Code Queue Review
411 lines
16 KiB
JavaScript
411 lines
16 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { execFile } from "node:child_process";
|
|
import { mkdtemp, mkdir, readFile, writeFile } from "node:fs/promises";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import test from "node:test";
|
|
import { promisify } from "node:util";
|
|
|
|
import { buildDesiredStatePlan } from "./src/deploy-desired-state-plan.mjs";
|
|
|
|
const execFileAsync = promisify(execFile);
|
|
|
|
async function git(repoRoot, args) {
|
|
const result = await execFileAsync("git", args, {
|
|
cwd: repoRoot,
|
|
maxBuffer: 1024 * 1024
|
|
});
|
|
return result.stdout.trim();
|
|
}
|
|
|
|
async function makeFixture({
|
|
serviceId = "hwlab-cloud-api",
|
|
commitId = "abc1234",
|
|
catalogCommitId = commitId,
|
|
catalogServiceCommitId = catalogCommitId,
|
|
catalogImageTag = catalogServiceCommitId.slice(0, 7),
|
|
deployEnvCommitId = commitId,
|
|
deployEnvImageTag = commitId,
|
|
deployEnvImage = null,
|
|
deployEnvMirrors = true,
|
|
deploySkillsCommitId = null,
|
|
deployCodeAgentProviderEnv = true,
|
|
deployDbEnv = true,
|
|
deployDbSslMode = "disable",
|
|
workloadTag = commitId,
|
|
workloadEnvCommitId = commitId,
|
|
workloadEnvImageTag = commitId,
|
|
workloadEnvImage = null,
|
|
workloadEnvMirrors = true,
|
|
workloadSkillsCommitId = null,
|
|
workloadCodeAgentProviderEnv = true,
|
|
workloadDbEnv = true,
|
|
workloadDbSslMode = "disable"
|
|
} = {}) {
|
|
const root = await mkdtemp(path.join(os.tmpdir(), "hwlab-desired-state-"));
|
|
await mkdir(path.join(root, "deploy/k8s/base"), { recursive: true });
|
|
await mkdir(path.join(root, "reports/dev-gate"), { recursive: true });
|
|
const image = `127.0.0.1:5000/hwlab/${serviceId}:${commitId}`;
|
|
const catalogImage = `127.0.0.1:5000/hwlab/${serviceId}:${catalogImageTag}`;
|
|
const workloadImage = `127.0.0.1:5000/hwlab/${serviceId}:${workloadTag}`;
|
|
const providerBaseUrl = "http://172.26.26.227:17680/v1/responses";
|
|
const providerEnv =
|
|
serviceId === "hwlab-cloud-api" && deployCodeAgentProviderEnv
|
|
? {
|
|
HWLAB_CODE_AGENT_PROVIDER: "openai",
|
|
HWLAB_CODE_AGENT_MODEL: "gpt-5.5",
|
|
HWLAB_CODE_AGENT_OPENAI_BASE_URL: providerBaseUrl,
|
|
OPENAI_API_KEY: "secretRef:hwlab-code-agent-provider/openai-api-key"
|
|
}
|
|
: {};
|
|
const workloadProviderEnv =
|
|
serviceId === "hwlab-cloud-api" && workloadCodeAgentProviderEnv
|
|
? [
|
|
{ name: "HWLAB_CODE_AGENT_PROVIDER", value: "openai" },
|
|
{ name: "HWLAB_CODE_AGENT_MODEL", value: "gpt-5.5" },
|
|
{ name: "HWLAB_CODE_AGENT_OPENAI_BASE_URL", value: providerBaseUrl },
|
|
{
|
|
name: "OPENAI_API_KEY",
|
|
valueFrom: {
|
|
secretKeyRef: {
|
|
name: "hwlab-code-agent-provider",
|
|
key: "openai-api-key"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
: [];
|
|
const dbEnv =
|
|
serviceId === "hwlab-cloud-api" && deployDbEnv
|
|
? {
|
|
HWLAB_CLOUD_DB_URL: "secretRef:hwlab-cloud-api-dev-db/database-url",
|
|
HWLAB_CLOUD_DB_SSL_MODE: deployDbSslMode
|
|
}
|
|
: {};
|
|
const workloadDbEntries =
|
|
serviceId === "hwlab-cloud-api" && workloadDbEnv
|
|
? [
|
|
{
|
|
name: "HWLAB_CLOUD_DB_URL",
|
|
valueFrom: {
|
|
secretKeyRef: {
|
|
name: "hwlab-cloud-api-dev-db",
|
|
key: "database-url"
|
|
}
|
|
}
|
|
},
