confctl 2.2.2 → 3.0.0

data/spec/inputs/commit_message_spec.rb

@@ -0,0 +1,205 @@
+# frozen_string_literal: true
+
+require 'confctl/flake_lock_diff'
+require 'confctl/inputs/commit_message'
+
+RSpec.describe ConfCtl::Inputs::CommitMessage do
+  def build_change(name:, old_rev:, new_rev:, url:)
+    ConfCtl::FlakeLockDiff::Change.new(
+      name: name,
+      old_info: old_rev ? { rev: old_rev, short_rev: old_rev[0, 8], url: url } : nil,
+      new_info: { rev: new_rev, short_rev: new_rev[0, 8], url: url }
+    )
+  end
+
+  def expect_git_log(url:, from:, to:, output:)
+    mirror = instance_double(ConfCtl::GitRepoMirror)
+
+    expect(ConfCtl::GitRepoMirror).to receive(:new).with(url, quiet: true).and_return(mirror)
+    expect(mirror).to receive(:setup)
+    expect(mirror).to receive(:log).with(from, to, opts: ['--oneline']).and_return(output)
+  end
+
+  it 'includes the new revision in title for a single input' do
+    changes = [
+      build_change(
+        name: 'nixpkgs',
+        old_rev: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+        new_rev: 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+        url: 'https://github.com/NixOS/nixpkgs'
+      )
+    ]
+
+    title = described_class.build(changes: changes, changelog: false).lines.first.chomp
+
+    expect(title).to eq('inputs: update nixpkgs to bbbbbbbb')
+  end
+
+  it 'includes the new revision in title for multiple inputs from the same source' do
+    changes = [
+      build_change(
+        name: 'nixpkgsStable',
+        old_rev: '1111111111111111111111111111111111111111',
+        new_rev: '2222222222222222222222222222222222222222',
+        url: 'https://github.com/NixOS/nixpkgs'
+      ),
+      build_change(
+        name: 'nixpkgsUnstable',
+        old_rev: '3333333333333333333333333333333333333333',
+        new_rev: '2222222222222222222222222222222222222222',
+        url: 'https://github.com/NixOS/nixpkgs/'
+      )
+    ]
+
+    title = described_class.build(changes: changes, changelog: false).lines.first.chomp
+
+    expect(title).to eq('inputs: update nixpkgsStable, nixpkgsUnstable to 22222222')
+  end
+
+  it 'keeps no-changelog input summaries compact' do
+    changes = [
+      build_change(
+        name: 'nixpkgsStable',
+        old_rev: '1111111111111111111111111111111111111111',
+        new_rev: '2222222222222222222222222222222222222222',
+        url: 'https://github.com/NixOS/nixpkgs'
+      ),
+      build_change(
+        name: 'nixpkgsUnstable',
+        old_rev: '3333333333333333333333333333333333333333',
+        new_rev: '2222222222222222222222222222222222222222',
+        url: 'https://github.com/NixOS/nixpkgs'
+      )
+    ]
+
+    message = described_class.build(changes: changes, changelog: false)
+
+    expect(message).to eq(<<~MSG.strip)
+      inputs: update nixpkgsStable, nixpkgsUnstable to 22222222
+
+      nixpkgsStable: 11111111 -> 22222222
+      nixpkgsUnstable: 33333333 -> 22222222
+    MSG
+  end
+
+  it 'groups changelog for inputs with the same source and same revision change' do
+    old_rev = '1111111111111111111111111111111111111111'
+    new_rev = '2222222222222222222222222222222222222222'
+    url = 'https://github.com/vpsfreecz/vpsadminos'
+    log = <<~LOG.strip
+      git log for #{old_rev}..#{new_rev}
+      > 222222222 shared change
+    LOG
+
+    changes = [
+      build_change(
+        name: 'vpsadminosStaging',
+        old_rev: old_rev,
+        new_rev: new_rev,
+        url: url
+      ),
+      build_change(
+        name: 'vpsadminosProduction',
+        old_rev: old_rev,
+        new_rev: new_rev,
+        url: "#{url}/"
+      )
+    ]
+
+    expect_git_log(url: url, from: old_rev, to: new_rev, output: log)
+
+    message = described_class.build(changes: changes, changelog: true)
+
+    expect(message).to eq(<<~MSG.strip)
+      inputs: update vpsadminosProduction, vpsadminosStaging to 22222222
+
+      vpsadminosStaging: 11111111 -> 22222222
+      vpsadminosProduction: 11111111 -> 22222222
+      git log for #{old_rev}..#{new_rev}
+      > 222222222 shared change
+    MSG
+  end
+
+  it 'keeps separate changelog groups for inputs with different old revisions' do
+    old_staging_rev = '1111111111111111111111111111111111111111'
+    old_os_staging_rev = '3333333333333333333333333333333333333333'
+    new_rev = '2222222222222222222222222222222222222222'
+    url = 'https://github.com/vpsfreecz/vpsadminos'
+    staging_log = <<~LOG.strip
+      git log for #{old_staging_rev}..#{new_rev}
+      > 222222222 staging change
+    LOG
+    os_staging_log = <<~LOG.strip
+      git log for #{old_os_staging_rev}..#{new_rev}
+      > 222222222 os staging change
+    LOG
+
+    changes = [
+      build_change(
+        name: 'vpsadminosStaging',
+        old_rev: old_staging_rev,
+        new_rev: new_rev,
+        url: url
+      ),
+      build_change(
+        name: 'vpsadminosProduction',
+        old_rev: old_os_staging_rev,
+        new_rev: new_rev,
+        url: url
+      )
+    ]
+
+    expect_git_log(url: url, from: old_staging_rev, to: new_rev, output: staging_log)
+    expect_git_log(url: url, from: old_os_staging_rev, to: new_rev, output: os_staging_log)
+
+    message = described_class.build(changes: changes, changelog: true)
+
+    expect(message).to eq(<<~MSG.strip)
+      inputs: update vpsadminosProduction, vpsadminosStaging to 22222222
+
+      vpsadminosStaging: 11111111 -> 22222222
+      git log for #{old_staging_rev}..#{new_rev}
+      > 222222222 staging change
+
+      vpsadminosProduction: 33333333 -> 22222222
+      git log for #{old_os_staging_rev}..#{new_rev}
+      > 222222222 os staging change
+    MSG
+  end
+
+  it 'does not include the revision in title for changes from different sources' do
+    changes = [
+      build_change(
+        name: 'nixpkgs',
+        old_rev: '4444444444444444444444444444444444444444',
+        new_rev: '5555555555555555555555555555555555555555',
+        url: 'https://github.com/NixOS/nixpkgs'
+      ),
+      build_change(
+        name: 'vpsadminos',
+        old_rev: '6666666666666666666666666666666666666666',
+        new_rev: '5555555555555555555555555555555555555555',
+        url: 'https://github.com/vpsfreecz/vpsadminos'
+      )
+    ]
+
+    title = described_class.build(changes: changes, changelog: false).lines.first.chomp
+
+    expect(title).to eq('inputs: update nixpkgs, vpsadminos')
+  end
+
+  it 'includes revision in title for set action' do
+    changes = [
+      build_change(
+        name: 'vpsadminos',
+        old_rev: nil,
+        new_rev: '7777777777777777777777777777777777777777',
+        url: 'https://github.com/vpsfreecz/vpsadminos'
+      )
+    ]
+
+    title = described_class.build(changes: changes, changelog: false, action: :set).lines.first.chomp
+
+    expect(title).to eq('inputs: set vpsadminos to 77777777')
+  end
+end

