root
196 lines
10 KiB
JavaScript
Executable File
196 lines
10 KiB
JavaScript
Executable File
#!/usr/bin/env bun
|
|
import { createHash } from "node:crypto";
|
|
import { spawnSync } from "node:child_process";
|
|
import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
|
|
import { dirname, resolve } from "node:path";
|
|
import { parseAllDocuments } from "yaml";
|
|
|
|
const placeholders = {
|
|
image: "__SUB2RANK_IMAGE_REF__",
|
|
configBase64: "__SUB2RANK_CONFIG_BASE64__",
|
|
configSha256: "__SUB2RANK_CONFIG_SHA256__",
|
|
sourceCommit: "__SUB2RANK_SOURCE_COMMIT__",
|
|
};
|
|
|
|
function option(name) {
|
|
const index = process.argv.indexOf(name);
|
|
if (index === -1) return null;
|
|
const value = process.argv[index + 1];
|
|
if (value === undefined || value.length === 0 || value.startsWith("--")) throw new Error(`${name} requires a value`);
|
|
return value;
|
|
}
|
|
|
|
function required(value, path) {
|
|
if (typeof value !== "string" || value.length === 0 || value.includes("\n")) throw new Error(`${path} must be a non-empty single-line string`);
|
|
return value;
|
|
}
|
|
|
|
function record(value, path) {
|
|
if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error(`${path} must be an object`);
|
|
return value;
|
|
}
|
|
|
|
function safePath(value, path) {
|
|
const result = required(value, path);
|
|
if (result.startsWith("/") || result.split(/[\\/]/u).includes("..") || !/^[A-Za-z0-9._/-]+$/u.test(result)) throw new Error(`${path} must be a safe relative path`);
|
|
return result;
|
|
}
|
|
|
|
function run(command, args, cwd, allowFailure = false) {
|
|
const result = spawnSync(command, args, { cwd, encoding: "utf8", maxBuffer: 4 * 1024 * 1024 });
|
|
if (result.error !== undefined) throw result.error;
|
|
if (result.status !== 0 && !allowFailure) {
|
|
const detail = `${result.stderr || result.stdout || "command failed"}`.trim().slice(-2000);
|
|
throw new Error(`${command} failed (${result.status}): ${detail}`);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
function sha256(value) {
|
|
return createHash("sha256").update(value).digest("hex");
|
|
}
|
|
|
|
function replaceAllRequired(template, replacements) {
|
|
let output = template;
|
|
for (const [from, to] of replacements) {
|
|
if (!output.includes(from)) throw new Error(`manifest template is missing ${from}`);
|
|
output = output.split(from).join(to);
|
|
}
|
|
for (const placeholder of Object.values(placeholders)) {
|
|
if (output.includes(placeholder)) throw new Error(`manifest template retained ${placeholder}`);
|
|
}
|
|
return output;
|
|
}
|
|
|
|
function validateManifest(manifest, expected) {
|
|
const documents = parseAllDocuments(manifest);
|
|
const errors = documents.flatMap((document) => document.errors);
|
|
if (errors.length > 0) throw new Error(`rendered manifest is invalid YAML: ${errors[0].message}`);
|
|
const objects = documents.map((document) => document.toJSON()).filter((value) => value !== null).map((value, index) => record(value, `manifest[${index}]`));
|
|
const deployment = objects.find((item) => item.kind === "Deployment" && item.metadata?.name === "sub2rank");
|
|
const service = objects.find((item) => item.kind === "Service" && item.metadata?.name === "sub2rank");
|
|
const configMap = objects.find((item) => item.kind === "ConfigMap" && item.metadata?.name === "sub2rank-config");
|
|
if (deployment === undefined || service === undefined || configMap === undefined) throw new Error("rendered manifest must contain the Sub2Rank Deployment, Service and ConfigMap");
|
|