|
|
{ name: "HWLAB_CLOUD_DB_SSL_MODE", value: workloadDbSslMode }
|
|
]
|
|
: [];
|
|
const deploy = {
|
|
manifestVersion: "v1",
|
|
environment: "dev",
|
|
commitId,
|
|
services: [
|
|
{
|
|
serviceId,
|
|
image,
|
|
namespace: "hwlab-dev",
|
|
healthPath: "/health/live",
|
|
profile: "dev",
|
|
replicas: 1,
|
|
env: deployEnvMirrors
|
|
? {
|
|
HWLAB_COMMIT_ID: deployEnvCommitId,
|
|
HWLAB_IMAGE: deployEnvImage ?? image,
|
|
HWLAB_IMAGE_TAG: deployEnvImageTag,
|
|
...(deploySkillsCommitId ? { HWLAB_SKILLS_COMMIT_ID: deploySkillsCommitId } : {}),
|
|
...dbEnv,
|
|
...providerEnv
|
|
}
|
|
: {}
|
|
}
|
|
]
|
|
};
|
|
const catalog = {
|
|
catalogVersion: "v1",
|
|
kind: "hwlab-artifact-catalog",
|
|
environment: "dev",
|
|
profile: "dev",
|
|
namespace: "hwlab-dev",
|
|
endpoint: "http://74.48.78.17:16667",
|
|
commitId: catalogCommitId,
|
|
artifactState: "contract-skeleton",
|
|
publish: {
|
|
ciPublished: false,
|
|
registryVerified: false,
|
|
provenance: "not_available_until_publish"
|
|
},
|
|
services: [
|
|
{
|
|
serviceId,
|
|
commitId: catalogServiceCommitId,
|
|
image: catalogImage,
|
|
imageTag: catalogImageTag,
|
|
digest: "not_published",
|
|
publishState: "skeleton-only",
|
|
artifactRequired: true
|
|
}
|
|
]
|
|
};
|
|
const workloads = {
|
|
apiVersion: "v1",
|
|
kind: "List",
|
|
items: [
|
|
{
|
|
apiVersion: "apps/v1",
|
|
kind: "Deployment",
|
|
metadata: {
|
|
name: serviceId,
|
|
namespace: "hwlab-dev",
|
|
labels: {
|
|
"hwlab.pikastech.local/service-id": serviceId
|
|
}
|
|
},
|
|
spec: {
|
|
template: {
|
|
spec: {
|
|
containers: [
|
|
{
|
|
name: serviceId,
|
|
image: workloadImage,
|
|
env: workloadEnvMirrors
|
|
? [
|
|
{ name: "HWLAB_COMMIT_ID", value: workloadEnvCommitId },
|
|
{ name: "HWLAB_IMAGE", value: workloadEnvImage ?? image },
|
|
{ name: "HWLAB_IMAGE_TAG", value: workloadEnvImageTag },
|
|
...(workloadSkillsCommitId ? [{ name: "HWLAB_SKILLS_COMMIT_ID", value: workloadSkillsCommitId }] : []),
|
|
...workloadDbEntries,
|
|
...workloadProviderEnv
|
|
]
|
|
: []
|
|
}
|
|
]
|
|
}
|
|
}
|
|
}
|
|
}
|
|
]
|
|
};
|
|
await writeFile(path.join(root, "deploy/deploy.json"), `${JSON.stringify(deploy, null, 2)}\n`);
|
|
await writeFile(path.join(root, "deploy/artifact-catalog.dev.json"), `${JSON.stringify(catalog, null, 2)}\n`);
|
|
await writeFile(path.join(root, "deploy/k8s/base/workloads.yaml"), `${JSON.stringify(workloads, null, 2)}\n`);
|
|
return root;
|
|
}
|
|
|
|
test("passes internally consistent desired-state", async () => {
|
|
const repoRoot = await makeFixture();
|
|
const plan = await buildDesiredStatePlan({ repoRoot });
|
|
assert.equal(plan.status, "pass");
|
|
assert.equal(plan.summary.desiredCommitId, "abc1234");
|
|
assert.equal(plan.summary.presentMirrorCount, 6);
|
|
assert.deepEqual(plan.diagnostics, []);
|
|
});
|
|
|
|
test("passes when cloud-web owns runtime identity mirrors", async () => {
|
|
const repoRoot = await makeFixture({ serviceId: "hwlab-cloud-web" });
|
|
const plan = await buildDesiredStatePlan({ repoRoot });
|
|
assert.equal(plan.status, "pass");
|
|
assert.equal(plan.summary.presentMirrorCount, 6);
|
|
assert.deepEqual(plan.diagnostics, []);
|
|
});
|
|
|
|
test("passes when cloud-api preserves provider env and DEV egress contract", async () => {