data/spec/inputs/nix_cached_fallback_spec.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'confctl/exceptions'
+require 'confctl/inputs/setter'
+require 'confctl/inputs/updater'
+require 'tmpdir'
+require 'tty-command'
+
+RSpec.describe 'Nix cached fallback handling' do
+  def cached_fallback_result
+    stderr = <<~ERR
+      warning: error: unable to download 'https://api.github.com/repos/vpsfreecz/vpsadminos/commits/staging': HTTP error 403
+      {"message":"API rate limit exceeded"}; using cached version
+    ERR
+
+    TTY::Command::Result.new(0, '', stderr)
+  end
+
+  let(:cmd) { instance_double(TTY::Command) }
+
+  before do
+    allow(ConfCtl::SystemCommand).to receive(:new).and_return(cmd)
+    allow(cmd).to receive(:run).and_return(cached_fallback_result)
+  end
+
+  it 'fails flake updates that used cached GitHub metadata' do
+    Dir.mktmpdir do |dir|
+      expect do
+        ConfCtl::Inputs::Updater.send(:run_nix_flake_update!, dir, ['vpsadminos'])
+      end.to raise_error(ConfCtl::Error, /GitHub API rate limit was exceeded/)
+    end
+  end
+
+  it 'fails flake locks that used cached GitHub metadata' do
+    Dir.mktmpdir do |dir|
+      tmpfile = File.join(dir, 'flake.lock.tmp')
+
+      expect do
+        ConfCtl::Inputs::Setter.send(
+          :run_nix_flake_lock!,
+          dir,
+          'vpsadminos',
+          'github:vpsfreecz/vpsadminos/staging',
+          tmpfile
+        )
+      end.to raise_error(ConfCtl::Error, /GitHub API rate limit was exceeded/)
+    end
+  end
+end

