pikasTech-HWLAB/scripts/deploy-desired-state-plan.test.mjs

import assert from "node:assert/strict";
import { mkdtemp, mkdir, writeFile } from "node:fs/promises";
import os from "node:os";
import path from "node:path";
import test from "node:test";

import { buildDesiredStatePlan } from "./src/deploy-desired-state-plan.mjs";

async function makeFixture({
  serviceId = "hwlab-cloud-api",
  commitId = "abc1234",
  catalogCommitId = commitId,
  catalogServiceCommitId = catalogCommitId,
  catalogImageTag = catalogServiceCommitId.slice(0, 7),
  deployEnvCommitId = commitId,
  deployEnvImageTag = commitId,
  deployEnvImage = null,
  deployEnvMirrors = true,
  deploySkillsCommitId = null,
  workloadTag = commitId,
  workloadEnvCommitId = commitId,
  workloadEnvImageTag = commitId,
  workloadEnvImage = null,
  workloadEnvMirrors = true,
  workloadSkillsCommitId = null
} = {}) {
  const root = await mkdtemp(path.join(os.tmpdir(), "hwlab-desired-state-"));
  await mkdir(path.join(root, "deploy/k8s/base"), { recursive: true });
  await mkdir(path.join(root, "reports/dev-gate"), { recursive: true });
  const image = `127.0.0.1:5000/hwlab/${serviceId}:${commitId}`;
  const catalogImage = `127.0.0.1:5000/hwlab/${serviceId}:${catalogImageTag}`;
  const workloadImage = `127.0.0.1:5000/hwlab/${serviceId}:${workloadTag}`;
  const deploy = {
    manifestVersion: "v1",
    environment: "dev",
    commitId,
    services: [
      {
        serviceId,
        image,
        namespace: "hwlab-dev",
        healthPath: "/health/live",
        profile: "dev",
        replicas: 1,
        env: deployEnvMirrors
          ? {
              HWLAB_COMMIT_ID: deployEnvCommitId,
              HWLAB_IMAGE: deployEnvImage ?? image,
              HWLAB_IMAGE_TAG: deployEnvImageTag,
              ...(deploySkillsCommitId ? { HWLAB_SKILLS_COMMIT_ID: deploySkillsCommitId } : {})
            }
          : {}
      }
    ]
  };
  const catalog = {
    catalogVersion: "v1",
    kind: "hwlab-artifact-catalog",
    environment: "dev",
    profile: "dev",
    namespace: "hwlab-dev",
    endpoint: "http://74.48.78.17:16667",
    commitId: catalogCommitId,
    artifactState: "contract-skeleton",
    publish: {
      ciPublished: false,
      registryVerified: false,
      provenance: "not_available_until_publish"
    },
    services: [
      {
        serviceId,
        commitId: catalogServiceCommitId,
        image: catalogImage,
        imageTag: catalogImageTag,
        digest: "not_published",
        publishState: "skeleton-only",
        artifactRequired: true
      }
    ]
  };
  const workloads = {
    apiVersion: "v1",
    kind: "List",
    items: [
      {
        apiVersion: "apps/v1",
        kind: "Deployment",
        metadata: {
          name: serviceId,
          namespace: "hwlab-dev",
          labels: {
            "hwlab.pikastech.local/service-id": serviceId
          }
        },
        spec: {
          template: {
            spec: {
              containers: [
                {
                  name: serviceId,
                  image: workloadImage,
                  env: workloadEnvMirrors
                    ? [
                        { name: "HWLAB_COMMIT_ID", value: workloadEnvCommitId },
                        { name: "HWLAB_IMAGE", value: workloadEnvImage ?? image },
                        { name: "HWLAB_IMAGE_TAG", value: workloadEnvImageTag },
                        ...(workloadSkillsCommitId ? [{ name: "HWLAB_SKILLS_COMMIT_ID", value: workloadSkillsCommitId }] : [])
                      ]
                    : []
                }
              ]
            }
          }
        }
      }
    ]
  };
  await writeFile(path.join(root, "deploy/deploy.json"), `${JSON.stringify(deploy, null, 2)}\n`);
  await writeFile(path.join(root, "deploy/artifact-catalog.dev.json"), `${JSON.stringify(catalog, null, 2)}\n`);
  await writeFile(path.join(root, "deploy/k8s/base/workloads.yaml"), `${JSON.stringify(workloads, null, 2)}\n`);
  return root;
}

test("passes internally consistent desired-state", async () => {
  const repoRoot = await makeFixture();
  const plan = await buildDesiredStatePlan({ repoRoot });
  assert.equal(plan.status, "pass");
  assert.equal(plan.summary.desiredCommitId, "abc1234");
  assert.equal(plan.summary.presentMirrorCount, 6);
  assert.deepEqual(plan.diagnostics, []);
});