|
|
const repoRoot = await makeFixture();
|
|
const plan = await buildDesiredStatePlan({ repoRoot });
|
|
assert.equal(plan.status, "pass");
|
|
assert.equal(plan.cloudApiDb.ready, true);
|
|
assert.equal(plan.cloudApiDb.sslMode.expected, "disable");
|
|
assert.equal(plan.cloudApiDb.sslMode.deployMatches, true);
|
|
assert.equal(plan.cloudApiDb.sslMode.workloadMatches, true);
|
|
assert.equal(plan.codeAgentProvider.ready, true);
|
|
assert.equal(plan.codeAgentProvider.secretRef.present, true);
|
|
assert.equal(plan.codeAgentProvider.egress.deployMatchesDevProxy, true);
|
|
assert.deepEqual(plan.diagnostics, []);
|
|
});
|
|
|
|
test("blocks when cloud-api DB SSL mode drifts back to require", async () => {
|
|
const repoRoot = await makeFixture({
|
|
deployDbSslMode: "require",
|
|
workloadDbSslMode: "require"
|
|
});
|
|
const plan = await buildDesiredStatePlan({ repoRoot });
|
|
assert.equal(plan.status, "blocked");
|
|
assert.equal(plan.cloudApiDb.ready, false);
|
|
assert.equal(plan.cloudApiDb.sslMode.expected, "disable");
|
|
assert.equal(plan.cloudApiDb.sslMode.deployMatches, false);
|
|
assert.equal(plan.cloudApiDb.sslMode.workloadMatches, false);
|
|
assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "cloud_api_db_contract_mismatch"));
|
|
});
|
|
|
|
test("blocks when cloud-web runtime identity mirrors are missing", async () => {
|
|
const repoRoot = await makeFixture({
|
|
serviceId: "hwlab-cloud-web",
|
|
deployEnvMirrors: false,
|
|
workloadEnvMirrors: false
|
|
});
|
|
const plan = await buildDesiredStatePlan({ repoRoot });
|
|
assert.equal(plan.status, "blocked");
|
|
assert.equal(plan.summary.blockers, 6);
|
|
assert.ok(plan.diagnostics.some((diagnostic) =>
|
|
diagnostic.code === "missing_mirror" &&
|
|
diagnostic.path === "deploy/deploy.json.services.hwlab-cloud-web.env.HWLAB_COMMIT_ID"
|
|
));
|
|
assert.ok(plan.diagnostics.some((diagnostic) =>
|
|
diagnostic.code === "missing_mirror" &&
|
|
diagnostic.path.endsWith(".env.HWLAB_IMAGE_TAG")
|
|
));
|
|
});
|
|
|
|
test("blocks when cloud-api provider env is missing from desired state", async () => {
|
|
const repoRoot = await makeFixture({ deployCodeAgentProviderEnv: false, workloadCodeAgentProviderEnv: false });
|
|
const plan = await buildDesiredStatePlan({ repoRoot });
|
|
assert.equal(plan.status, "blocked");
|
|
assert.equal(plan.codeAgentProvider.ready, false);
|
|
assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "code_agent_provider_contract_mismatch"));
|
|
assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.path === "deploy.codeAgentProvider"));
|
|
});
|
|
|
|
test("blocks when cloud-api workload points Code Agent directly at public OpenAI", async () => {
|
|
const repoRoot = await makeFixture();
|
|
const workloadsPath = path.join(repoRoot, "deploy/k8s/base/workloads.yaml");
|
|
const workloads = JSON.parse(await readFile(workloadsPath, "utf8"));
|
|
const env = workloads.items[0].spec.template.spec.containers[0].env;
|
|
env.find((entry) => entry.name === "HWLAB_CODE_AGENT_OPENAI_BASE_URL").value = "https://api.openai.com/v1/responses";
|
|
await writeFile(workloadsPath, `${JSON.stringify(workloads, null, 2)}\n`);
|
|
|
|
const plan = await buildDesiredStatePlan({ repoRoot });
|
|
assert.equal(plan.status, "blocked");
|