data/spec/inputs/nix_output_guard_spec.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'confctl/exceptions'
+require 'confctl/inputs/nix_output_guard'
+require 'tty-command'
+
+RSpec.describe ConfCtl::Inputs::NixOutputGuard do
+  def command_result(stderr)
+    TTY::Command::Result.new(0, '', stderr)
+  end
+
+  it 'raises when Nix falls back to cached GitHub metadata after rate limiting' do
+    stderr = <<~ERR
+      warning: error: unable to download 'https://api.github.com/repos/vpsfreecz/vpsadminos/commits/staging': HTTP error 403
+
+             response body:
+
+             {"message":"API rate limit exceeded for 192.0.2.1."}; using cached version
+    ERR
+
+    expect do
+      described_class.check!(command_result(stderr))
+    end.to raise_error(ConfCtl::Error, /GitHub API rate limit was exceeded/)
+  end
+
+  it 'raises when Nix falls back to cached GitHub metadata for another API error' do
+    stderr = <<~ERR
+      warning: error: unable to download 'https://api.github.com/repos/example/project/commits/main': HTTP error 503
+      ; using cached version
+    ERR
+
+    expect do
+      described_class.check!(command_result(stderr))
+    end.to raise_error(ConfCtl::Error, /used a cached version/)
+  end
+
+  it 'does not raise for unrelated Nix warnings' do
+    stderr = "warning: '--update-input' is a deprecated alias for 'flake update'\n"
+
+    expect do
+      described_class.check!(command_result(stderr))
+    end.not_to raise_error
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+$:.unshift(File.expand_path('../lib', __dir__))
+
+RSpec.configure do |config|
+  config.disable_monkey_patching!
+  config.expect_with :rspec do |expectations|
+    expectations.syntax = :expect
+  end
+end
+
+Dir[File.join(__dir__, 'support', '*.rb')].each { |f| require f }

