confctl 2.2.2 → 3.0.0

data/lib/confctl/inputs/commit_message.rb

@@ -0,0 +1,125 @@
+require 'confctl/git_repo_mirror'
+
+module ConfCtl
+  module Inputs
+    class CommitMessage
+      def self.build(changes:, changelog:, downgrade: false, action: :update)
+        raise ArgumentError, 'no changes' if changes.nil? || changes.empty?
+
+        title = build_title(changes, action)
+
+        body =
+          if changelog
+            build_changelog_body(changes, downgrade)
+          else
+            build_plain_body(changes)
+          end
+
+        "#{title}\n\n#{body}".strip
+      end
+
+      def self.build_plain_body(changes)
+        changes.each_with_object(+'') do |ch, body|
+          body << change_summary(ch)
+        end
+      end
+
+      def self.build_changelog_body(changes, downgrade)
+        group_changes(changes).map do |group|
+          build_changelog_group(group, downgrade).rstrip
+        end.join("\n\n")
+      end
+
+      def self.build_changelog_group(group, downgrade)
+        body = +''
+
+        group.each do |ch|
+          body << change_summary(ch)
+        end
+
+        reference = group.first
+        return body unless reference.url && reference.old_rev && reference.new_rev
+        return body if reference.old_rev == reference.new_rev
+
+        from = downgrade ? reference.new_rev : reference.old_rev
+        to = downgrade ? reference.old_rev : reference.new_rev
+
+        begin
+          mirror = ConfCtl::GitRepoMirror.new(reference.url, quiet: true)
+          mirror.setup
+          body << mirror.log(from, to, opts: ['--oneline'])
+        rescue StandardError => e
+          body << "(changelog unavailable: #{e})"
+        end
+
+        body
+      end
+
+      def self.group_changes(changes)
+        groups = []
+        group_indexes = {}
+
+        changes.each do |ch|
+          key = group_key(ch)
+
+          if key && group_indexes.has_key?(key)
+            groups[group_indexes[key]] << ch
+          else
+            group_indexes[key] = groups.length if key
+            groups << [ch]
+          end
+        end
+
+        groups
+      end
+
+      def self.group_key(change)
+        url = normalize_url(change.url)
+        return nil if url.nil?
+
+        [url, change.old_rev, change.new_rev]
+      end
+
+      def self.change_summary(change)
+        "#{change.name}: #{change.old_rev ? change.old_short_rev : 'set'} -> #{change.new_short_rev || '-'}\n"
+      end
+
+      def self.build_title(changes, action)
+        names = changes.map(&:name).sort
+        verb = action == :set ? 'set' : 'update'
+        title = "inputs: #{verb} #{names.join(', ')}"
+        short_rev = common_short_rev(changes)
+
+        short_rev ? "#{title} to #{short_rev}" : title
+      end
+
+      def self.common_short_rev(changes)
+        reference = changes.first
+
+        return nil if reference.new_rev.nil? || reference.new_short_rev.nil?
+        return nil if changes.any? { |ch| ch.new_rev != reference.new_rev }
+        return reference.new_short_rev if changes.length == 1
+        return nil unless same_sources?(changes, reference.url)
+
+        reference.new_short_rev
+      end
+
+      def self.same_sources?(changes, reference_url)
+        normalized_reference = normalize_url(reference_url)
+        return false if normalized_reference.nil?
+
+        changes.all? { |ch| normalize_url(ch.url) == normalized_reference }
+      end
+
+      def self.normalize_url(url)
+        return nil if url.nil?
+
+        url.sub(%r{/+\z}, '')
+      end
+
+      private_class_method :build_plain_body, :build_changelog_body, :build_changelog_group,
+                           :group_changes, :group_key, :change_summary, :build_title,
+                           :common_short_rev, :same_sources?, :normalize_url
+    end
+  end
+end

