@t add -A \
|
||||||
|
&& git -C "$d" -c user.name=t -c user.email=t@t commit -qm "Add fixture app"
|
||||||
|
}
|
||||||
|
|
||||||
|
run_pipeline() { # dir -> runs manifest, checks, build, publish; echoes the failing stage or "ok"
|
||||||
|
local d="$1" ghenv ghout ghsum
|
||||||
|
ghenv="$(mktemp)"; ghout="$(mktemp)"; ghsum="$(mktemp)"
|
||||||
|
export GITHUB_ENV="$ghenv" GITHUB_OUTPUT="$ghout" GITHUB_STEP_SUMMARY="$ghsum"
|
||||||
|
export GITHUB_SHA="$(git -C "$d" rev-parse HEAD)" GITHUB_REF_NAME="feature/x" GITHUB_ACTOR="tester"
|
||||||
|
export DEALSAGE_FUNCTIONS_URL="http://127.0.0.1:$PORT" PUBLISH_TOKEN="test-publish-token"
|
||||||
|
export SUPABASE_ANON_KEY="anon" SUPABASE_URL="https://example.supabase.co" CUSTOM_APPS_WORKER_URL="http://127.0.0.1:$PORT"
|
||||||
|
export MANIFEST_PATH=".dealsage/app.json"
|
||||||
|
unset APP_ID MANIFEST_JSON CHECKS_JSON CHECKS_RESULT_JSON
|
||||||
|
local stage
|
||||||
|
for stage in manifest run-checks build publish; do
|
||||||
|
( cd "$d" && bash "$SCRIPTS/$stage.sh" ) > "$WORK/$stage.log" 2>&1 || { echo "$stage"; cat "$ghenv" > "$WORK/last.env"; return 0; }
|
||||||
|
# composite steps share state through GITHUB_ENV (heredoc form); load it.
|
||||||
|
eval "$(python3 - "$ghenv" <<'PY'
|
||||||
|
import re,sys,shlex
|
||||||
|
txt=open(sys.argv[1]).read()
|
||||||
|
for m in re.finditer(r'^(\w+)<<__DS_EOF__\n(.*?)\n__DS_EOF__$', txt, re.S|re.M):
|
||||||
|
print(f"export {m.group(1)}={shlex.quote(m.group(2))}")
|
||||||
|
PY
|
||||||
|
)"
|
||||||
|
done
|
||||||
|
cp "$ghout" "$WORK/last.out"; cp "$ghsum" "$WORK/last.summary"
|
||||||
|
echo ok
|
||||||
|
}
|
||||||
|
|
||||||
|
start_stub() { # policy
|
||||||
|
: > "$WORK/requests.jsonl"
|
||||||
|
STUB_LOG="$WORK/requests.jsonl" STUB_POLICY="$1" python3 "$HERE/stub_server.py" "$PORT" & STUB_PID=$!
|
||||||
|
for _ in $(seq 1 30); do curl -s -o /dev/null "http://127.0.0.1:$PORT/" && break; sleep 0.1; done
|
||||||
|
}
|
||||||
|
stop_stub() { kill "$STUB_PID" 2>/dev/null || true; wait "$STUB_PID" 2>/dev/null || true; }
|
||||||
|
req() { jq -c "$1" "$WORK/requests.jsonl"; }
|
||||||
|
|
||||||
|
echo "Scenario 1: auto policy"
|
||||||
|
make_app "$WORK/app1" "true"; start_stub auto
|
||||||
|
r="$(run_pipeline "$WORK/app1")"
|
||||||
|
check "pipeline completed" "[ '$r' = ok ]"
|
||||||
|
check "four checks recorded (typecheck, lint, conventions, build)" "[ \"\$(req 'select(.path|endswith(\"/record-app-check\"))' | wc -l)\" = 4 ]"
|
||||||
|
check "advisory lint failure recorded as failed" "req 'select(.body.checkId==\"lint\") | .body.status' | grep -q '\"failed\"'"
|
||||||
|
check "conventions passed" "req 'select(.body.checkId==\"conventions\") | .body.status' | grep -q '\"passed\"'"
|
||||||
|
check "check payload carries commit, branch and log tail" "req 'select(.body.checkId==\"typecheck\") | .body | (.commitSha|length)==40 and .branch==\"feature/x\" and (.logTail|length)>0' | grep -q true"
|
||||||
|
check "allocate sent branch, message, author, manifest and check results" "req 'select(.body.action==\"allocate\") | .body | .branch==\"feature/x\" and .commitMessage==\"Add fixture app\" and .author==\"t\" and (.manifest.dependencies.objectTypes|length)==1 and (.checks|length)==3' | grep -q true"
|
||||||
|
check "two files uploaded through the Worker with the upload token" "[ \"\$(req 'select(.method==\"PUT\" and .auth==\"Bearer upl-token\")' | wc -l)\" = 2 ]"
|
||||||
|
check "promote requested after upload" "req 'select(.body.action==\"promote\") | .body.version' | grep -q 7"
|
||||||
|
check "outputs: version=7 promoted=true" "grep -q '^version=7$' '$WORK/last.out' && grep -q '^promoted=true$' '$WORK/last.out'"
|
||||||
|
stop_stub
|
||||||
|
|
||||||
|
echo "Scenario 2: required check fails"
|
||||||
|
make_app "$WORK/app2" "echo 'type error' && exit 1"; start_stub auto
|
||||||
|
r="$(run_pipeline "$WORK/app2")"
|
||||||
|
check "stopped at run-checks" "[ '$r' = run-checks ]"
|
||||||
|
check "failure still recorded" "req 'select(.body.checkId==\"typecheck\") | .body.status' | grep -q '\"failed\"'"
|
||||||
|
check "nothing allocated" "! req 'select(.body.action==\"allocate\")' | grep -q ."