data/spec/support/cli_helper.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'open3'
+
+module CliHelper
+  Result = Struct.new(:out, :err, :status) do
+    def success?
+      status.success?
+    end
+  end
+
+  def repo_root
+    File.expand_path('../..', __dir__)
+  end
+
+  def confctl_bin
+    ENV.fetch('CONFCTL_BIN', File.join(repo_root, 'bin', 'confctl'))
+  end
+
+  def run_confctl(*, chdir:, env: {})
+    default_env = {
+      'CONFCTL_TTY' => '0',
+      'NO_COLOR' => '1',
+      'PAGER' => ''
+    }
+
+    out, err, status = Open3.capture3(default_env.merge(env), confctl_bin, *, chdir:)
+    Result.new(out, err, status)
+  end
+
+  def run_cmd(*, chdir:, env: {})
+    out, err, status = Open3.capture3(env, *, chdir:)
+    Result.new(out, err, status)
+  end
+
+  def init_git_repo(path)
+    run_cmd('git', 'init', chdir: path).tap do |r|
+      raise "git init failed: #{r.err}" unless r.success?
+    end
+    run_cmd('git', 'config', 'user.email', 'confctl-tests@example.invalid', chdir: path).tap do |r|
+      raise "git config user.email failed: #{r.err}" unless r.success?
+    end
+    run_cmd('git', 'config', 'user.name', 'confctl-tests', chdir: path).tap do |r|
+      raise "git config user.name failed: #{r.err}" unless r.success?
+    end
+  end
+
+  def git_commit_all(path, message)
+    run_cmd('git', 'add', '.', chdir: path).tap do |r|
+      raise "git add failed: #{r.err}" unless r.success?
+    end
+    run_cmd('git', 'commit', '-m', message, chdir: path).tap do |r|
+      raise "git commit failed: #{r.err}" unless r.success?
+    end
+  end
+end

data/test-runner.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd -- "$(dirname "$0")" && pwd)"
+cd "$ROOT"
+
+exec nix run .#test-runner -- "$@"

data/tests/all-tests.nix

@@ -0,0 +1,30 @@
+{
+  pkgs ? <nixpkgs>,
+  system ? builtins.currentSystem,
+  suiteArgs ? { },
+  testConfig ? { },
+  configuration ? null,
+  testFramework,
+}:
+let
+  nixpkgs = import pkgs { inherit system; };
+  lib = nixpkgs.lib;
+  testLib = testFramework.makeTestLib {
+    inherit
+      pkgs
+      system
+      lib
+      suiteArgs
+      testConfig
+      configuration
+      ;
+    suitePath = ./suite;
+  };
+in
+testLib.makeTests [
+  "carrier/deploy"
+  "carrier/netboot"
+  "deploy/flakes"
+  "deploy/swpins"
+  "auto_rollback"
+]

data/tests/make-test.nix

@@ -0,0 +1,15 @@
+testFn:
+{ testFramework, ... }@args:
+let
+  upstream = testFramework.makeTest testFn;
+  mergedExtraArgs = {
+    vpsadminos = testFramework.sourcePath;
+    confctlSrc = args.confctlSrc or null;
+    confctlPackage = args.confctlPackage or null;
+  }
+  // (args.extraArgs or { });
+  argsWithExtra = args // {
+    extraArgs = mergedExtraArgs;
+  };
+in
+upstream argsWithExtra