if (deployment.spec?.template?.spec?.containers?.[0]?.image !== expected.digestRef) throw new Error("rendered Deployment image is not the expected digest reference");
|
|
if (deployment.spec?.template?.metadata?.annotations?.["unidesk.ai/source-commit"] !== expected.sourceCommit) throw new Error("rendered Deployment source commit annotation is incorrect");
|
|
if (deployment.spec?.template?.metadata?.annotations?.["unidesk.ai/sub2rank-config-sha256"] !== expected.configSha256) throw new Error("rendered Deployment config SHA annotation is incorrect");
|
|
if (configMap.binaryData?.["sub2rank.yaml"] !== expected.configBase64) throw new Error("rendered ConfigMap does not contain the exact source config");
|
|
}
|
|
|
|
function main() {
|
|
const sourceRoot = resolve(required(option("--source-root"), "--source-root"));
|
|
const sourceCommit = required(option("--source-commit"), "--source-commit");
|
|
const configPath = safePath(required(option("--config-path"), "--config-path"), "--config-path");
|
|
const metadataPath = resolve(required(option("--metadata"), "--metadata"));
|
|
const templateB64 = required(option("--manifest-template-b64"), "--manifest-template-b64");
|
|
const imageRepository = required(option("--image-repository"), "--image-repository");
|
|
const readUrl = required(option("--gitops-read-url"), "--gitops-read-url");
|
|
const writeUrl = required(option("--gitops-write-url"), "--gitops-write-url");
|
|
const branch = required(option("--gitops-branch"), "--gitops-branch");
|
|
const manifestPath = safePath(required(option("--manifest-path"), "--manifest-path"), "--manifest-path");
|
|
const releaseStatePath = safePath(required(option("--release-state-path"), "--release-state-path"), "--release-state-path");
|
|
const maxPushAttempts = Number(required(option("--max-push-attempts"), "--max-push-attempts"));
|
|
const authorName = required(option("--author-name"), "--author-name");
|
|
const authorEmail = required(option("--author-email"), "--author-email");
|
|
const worktree = resolve(required(option("--worktree"), "--worktree"));
|
|
if (!/^[0-9a-f]{40}$/u.test(sourceCommit)) throw new Error("--source-commit must be a full lowercase Git SHA");
|
|
if (!Number.isInteger(maxPushAttempts) || maxPushAttempts < 1 || maxPushAttempts > 5) throw new Error("--max-push-attempts must be an integer from 1 to 5");
|
|
if (run("git", ["rev-parse", "HEAD"], sourceRoot).stdout.trim() !== sourceCommit) throw new Error("source checkout does not match --source-commit");
|
|
|
|
const configText = readFileSync(resolve(sourceRoot, configPath), "utf8");
|
|
const appConfig = record(Bun.YAML.parse(configText), configPath);
|
|
if (appConfig.kind !== "Sub2Rank") throw new Error(`${configPath}.kind must be Sub2Rank`);
|
|
const lottery = record(appConfig.lottery, `${configPath}.lottery`);
|
|
const automaticCredit = record(lottery.automaticCredit, `${configPath}.lottery.automaticCredit`);
|
|
if (typeof automaticCredit.enabled !== "boolean" || !new Set(["dry-run", "live"]).has(automaticCredit.mode)) throw new Error(`${configPath}.lottery.automaticCredit must declare enabled and mode`);
|
|
const configBase64 = Buffer.from(configText, "utf8").toString("base64");
|
|
const configSha256 = sha256(configText);
|
|
|
|
const metadata = record(JSON.parse(readFileSync(metadataPath, "utf8")), metadataPath);
|
|
const digest = required(metadata["containerimage.digest"], `${metadataPath}.containerimage.digest`);
|
|
if (!/^sha256:[0-9a-f]{64}$/u.test(digest)) throw new Error("BuildKit metadata digest is invalid");
|
|
const digestRef = `${imageRepository}@${digest}`;
|
|