data/lib/confctl/inputs/git_commit.rb

@@ -0,0 +1,17 @@
+module ConfCtl
+  module Inputs
+    class GitCommit
+      def self.commit!(conf_dir:, message:, editor:, files:)
+        args = %w[git commit]
+        args << '-e' if editor && $stdout.tty?
+        args << '-m' << message
+        args.concat(files)
+
+        Dir.chdir(conf_dir) do
+          ok = Kernel.system(*args)
+          raise 'git commit failed' unless ok
+        end
+      end
+    end
+  end
+end

data/lib/confctl/inputs/nix_output_guard.rb

@@ -0,0 +1,37 @@
+module ConfCtl
+  module Inputs
+    module NixOutputGuard
+      GITHUB_API_CACHE_FALLBACK =
+        %r{unable to download 'https://api\.github\.com/.*using cached version}m
+      GITHUB_RATE_LIMIT = /rate limit exceeded/i
+
+      def self.check!(result)
+        output = [result&.stdout, result&.stderr].compact.join("\n")
+        return unless github_api_cache_fallback?(output)
+
+        if github_rate_limit?(output)
+          raise ConfCtl::Error, <<~MSG.strip
+            Nix could not refresh GitHub input metadata because the GitHub API rate limit was exceeded.
+            It used a cached version instead, so the selected input may not be the latest revision.
+            Configure a GitHub token in Nix access-tokens or retry later.
+          MSG
+        end
+
+        raise ConfCtl::Error, <<~MSG.strip
+          Nix could not refresh GitHub input metadata and used a cached version instead.
+          The selected input may not be the latest revision; retry after the GitHub API is reachable.
+        MSG
+      end
+
+      def self.github_api_cache_fallback?(output)
+        output.match?(GITHUB_API_CACHE_FALLBACK)
+      end
+
+      def self.github_rate_limit?(output)
+        output.match?(GITHUB_RATE_LIMIT)
+      end
+
+      private_class_method :github_api_cache_fallback?, :github_rate_limit?
+    end
+  end
+end