data/tests/runner/extensions/confctl_helpers.rb

@@ -0,0 +1,238 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+require 'json'
+require 'open3'
+
+module ConfctlTestHelpers
+  STORE_PATH_RE = %r{/nix/store/[0-9a-z]{32}-[^\s'"]+}
+
+  def confctl_setup!(bin:, src:, conf_dir:, home_dir:, nix_path: nil)
+    @confctl_bin = bin
+    @confctl_src = src
+    @conf_dir = conf_dir
+    @home_dir = home_dir
+    @nix_path = nix_path
+  end
+
+  def confctl_bin
+    @confctl_bin || raise('confctl_setup! must be called before confctl helpers are used')
+  end
+
+  def confctl_src
+    @confctl_src || raise('confctl_setup! must be called before confctl helpers are used')
+  end
+
+  def conf_dir
+    @conf_dir || raise('confctl_setup! must be called before confctl helpers are used')
+  end
+
+  def home_dir
+    @home_dir || raise('confctl_setup! must be called before confctl helpers are used')
+  end
+
+  def nix_path
+    @nix_path
+  end
+
+  def run_local(argv, chdir: nil, env: {})
+    kwargs = {}
+    kwargs[:chdir] = chdir if chdir
+    out, err, status = Open3.capture3(env, *argv, **kwargs)
+    [out, err, status]
+  end
+
+  def run_local!(argv, chdir: nil, env: {})
+    out, err, status = run_local(argv, chdir: chdir, env: env)
+
+    return [out, err] if status.success?
+
+    msg = []
+    msg << "Command failed: #{argv.join(' ')}"
+    msg << "Exit status: #{status.exitstatus}"
+    msg << "STDOUT:\n#{out}" unless out.empty?
+    msg << "STDERR:\n#{err}" unless err.empty?
+    raise msg.join("\n\n")
+  end
+
+  def prepare_fixture_dir!(path, template: 'example-flake')
+    FileUtils.rm_rf(path)
+    FileUtils.mkdir_p(path)
+
+    run_local!(['cp', '-r', "#{File.join(confctl_src, template)}/.", path])
+    run_local!(['chmod', '-R', 'u+w', path])
+
+    # Test fixtures regenerate local state such as swpins pins and channels.
+    # Drop any copied state from the repository template to keep runs deterministic.
+    %w[.bin .confctl .gems .man swpins].each do |dir|
+      FileUtils.rm_rf(File.join(path, dir))
+    end
+  end
+
+  def nix_escape_string(str)
+    str.gsub('\\', '\\\\').gsub('"', '\\"')
+  end
+
+  def write_admin_ssh_keys!(path, pubkey, admin_name: 'someone')
+    escaped_key = nix_escape_string(pubkey)
+
+    File.write(File.join(path, 'data/ssh-keys.nix'), <<~NIX)
+      rec {
+        admins = [ #{admin_name} ];
+
+        #{admin_name} = "#{escaped_key}";
+      }
+    NIX
+  end
+
+  def write_cluster_modules!(path, entries)
+    modules = entries.map { |v| "  ./#{v}" }.join("\n")
+
+    File.write(File.join(path, 'cluster/cluster.nix'), <<~NIX)
+      # This file is generated by confctl, changes will be lost
+      [
+      #{modules}
+      ]
+    NIX
+  end
+
+  def init_fixture_repo!(path, message: 'fixture: initial')
+    run_local!(%w[git init], chdir: path)
+    run_local!(%w[git config user.email confctl-tests@example.invalid], chdir: path)
+    run_local!(%w[git config user.name confctl-tests], chdir: path)
+    run_local!(%w[git add .], chdir: path)
+    run_local!(['git', 'commit', '-m', message], chdir: path)
+  end
+
+  def setup_ssh_home!(path)
+    FileUtils.rm_rf(path)
+    ssh_dir = File.join(path, '.ssh')
+    key_path = File.join(ssh_dir, 'id_ed25519')
+    FileUtils.mkdir_p(ssh_dir)
+
+    run_local!(['ssh-keygen', '-q', '-t', 'ed25519', '-N', '', '-f', key_path])
+
+    File.write(File.join(ssh_dir, 'config'), <<~CFG)
+      Host *
+        StrictHostKeyChecking no
+        UserKnownHostsFile /dev/null
+        IdentityFile #{key_path}
+        IdentitiesOnly yes
+        ConnectTimeout 10
+        ServerAliveInterval 5