const template = Buffer.from(templateB64, "base64").toString("utf8");
|
|
const manifest = replaceAllRequired(template, [
|
|
[placeholders.image, digestRef],
|
|
[placeholders.configBase64, configBase64],
|
|
[placeholders.configSha256, configSha256],
|
|
[placeholders.sourceCommit, sourceCommit],
|
|
]);
|
|
validateManifest(manifest, { digestRef, sourceCommit, configSha256, configBase64 });
|
|
|
|
rmSync(worktree, { recursive: true, force: true });
|
|
run("git", ["clone", "--no-checkout", readUrl, worktree], sourceRoot);
|
|
const fetched = run("git", ["fetch", "origin", branch], worktree, true).status === 0;
|
|
if (fetched) run("git", ["checkout", "-B", branch, `origin/${branch}`], worktree);
|
|
else {
|
|
run("git", ["checkout", "--orphan", branch], worktree);
|
|
run("git", ["rm", "-rf", "."], worktree, true);
|
|
}
|
|
|
|
const targetPath = resolve(worktree, manifestPath);
|
|
const statePath = resolve(worktree, releaseStatePath);
|
|
if (!targetPath.startsWith(`${worktree}/`) || !statePath.startsWith(`${worktree}/`)) throw new Error("GitOps output path escaped the worktree");
|
|
mkdirSync(dirname(targetPath), { recursive: true });
|
|
writeFileSync(targetPath, manifest, "utf8");
|
|
mkdirSync(dirname(statePath), { recursive: true });
|
|
writeFileSync(statePath, `${JSON.stringify({
|
|
version: 1,
|
|
kind: "Sub2RankReleaseState",
|
|
service: "sub2rank",
|
|
sourceCommit,
|
|
configSha256,
|
|
digest,
|
|
digestRef,
|
|
manifestPath,
|
|
automaticCredit: { enabled: automaticCredit.enabled, mode: automaticCredit.mode },
|
|
}, null, 2)}\n`, "utf8");
|
|
|
|
run("git", ["config", "user.name", authorName], worktree);
|
|
run("git", ["config", "user.email", authorEmail], worktree);
|
|
run("git", ["add", "--", manifestPath, releaseStatePath], worktree);
|
|
const changed = run("git", ["diff", "--cached", "--quiet"], worktree, true).status !== 0;
|
|
if (changed) run("git", ["commit", "-m", `sub2rank: deploy ${sourceCommit.slice(0, 12)}`], worktree);
|
|
run("git", ["remote", "set-url", "origin", writeUrl], worktree);
|
|
|
|
let pushAttempts = 0;
|
|
if (changed) {
|
|
let pushed = false;
|
|
for (let attempt = 1; attempt <= maxPushAttempts; attempt += 1) {
|
|
pushAttempts = attempt;
|
|
if (run("git", ["push", "origin", `HEAD:refs/heads/${branch}`], worktree, true).status === 0) {
|
|
pushed = true;
|
|
break;
|
|
}
|
|
run("git", ["fetch", "origin", branch], worktree);
|
|
const rebase = run("git", ["rebase", `origin/${branch}`], worktree, true);
|
|
if (rebase.status !== 0) {
|
|
run("git", ["rebase", "--abort"], worktree, true);
|
|
throw new Error(`GitOps rebase failed after push attempt ${attempt}`);
|
|
}
|
|
}
|
|
if (!pushed) throw new Error(`GitOps push failed after ${maxPushAttempts} attempts`);
|
|
}
|
|
const gitopsCommit = run("git", ["rev-parse", "HEAD"], worktree).stdout.trim();
|
|
const remoteHead = run("git", ["ls-remote", writeUrl, `refs/heads/${branch}`], worktree).stdout.trim().split(/\s+/u)[0] ?? "";
|
|
if (remoteHead !== gitopsCommit) throw new Error("GitOps remote branch did not converge to the published commit");
|
|
process.stdout.write(`${JSON.stringify({
|
|
ok: true,
|
|
phase: "gitops-publish",
|
|
status: "built",
|
|
imageStatus: "built",
|
|
sourceCommit,
|
|
runtimeSourceCommit: sourceCommit,
|
|
configSha256,
|
|
automaticCredit: { enabled: automaticCredit.enabled, mode: automaticCredit.mode },
|
|
digest,
|
|
digestRef,
|
|
gitopsCommit,
|
|
changed,
|
|
pushAttempts,
|
|
valuesPrinted: false,
|
|
})}\n`);
|
|
}
|
|
|
|
if (!process.execArgv.includes("--check")) main();
|