|
assert.equal(plan.codeAgentProvider.egress.directPublicOpenAi, true);
|
|
assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "code_agent_provider_contract_mismatch"));
|
|
});
|
|
|
|
test("target tag review is read-only promotion_pending when current state is uniformly older", async () => {
|
|
const repoRoot = await makeFixture();
|
|
const plan = await buildDesiredStatePlan({ repoRoot, targetTag: "def5678" });
|
|
assert.equal(plan.status, "planned");
|
|
assert.equal(plan.target.convergence.state, "promotion_pending");
|
|
assert.equal(plan.summary.blockers, 0);
|
|
assert.match(plan.services[0].promotion.deployImage, /:def5678$/u);
|
|
});
|
|
|
|
test("target check blocks when current desired-state is uniformly older", async () => {
|
|
const repoRoot = await makeFixture();
|
|
const plan = await buildDesiredStatePlan({ repoRoot, targetTag: "def5678", requireTargetConvergence: true });
|
|
assert.equal(plan.status, "blocked");
|
|
assert.equal(plan.target.convergence.state, "target_mismatch");
|
|
assert.equal(plan.target.convergenceRequirement, "target-check");
|
|
assert.ok(plan.diagnostics.some((diagnostic) =>
|
|
diagnostic.code === "target_desired_state_mismatch" &&
|
|
diagnostic.message.includes("stale desired-state is not pinned")
|
|
));
|
|
});
|
|
|
|
test("target check accepts accepted first-parent main on the checked-out merge commit", async () => {
|
|
const repoRoot = await makeFixture();
|
|
await git(repoRoot, ["init", "-b", "main"]);
|
|
await git(repoRoot, ["config", "user.email", "test@example.invalid"]);
|
|
await git(repoRoot, ["config", "user.name", "HWLAB Test"]);
|
|
await git(repoRoot, ["add", "."]);
|
|
await git(repoRoot, ["commit", "-m", "base"]);
|
|
|
|
const acceptedMain = await git(repoRoot, ["rev-parse", "HEAD"]);
|
|
const acceptedTag = acceptedMain.slice(0, 7);
|
|
await git(repoRoot, ["checkout", "-b", "desired-state-refresh"]);
|
|
|
|
for (const relativePath of [
|
|
"deploy/deploy.json",
|
|
"deploy/artifact-catalog.dev.json",
|
|
"deploy/k8s/base/workloads.yaml"
|
|
]) {
|
|
const filePath = path.join(repoRoot, relativePath);
|
|
const raw = await readFile(filePath, "utf8");
|
|
await writeFile(filePath, raw.replaceAll("abc1234", acceptedTag));
|
|
}
|
|
await git(repoRoot, ["add", "."]);
|
|
await git(repoRoot, ["commit", "-m", "refresh desired-state"]);
|
|
await git(repoRoot, ["checkout", "main"]);
|
|
await git(repoRoot, ["merge", "--no-ff", "desired-state-refresh", "-m", "merge desired-state refresh"]);
|
|
|
|
const mergeCommit = await git(repoRoot, ["rev-parse", "HEAD"]);
|
|
const plan = await buildDesiredStatePlan({ repoRoot, targetRef: "HEAD", requireTargetConvergence: true });
|
|
|
|
assert.equal(plan.status, "pass");
|
|
assert.equal(plan.target.commitId, mergeCommit);
|
|
assert.equal(plan.target.acceptedCurrentMain.commitId, acceptedMain);
|
|
assert.equal(plan.target.comparisonCommitId, acceptedMain);
|
|
assert.equal(plan.target.comparisonTag, acceptedTag);
|
|
assert.equal(plan.target.convergence.state, "accepted_main_promoted");
|
|
assert.deepEqual(plan.diagnostics, []);
|
|
});
|
|
|
|
test("promotion commit check blocks when current desired-state is uniformly older", async () => {
|
|
const repoRoot = await makeFixture();
|
|