test("passes when cloud-web owns runtime identity mirrors", async () => {
  const repoRoot = await makeFixture({ serviceId: "hwlab-cloud-web" });
  const plan = await buildDesiredStatePlan({ repoRoot });
  assert.equal(plan.status, "pass");
  assert.equal(plan.summary.presentMirrorCount, 6);
  assert.deepEqual(plan.diagnostics, []);
});

test("blocks when cloud-web runtime identity mirrors are missing", async () => {
  const repoRoot = await makeFixture({
    serviceId: "hwlab-cloud-web",
    deployEnvMirrors: false,
    workloadEnvMirrors: false
  });
  const plan = await buildDesiredStatePlan({ repoRoot });
  assert.equal(plan.status, "blocked");
  assert.equal(plan.summary.blockers, 6);
  assert.ok(plan.diagnostics.some((diagnostic) =>
    diagnostic.code === "missing_mirror" &&
    diagnostic.path === "deploy/deploy.json.services.hwlab-cloud-web.env.HWLAB_COMMIT_ID"
  ));
  assert.ok(plan.diagnostics.some((diagnostic) =>
    diagnostic.code === "missing_mirror" &&
    diagnostic.path.endsWith(".env.HWLAB_IMAGE_TAG")
  ));
});

test("target tag review is read-only promotion_pending when current state is uniformly older", async () => {
  const repoRoot = await makeFixture();
  const plan = await buildDesiredStatePlan({ repoRoot, targetTag: "def5678" });
  assert.equal(plan.status, "planned");
  assert.equal(plan.target.convergence.state, "promotion_pending");
  assert.equal(plan.summary.blockers, 0);
  assert.match(plan.services[0].promotion.deployImage, /:def5678$/u);
});

test("promotion commit check blocks when current desired-state is uniformly older", async () => {
  const repoRoot = await makeFixture();
  const plan = await buildDesiredStatePlan({ repoRoot, promotionCommit: "def5678" });
  assert.equal(plan.status, "blocked");
  assert.equal(plan.target.convergence.state, "promotion_mismatch");
  assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "promotion_commit_mismatch"));
});

test("promotion commit check passes when every desired-state field is converged", async () => {
  const repoRoot = await makeFixture({ commitId: "def5678" });
  const plan = await buildDesiredStatePlan({ repoRoot, promotionCommit: "def5678" });
  assert.equal(plan.status, "pass");
  assert.equal(plan.target.convergence.state, "already_promoted");
  assert.deepEqual(plan.diagnostics, []);
});

test("promotion commit check blocks an explicit non-matching target tag", async () => {
  const repoRoot = await makeFixture({ commitId: "def5678" });
  const plan = await buildDesiredStatePlan({
    repoRoot,
    promotionCommit: "def5678",
    targetTag: "abc1234"
  });
  assert.equal(plan.status, "blocked");
  assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "promotion_tag_mismatch"));
});

test("blocks on mirror drift", async () => {
  const repoRoot = await makeFixture({ workloadEnvImageTag: "badcafe" });
  const plan = await buildDesiredStatePlan({ repoRoot });
  assert.equal(plan.status, "blocked");
  assert.equal(plan.summary.blockers, 1);
  assert.equal(plan.diagnostics[0].code, "mirror_mismatch");
  assert.match(plan.diagnostics[0].path, /HWLAB_IMAGE_TAG/u);
});

test("blocks on skills commit mirror drift", async () => {
  const repoRoot = await makeFixture({ deploySkillsCommitId: "badcafe" });
  const plan = await buildDesiredStatePlan({ repoRoot });
  assert.equal(plan.status, "blocked");
  assert.ok(plan.diagnostics.some((diagnostic) =>
    diagnostic.code === "mirror_mismatch" &&
    diagnostic.path.endsWith("HWLAB_SKILLS_COMMIT_ID")
  ));
});

test("blocks on workload image drift", async () => {
  const repoRoot = await makeFixture({ workloadTag: "badcafe" });
  const plan = await buildDesiredStatePlan({ repoRoot });
  assert.equal(plan.status, "blocked");
  assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "image_tag_mismatch"));
  assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "image_mismatch"));
});

test("reports partial target drift when catalog top-level commit moves but services stay old", async () => {
  const repoRoot = await makeFixture({ catalogCommitId: "def5678" });
  const plan = await buildDesiredStatePlan({ repoRoot, targetTag: "def5678" });
  assert.equal(plan.status, "blocked");
  assert.equal(plan.target.convergence.state, "partial_drift");
  assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "partial_target_drift"));
});

test("reports partial target drift as a blocker", async () => {
  const repoRoot = await makeFixture({ workloadTag: "def5678", workloadEnvImageTag: "def5678" });
  const plan = await buildDesiredStatePlan({ repoRoot, targetTag: "def5678" });
  assert.equal(plan.status, "blocked");
  assert.equal(plan.target.convergence.state, "partial_drift");
  assert.ok(plan.diagnostics.some((diagnostic) => diagnostic.code === "partial_target_drift"));
});