+        ServerAliveCountMax 6
+        LogLevel ERROR
+    CFG
+
+    File.chmod(0o700, ssh_dir)
+    File.chmod(0o600, key_path)
+    File.chmod(0o600, "#{key_path}.pub")
+    File.chmod(0o600, File.join(ssh_dir, 'config'))
+
+    File.read("#{key_path}.pub").strip
+  end
+
+  def install_pubkey!(machine, pubkey, timeout: 300)
+    wait_for_block(name: "install SSH key on #{machine.name}", timeout:) do
+      machine.succeeds('mkdir -p /root/.ssh && chmod 700 /root/.ssh')
+      machine.succeeds("cat > /root/.ssh/authorized_keys <<'EOF'\n#{pubkey}\nEOF\nchmod 600 /root/.ssh/authorized_keys")
+      true
+    rescue EOFError, OsVm::MachineShellClosed, OsVm::CommandFailed
+      false
+    end
+  end
+
+  def confctl_env
+    ssh_config = File.join(home_dir, '.ssh', 'config')
+    ssh_key = File.join(home_dir, '.ssh', 'id_ed25519')
+    ssh_opts = [
+      "-F #{ssh_config}",
+      "-i #{ssh_key}",
+      '-o IdentitiesOnly=yes',
+      '-o StrictHostKeyChecking=no',
+      '-o UserKnownHostsFile=/dev/null',
+      '-o LogLevel=ERROR',
+      '-o ConnectTimeout=10'
+    ].join(' ')
+
+    {
+      'HOME' => home_dir,
+      'CONFCTL_TTY' => '0',
+      'CONFCTL_SSH_CONFIG' => ssh_config,
+      'NIX_SSHOPTS' => ssh_opts,
+      'NIX_PATH' => [nix_path, ENV.fetch('NIX_PATH', nil)].compact.join(':'),
+      'NIX_CONFIG' => [ENV.fetch('NIX_CONFIG', nil), 'sandbox = false'].compact.join("\n"),
+      'NO_COLOR' => '1',
+      'PAGER' => ''
+    }
+  end
+
+  def confctl(*args)
+    run_local([confctl_bin, *args], chdir: conf_dir, env: confctl_env)
+  end
+
+  def confctl!(*args)
+    run_local!([confctl_bin, *args], chdir: conf_dir, env: confctl_env)
+  end
+
+  def confctl_ssh(machine, *remote_argv)
+    confctl('ssh', '--yes', machine, *remote_argv.map(&:to_s))
+  end
+
+  def confctl_ssh!(machine, *remote_argv)
+    confctl!('ssh', '--yes', machine, *remote_argv.map(&:to_s))
+  end
+
+  def extract_store_path(text)
+    text.to_s.scan(STORE_PATH_RE).last
+  end
+
+  def confctl_remote_realpath(machine, path)
+    out, = confctl_ssh!(machine, 'realpath', path)
+    store_path = extract_store_path(out)
+    return store_path unless store_path.nil?
+
+    raise "unable to parse store path from confctl ssh output for #{machine}:#{path}: #{out.inspect}"
+  end
+
+  def confctl_store_path_exists!(machine, store_path)
+    confctl_ssh!(machine, 'test', '-e', store_path)
+  end
+
+  def confctl_machine_state(machine)
+    {
+      profile: confctl_remote_realpath(machine, '/nix/var/nix/profiles/system'),
+      current: confctl_remote_realpath(machine, '/run/current-system')
+    }
+  end
+
+  def wait_for_confctl_connectivity!(expected_successes:, timeout: 120)
+    deadline = Time.now + timeout
+
+    loop do
+      out, _err, status = confctl('test-connection', '--yes')
+      return out if status.success? && out.include?("#{expected_successes} successful")
+
+      raise "confctl test-connection did not report #{expected_successes} successful hosts in #{timeout}s" if Time.now >= deadline
+
+      sleep(2)
+    end
+  end
+
+  def confctl_generation_info(host, selector = 'current')
+    host_dir = File.join(conf_dir, '.confctl', 'generations', host.tr('/', ':'))
+
+    generation_name =
+      if selector == 'current'
+        current_link = File.join(host_dir, 'current')
+        File.basename(File.readlink(current_link))
+      else
+        selector
+      end
+
+    json_path = File.join(host_dir, generation_name, 'generation.json')
+    JSON.parse(File.read(json_path)).merge('name' => generation_name)
+  end
+end
+
+TestRunner::TestEvaluator.include(ConfctlTestHelpers)