data/lib/confctl/inputs/setter.rb

@@ -0,0 +1,179 @@
+require 'confctl/flake_lock'
+require 'confctl/flake_lock_diff'
+require 'confctl/inputs/commit_message'
+require 'confctl/inputs/git_commit'
+require 'confctl/inputs/nix_output_guard'
+require 'confctl/system_command'
+require 'fileutils'
+require 'json'
+require 'securerandom'
+
+module ConfCtl
+  module Inputs
+    class Setter
+      def self.run!(conf_dir:, inputs:, rev:, commit:, changelog:, downgrade:, editor:)
+        raise ArgumentError, 'inputs empty' if inputs.nil? || inputs.empty?
+
+        lock_path = File.join(conf_dir, 'flake.lock')
+        unless File.exist?(lock_path)
+          raise ConfCtl::Error, 'flake.lock missing; run confctl inputs update first'
+        end
+
+        old_lock = ConfCtl::FlakeLock.load(lock_path)
+        old_lock_data = JSON.parse(File.read(lock_path))
+
+        saved_original = {}
+        override_urls = {}
+
+        inputs.each do |input|
+          node_id = resolve_node_id(old_lock_data, input)
+          saved_original[input] = deep_dup(old_lock_data.dig('nodes', node_id, 'original'))
+
+          input_info = old_lock.input_info(input)
+          type = input_info[:type]
+          unless %w[github git].include?(type)
+            raise ConfCtl::Error, "input '#{input}' has unsupported type '#{type}' for set"
+          end
+
+          override_urls[input] = build_override_url(input_info, rev)
+        end
+
+        apply_inputs!(conf_dir, inputs, override_urls, saved_original, lock_path)
+
+        new_lock = ConfCtl::FlakeLock.load(lock_path)
+        changes = ConfCtl::FlakeLockDiff.diff(old_lock, new_lock, inputs: inputs)
+
+        return { changed: false, changes: [] } if changes.empty?
+
+        if commit
+          msg = ConfCtl::Inputs::CommitMessage.build(
+            changes: changes,
+            changelog: changelog,
+            downgrade: downgrade,
+            action: :set
+          )
+          ConfCtl::Inputs::GitCommit.commit!(
+            conf_dir: conf_dir,
+            message: msg,
+            editor: editor,
+            files: ['flake.lock']
+          )
+        end
+
+        { changed: true, changes: changes }
+      end
+
+      def self.resolve_node_id(lock_data, input_name)
+        node_id = lock_data.dig('nodes', 'root', 'inputs', input_name)
+
+        return node_id if node_id.is_a?(String)
+        return node_id[0] if node_id.is_a?(Array) && node_id[0].is_a?(String)
+
+        raise ConfCtl::Error, "unknown input '#{input_name}'"
+      end
+
+      def self.build_override_url(input_info, rev)
+        locked = input_info[:locked] || {}
+        original = input_info[:original] || {}
+
+        case input_info[:type]
+        when 'github'
+          owner = locked['owner'] || original['owner']
+          repo = locked['repo'] || original['repo']
+          dir = locked['dir'] || original['dir']
+          raise ConfCtl::Error, 'missing github owner or repo' unless owner && repo
+
+          url = "github:#{owner}/#{repo}/#{rev}"
+          url += "?dir=#{dir}" if dir
+          url
+        when 'git'
+          url = locked['url'] || original['url']
+          raise ConfCtl::Error, 'missing git url' unless url
+
+          url = url.sub(/^git\+/, '')
+          separator = url.include?('?') ? '&' : '?'
+          "git+#{url}#{separator}rev=#{rev}"
+        else
+          raise ConfCtl::Error, "unsupported input type '#{input_info[:type]}'"
+        end
+      end
+
+      def self.run_nix_flake_lock!(conf_dir, input, override_url, tmpfile)
+        cmd = ConfCtl::SystemCommand.new
+        extra_experimental = false
+
+        loop do
+          args = ['nix']
+          if extra_experimental
+            args << '--extra-experimental-features' << 'nix-command'
+            args << '--extra-experimental-features' << 'flakes'
+          end
+          args << 'flake' << 'lock'
+          args << '--update-input' << input
+          args << '--override-input' << input << override_url
+          args << '--output-lock-file' << tmpfile
+
+          begin
+            result = Dir.chdir(conf_dir) { cmd.run(*args) }
+            ConfCtl::Inputs::NixOutputGuard.check!(result)
+            break
+          rescue TTY::Command::ExitError => e
+            if !extra_experimental && experimental_error?(e.message)
+              extra_experimental = true
+              next
+            end
+
+            raise
+          end
+        end
+      end
+
+      def self.experimental_error?(message)
+        message.match?(/experimental/i) && message.match?(/nix-command|flakes/i)
+      end
+
+      def self.apply_inputs!(conf_dir, inputs, override_urls, saved_original, lock_path)
+        inputs.each do |input|
+          tmpfile = build_tmp_lock_path(conf_dir)
+
+          begin
+            run_nix_flake_lock!(conf_dir, input, override_urls[input], tmpfile)
+
+            tmp_lock_data = JSON.parse(File.read(tmpfile))
+            inputs.each do |name|
+              node_id = resolve_node_id(tmp_lock_data, name)
+              node = tmp_lock_data.dig('nodes', node_id) || {}
+              original = saved_original[name]
+
+              if original.nil?
+                node.delete('original')
+              else
+                node['original'] = deep_dup(original)
+              end
+
+              tmp_lock_data['nodes'][node_id] = node
+            end
+
+            File.write(tmpfile, "#{JSON.pretty_generate(tmp_lock_data)}\n")
+            File.rename(tmpfile, lock_path)
+          ensure
+            FileUtils.rm_f(tmpfile) if tmpfile && File.exist?(tmpfile)
+          end
+        end
+      end
+
+      def self.deep_dup(obj)
+        return nil if obj.nil?
+
+        Marshal.load(Marshal.dump(obj))
+      end
+
+      def self.build_tmp_lock_path(conf_dir)
+        File.join(conf_dir, "flake.lock.tmp-#{Process.pid}-#{SecureRandom.hex(6)}")
+      end
+
+      private_class_method :resolve_node_id, :build_override_url, :run_nix_flake_lock!,
+                           :experimental_error?, :apply_inputs!, :deep_dup, :build_tmp_lock_path
+    end
+  end
+end