|
||||||
|
check "advisory and platform checks still ran" "[ \"\$(req 'select(.path|endswith(\"/record-app-check\"))' | wc -l)\" = 3 ]"
|
||||||
|
stop_stub
|
||||||
|
|
||||||
|
echo "Scenario 3: manual policy"
|
||||||
|
make_app "$WORK/app3" "true"; start_stub manual
|
||||||
|
r="$(run_pipeline "$WORK/app3")"
|
||||||
|
check "pipeline completed" "[ '$r' = ok ]"
|
||||||
|
check "outputs: promoted=false, channel=branch/feature/x" "grep -q '^promoted=false$' '$WORK/last.out' && grep -q '^channel=branch/feature/x$' '$WORK/last.out'"
|
||||||
|
check "summary mentions the channel" "grep -q 'channel' '$WORK/last.summary'"
|
||||||
|
stop_stub
|
||||||
|
|
||||||
|
echo; echo "$pass passed, $fail failed"
|
||||||
|
[ "$fail" = 0 ]
|
||||||
Executable
+69
@@ -0,0 +1,69 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
"""Stub of the DealSage endpoints the pipeline talks to, for local tests.
|
||||||
|
|
||||||
|
Records every request as JSON lines in the file named by STUB_LOG, and answers
|
||||||
|
like the real functions would:
|
||||||
|
POST /record-app-version allocate -> version 7 + upload token
|
||||||
|
promote -> promoted per STUB_POLICY (auto|manual)
|
||||||
|
fail -> ok
|
||||||
|
POST /record-app-check -> {"id": "..."}
|
||||||
|
PUT /__upload/<app>/<v>/<path> -> 204
|
||||||
|
"""
|
||||||
|
import json, os, sys
|
||||||
|
from http.server import BaseHTTPRequestHandler, HTTPServer
|
||||||
|
|
||||||
|
LOG = os.environ.get("STUB_LOG", "/tmp/stub-requests.jsonl")
|
||||||
|
POLICY = os.environ.get("STUB_POLICY", "auto")
|
||||||
|
seq = {"n": 0}
|
||||||
|
|
||||||
|
class H(BaseHTTPRequestHandler):
|
||||||
|
def log_message(self, *a): # quiet
|
||||||
|
pass
|
||||||
|
|
||||||
|
def _record(self, body):
|
||||||
|
with open(LOG, "a") as f:
|
||||||
|
f.write(json.dumps({"method": self.command, "path": self.path,
|
||||||
|
"auth": self.headers.get("Authorization"), "body": body}) + "\n")
|
||||||
|
|
||||||
|
def _json(self, code, obj):
|
||||||
|
data = json.dumps(obj).encode()
|
||||||
|
self.send_response(code); self.send_header("content-type", "application/json")
|
||||||
|
self.send_header("content-length", str(len(data))); self.end_headers(); self.wfile.write(data)
|
||||||
|
|
||||||
|
def do_POST(self):
|
||||||
|
n = int(self.headers.get("content-length") or 0)
|
||||||
|
raw = self.rfile.read(n).decode() if n else ""
|
||||||
|
try: body = json.loads(raw) if raw else {}
|
||||||
|
except json.JSONDecodeError: body = {"_raw": raw}
|
||||||
|
self._record(body)
|
||||||
|
if self.headers.get("Authorization") != "Bearer test-publish-token":
|
||||||
|
return self._json(401, {"error": "bad token"})
|
||||||
|
if self.path.endswith("/record-app-version"):
|
||||||
|
a = body.get("action")
|
||||||
|
if a == "allocate":
|
||||||
|
return self._json(200, {"version": 7, "r2Prefix": f"apps/{body.get('appId')}/7/", "uploadToken": "upl-token"})
|
||||||
|
if a == "promote":
|
||||||
|
if POLICY == "auto":
|
||||||
|
return self._json(200, {"version": 7, "currentVersion": 7, "promoted": True, "channel": "live"})
|
||||||
|
return self._json(200, {"version": 7, "currentVersion": 6, "promoted": False, "channel": "branch/feature/x"})
|
||||||
|
if a == "fail":
|
||||||
|
return self._json(200, {"ok": True})
|
||||||
|
return self._json(400, {"error": "bad action"})
|
||||||
|
if self.path.endswith("/record-app-check"):
|
||||||
|
seq["n"] += 1
|
||||||
|
return self._json(200, {"id": f"chk-{seq['n']}"})
|
||||||
|
self._json(404, {"error": "no route"})
|
||||||
|
|
||||||
|
def do_PUT(self):
|
||||||
|
n = int(self.headers.get("content-length") or 0)
|
||||||
|
self.rfile.read(n)
|
||||||
|
self._record({"bytes": n})
|
||||||
|
if not self.path.startswith("/__upload/"):
|
||||||
|
return self._json(404, {"error": "no route"})
|
||||||
|
if self.headers.get("Authorization") != "Bearer upl-token":
|
||||||
|
return self._json(401, {"error": "bad upload token"})
|
||||||
|
self.send_response(204); self.end_headers()
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
port = int(sys.argv[1]) if len(sys.argv) > 1 else 8765
|
||||||
|
HTTPServer(("127.0.0.1", port), H).serve_forever()
|
||||||
Reference in New Issue
Block a user