const plan = await buildDesiredStatePlan({ repoRoot, promotionCommit: "def5678" });
|
|
assert.equal(plan.status, "blocked");
|
|
assert.equal(plan.target.convergence.state, "promotion_mismatch");
|
|
assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "promotion_commit_mismatch"));
|
|
});
|
|
|
|
test("promotion commit check passes when every desired-state field is converged", async () => {
|
|
const repoRoot = await makeFixture({ commitId: "def5678" });
|
|
const plan = await buildDesiredStatePlan({ repoRoot, promotionCommit: "def5678" });
|
|
assert.equal(plan.status, "pass");
|
|
assert.equal(plan.target.convergence.state, "already_promoted");
|
|
assert.deepEqual(plan.diagnostics, []);
|
|
});
|
|
|
|
test("promotion commit check blocks an explicit non-matching target tag", async () => {
|
|
const repoRoot = await makeFixture({ commitId: "def5678" });
|
|
const plan = await buildDesiredStatePlan({
|
|
repoRoot,
|
|
promotionCommit: "def5678",
|
|
targetTag: "abc1234"
|
|
});
|
|
assert.equal(plan.status, "blocked");
|
|
assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "promotion_tag_mismatch"));
|
|
});
|
|
|
|
test("blocks on mirror drift", async () => {
|
|
const repoRoot = await makeFixture({ workloadEnvImageTag: "badcafe" });
|
|
const plan = await buildDesiredStatePlan({ repoRoot });
|
|
assert.equal(plan.status, "blocked");
|
|
assert.equal(plan.summary.blockers, 1);
|
|
assert.equal(plan.diagnostics[0].code, "mirror_mismatch");
|
|
assert.match(plan.diagnostics[0].path, /HWLAB_IMAGE_TAG/u);
|
|
});
|
|
|
|
test("blocks on skills commit mirror drift", async () => {
|
|
const repoRoot = await makeFixture({ deploySkillsCommitId: "badcafe" });
|
|
const plan = await buildDesiredStatePlan({ repoRoot });
|
|
assert.equal(plan.status, "blocked");
|
|
assert.ok(plan.diagnostics.some((diagnostic) =>
|
|
diagnostic.code === "mirror_mismatch" &&
|
|
diagnostic.path.endsWith("HWLAB_SKILLS_COMMIT_ID")
|
|
));
|
|
});
|
|
|
|
test("blocks on workload image drift", async () => {
|
|
const repoRoot = await makeFixture({ workloadTag: "badcafe" });
|
|
const plan = await buildDesiredStatePlan({ repoRoot });
|
|
assert.equal(plan.status, "blocked");
|
|
assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "image_tag_mismatch"));
|
|
assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "image_mismatch"));
|
|
});
|
|
|
|
test("reports partial target drift when catalog top-level commit moves but services stay old", async () => {
|
|
const repoRoot = await makeFixture({ catalogCommitId: "def5678" });
|
|
const plan = await buildDesiredStatePlan({ repoRoot, targetTag: "def5678" });
|
|
assert.equal(plan.status, "blocked");
|
|
assert.equal(plan.target.convergence.state, "partial_drift");
|
|
assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "partial_target_drift"));
|
|
});
|
|
|
|
test("reports partial target drift as a blocker", async () => {
|
|
const repoRoot = await makeFixture({ workloadTag: "def5678", workloadEnvImageTag: "def5678" });
|
|
const plan = await buildDesiredStatePlan({ repoRoot, targetTag: "def5678" });
|
|
assert.equal(plan.status, "blocked");
|
|
assert.equal(plan.target.convergence.state, "partial_drift");
|
|
assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "partial_target_drift"));
|
|
});
|