data/lib/confctl/inputs/updater.rb

@@ -0,0 +1,76 @@
+require 'confctl/flake_lock'
+require 'confctl/flake_lock_diff'
+require 'confctl/inputs/commit_message'
+require 'confctl/inputs/git_commit'
+require 'confctl/inputs/nix_output_guard'
+require 'confctl/system_command'
+
+module ConfCtl
+  module Inputs
+    class Updater
+      def self.run!(conf_dir:, inputs:, commit:, changelog:, downgrade:, editor:)
+        raise ArgumentError, 'inputs empty' if inputs.nil? || inputs.empty?
+
+        lock_path = File.join(conf_dir, 'flake.lock')
+        old_lock = ConfCtl::FlakeLock.load_optional(lock_path)
+
+        run_nix_flake_update!(conf_dir, inputs)
+
+        new_lock = ConfCtl::FlakeLock.load(lock_path)
+        changes = ConfCtl::FlakeLockDiff.diff(old_lock, new_lock, inputs: inputs)
+
+        return { changed: false, changes: [] } if changes.empty?
+
+        if commit
+          msg = ConfCtl::Inputs::CommitMessage.build(
+            changes: changes,
+            changelog: changelog,
+            downgrade: downgrade
+          )
+          ConfCtl::Inputs::GitCommit.commit!(
+            conf_dir: conf_dir,
+            message: msg,
+            editor: editor,
+            files: ['flake.lock']
+          )
+        end
+
+        { changed: true, changes: changes }
+      end
+
+      def self.run_nix_flake_update!(conf_dir, inputs)
+        cmd = ConfCtl::SystemCommand.new
+        extra_experimental = false
+
+        loop do
+          args = ['nix']
+          if extra_experimental
+            args << '--extra-experimental-features' << 'nix-command'
+            args << '--extra-experimental-features' << 'flakes'
+          end
+          args << 'flake' << 'update'
+          args.concat(inputs) if inputs
+
+          begin
+            result = Dir.chdir(conf_dir) { cmd.run(*args) }
+            ConfCtl::Inputs::NixOutputGuard.check!(result)
+            break
+          rescue TTY::Command::ExitError => e
+            if !extra_experimental && experimental_error?(e.message)
+              extra_experimental = true
+              next
+            end
+
+            raise
+          end
+        end
+      end
+
+      def self.experimental_error?(message)
+        message.match?(/experimental/i) && message.match?(/nix-command|flakes/i)
+      end
+
+      private_class_method :run_nix_flake_update!, :experimental_error?
+    end
+  end
+end

data/lib/confctl/inputs.rb

@@ -0,0 +1,5 @@
+module ConfCtl
+  module Inputs; end
+end
+
+require_rel 'inputs'

data/lib/confctl/inputs_info.rb

@@ -0,0 +1,50 @@
+require 'json'
+
+module ConfCtl
+  class InputsInfo
+    KEYS = %w[input url rev shortRev lastModified].freeze
+
+    def self.parse(json)
+      normalize(JSON.parse(json))
+    rescue JSON::ParserError => e
+      raise Error, "unable to parse inputs info: #{e.message}"
+    end
+
+    def self.normalize(hash)
+      return nil unless hash.is_a?(Hash)
+
+      hash.each_with_object({}) do |(role, info), acc|
+        acc[role.to_s] = normalize_info(info)
+      end
+    end
+
+    def self.normalize_info(info)
+      case info
+      when String
+        rev = info
+        data = { 'rev' => rev, 'shortRev' => rev && rev[0, 8] }
+        data.compact
+      when Hash
+        normalized = {}
+
+        info.each do |k, v|
+          key = k.to_s
+          case key
+          when 'input', 'url', 'rev', 'shortRev', 'lastModified'
+            normalized[key] = v
+          when 'short_rev'
+            normalized['shortRev'] = v
+          end
+        end
+
+        if normalized['shortRev'].nil? && normalized['rev']
+          normalized['shortRev'] = normalized['rev'][0, 8]
+        end
+
+        normalized
+      else
+        {}
+      end
+    end
+  end
+end

data/lib/confctl/line_buffer.rb

@@ -29,7 +29,7 @@ module ConfCtl
       return if nl.nil?
 
