mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: scope envreuse artifact collection to ci plan (#2174)

Browse Source
This commit is contained in:
Lyon
2026-06-26 03:23:55 +08:00
committed by GitHub
parent d25e67ebbd
commit 2e9e4bd663
3 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/artifact-publish.mjs
+13 -1
View File
@@ -88,6 +88,7 @@ function parseArgs(argv) {
buildkitAddr: defaultBuildkitAddr,
externalServiceReportDir: null,
externalServiceResultsEnv: false,
ciPlanPath: null,
tektonResultsDir: null,
emitReport: true,
quietBuild: false,
@@ -115,6 +116,7 @@ function parseArgs(argv) {
else if (arg === "--buildkit-addr") args.buildkitAddr = readOption(argv, ++index, arg);
else if (arg === "--external-service-report-dir") args.externalServiceReportDir = readOption(argv, ++index, arg);
else if (arg === "--external-service-results-env") args.externalServiceResultsEnv = true;
else if (arg === "--ci-plan-path") args.ciPlanPath = readOption(argv, ++index, arg);
else if (arg === "--tekton-results-dir") args.tektonResultsDir = readOption(argv, ++index, arg);
else if (arg === "--no-report") args.emitReport = false;
else if (arg === "--quiet-build") args.quietBuild = true;
@@ -211,6 +213,7 @@ function printHelp() {
" --buildkit-addr ADDR optional buildctl --addr endpoint for a sidecar BuildKit daemon",
" --external-service-report-dir DIR collect affected service artifacts from per-service publish reports",
" --external-service-results-env collect service artifacts from HWLAB_SERVICE_RESULT_* env vars",
" --ci-plan-path PATH reuse plan-artifacts JSON to scope external service reports",
" --tekton-results-dir DIR write single-service build result files for Tekton results",
` --report PATH default: ${defaultReportPath}`,
" --no-report print JSON without updating the temporary artifact JSON",
@@ -223,6 +226,13 @@ async function readConfig(relativePath) {
return readStructuredFile(repoRoot, relativePath);
}
async function readOptionalCiPlan(pathValue) {
const text = typeof pathValue === "string" ? pathValue.trim() : "";
if (!text) return null;
const fullPath = path.isAbsolute(text) ? text : path.resolve(repoRoot, text);
return JSON.parse(await readFile(fullPath, "utf8"));
}
async function readConfigIfPresent(relativePath, fallback = null) {
try {
return await readConfig(relativePath);
@@ -2324,7 +2334,7 @@ async function main() {
const buildCreatedAt = new Date().toISOString();
const repo = repoLabelFromRemote(remoteUrl);
const producer = artifactProducer(process.env);
const ciPlan = await createCiPlan({
const computedCiPlan = await createCiPlan({
repoRoot,
lane: args.lane,
targetRef: "HEAD",
@@ -2334,6 +2344,8 @@ async function main() {
baseImage: args.baseImage ?? undefined,
...(args.servicesExplicit ? { services: args.services } : {})
});
const ciPlanOverride = await readOptionalCiPlan(args.ciPlanPath);
const ciPlan = ciPlanOverride ?? computedCiPlan;
const allowedServiceIds = isRuntimeArtifactLane(args.lane) ? runtimeLaneServiceIdsFromDeploy(deployManifest, args.lane) : SERVICE_IDS;
const services = enrichServicesWithCiPlan(await resolveServices(args.services, catalog, allowedServiceIds), ciPlan);
const catalogByServiceId = new Map((catalog?.services ?? []).map((service) => [service.serviceId, service]));
scripts/gitops-render.mjs
+1 -1
View File
@@ -2104,7 +2104,7 @@ export HWLAB_ARTIFACT_LANE="$(params.lane)"
export HWLAB_ARTIFACT_CATALOG_PATH="$(params.catalog-path)"
export HWLAB_DEPLOY_MANIFEST_PATH="deploy/deploy.yaml"
export HWLAB_ARTIFACT_IMAGE_TAG_MODE="$(params.image-tag-mode)"
HWLAB_CI_PLAN_VERIFY_REUSE_REGISTRY=1 node scripts/artifact-publish.mjs --publish --lane "$(params.lane)" --catalog-path "$(params.catalog-path)" --deploy-config deploy/deploy.yaml --image-tag-mode "$(params.image-tag-mode)" --registry-prefix "$(params.registry-prefix)" --report /workspace/source/dev-artifacts.json --quiet-build --concurrency 1 --services "$(params.services)" --external-service-report-dir /workspace/source/service-results
HWLAB_CI_PLAN_VERIFY_REUSE_REGISTRY=1 node scripts/artifact-publish.mjs --publish --lane "$(params.lane)" --catalog-path "$(params.catalog-path)" --deploy-config deploy/deploy.yaml --image-tag-mode "$(params.image-tag-mode)" --registry-prefix "$(params.registry-prefix)" --report /workspace/source/dev-artifacts.json --quiet-build --concurrency 1 --services "$(params.services)" --external-service-report-dir /workspace/source/service-results --ci-plan-path /workspace/source/affected-services.json
node scripts/refresh-artifact-catalog.mjs --lane "$(params.lane)" --catalog-path "$(params.catalog-path)" --deploy-config deploy/deploy.yaml --image-tag-mode "$(params.image-tag-mode)" --target-ref HEAD --publish-report /workspace/source/dev-artifacts.json --no-write
`;
}
scripts/gitops-render.test.ts
+3
View File
@@ -532,6 +532,9 @@ test("v03 render keeps node identity as data instead of generated structure", as
assert.ok(generatedPaths.includes("argocd/application-v03.yaml"));
assert.ok(generatedPaths.includes("tekton-v03/pipeline.yaml"));
assert.ok(generatedPaths.includes("runtime-v03/external-postgres.yaml"));
const pipeline = await readFile(path.join(outDir, "tekton-v03", "pipeline.yaml"), "utf8");
assert.match(pipeline, /--external-service-report-dir \/workspace\/source\/service-results/u);
assert.match(pipeline, /--ci-plan-path \/workspace\/source\/affected-services\.json/u);
assert.ok(!generatedPaths.includes("runtime-v03/postgres.yaml"));
for (const relativePath of generatedPaths) {
assert.doesNotMatch(relativePath, /g14/i, `legacy node token leaked into generated path ${relativePath}`);