       line = buffer[0..nl]
-      @buffer = buffer[nl + 1..]
+      @buffer = buffer[(nl + 1)..]
       line
     end
 

data/lib/confctl/machine.rb

@@ -4,8 +4,7 @@ module ConfCtl
       :carrier,
       :name,
       :alias,
-      :attribute,
-      keyword_init: true
+      :attribute
     )
 
     # @return [String]
@@ -17,6 +16,9 @@ module ConfCtl
     # @return [Boolean]
     attr_reader :managed
 
+    # @return [String, nil]
+    attr_reader :key
+
     # @return [String]
     attr_reader :spin
 
@@ -47,6 +49,7 @@ module ConfCtl
       @name = opts['name']
       @safe_name = name.gsub('/', ':')
       @managed = meta['managed']
+      @key = opts['key'] || opts['machineKey'] || opts['flakeKey']
       @spin = meta['spin']
       @is_carrier = meta.fetch('carrier', {}).fetch('enable', false)
       @carrier_name = opts['carrier']
@@ -94,10 +97,18 @@ module ConfCtl
       meta.fetch('host', {}).fetch('target', name)
     end
 
+    def target_port
+      meta.fetch('host', {}).fetch('port', 22).to_i
+    end
+
     def localhost?
       target_host == 'localhost'
     end
 
+    def runnable?
+      !carried? && !target_host.nil?
+    end
+
     # @return [String] path to nix-env managed profile
     def profile
       if carried?
@@ -112,7 +123,7 @@ module ConfCtl
         eq = v.index('=')
         raise "'#{v}' is not a valid nix path entry " if eq.nil?
 
-        [v[0..eq - 1], v[eq + 1..]]
+        [v[0..(eq - 1)], v[(eq + 1)..]]
       end
     end
 
@@ -150,6 +161,8 @@ module ConfCtl
           end
 
         when 'builderCommands', 'machineCommands'
+          next if type == 'machineCommands' && !runnable?
+
           checks.each do |cmd|
             health_checks << HealthChecks::RunCommand.new(
               self,
@@ -171,6 +184,8 @@ module ConfCtl
         get(meta, key.split('.'))
       elsif key == 'name'
         name
+      elsif %w[key machineKey flakeKey].include?(key)
+        @key
       elsif key == 'checks'
         health_checks.length
       else

data/lib/confctl/machine_control.rb

@@ -1,4 +1,5 @@
 require 'etc'
+require 'shellwords'
 
 module ConfCtl
   class MachineControl
@@ -158,7 +159,7 @@ module ConfCtl
         if machine.localhost?
           command
         else
-          ssh_args + command
+          ssh_args + [Shellwords.join(command)]
         end
 
       cmd.method(method).call(*args, **kwargs, &)
@@ -174,7 +175,12 @@ module ConfCtl
     end
 
     def ssh_args
-      ['ssh', '-l', 'root'] + extra_ssh_opts + [machine.target_host]
+      ret = ['ssh']
+      ssh_config = ENV.fetch('CONFCTL_SSH_CONFIG', nil)
+      ret += ['-F', ssh_config] if ssh_config && !ssh_config.empty?
+      ret += ['-l', 'root']
+      ret += ['-p', machine.target_port.to_s] if machine.target_port != 22
+      ret + extra_ssh_opts + [machine.target_host]
     end
   end
 end

data/lib/confctl/machine_list.rb

@@ -64,7 +64,7 @@ module ConfCtl
 
     # @return [MachineList]
     def runnable
-      select { |_host, machine| !machine.carried? && machine.target_host }
+      select { |_host, machine| machine.runnable? }
     end
 
     # @param host [String]
@@ -99,7 +99,7 @@ module ConfCtl
       checks = []
 
       machines.each_value do |machine|
-        next if machine.carried?
+        next unless machine.runnable?
 
         checks.concat(machine.health_checks)
       end