kubernetes_template_rendering 0.6.1 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5db190341419a622d7593eea77f9ad5525839c0c2039d540edd55a6ce8117479
-  data.tar.gz: ac8e1ec55caccb59e15cc7b552c58e433f14ac3d3946b9100a1895cfcab97ea2
+  metadata.gz: 7c71eb502c7b52355ee6d9040a8401a6e7937477b4ffc81b725951187340e325
+  data.tar.gz: 07e31b80f5c7c2e0d95860d10a4a73390dd919eeed86000867e151faad9f7113
 SHA512:
-  metadata.gz: 34090f91339fc87a45fb91bd3174f281953d952f618ee91b035fb4ecc1dca9c9f2f1cbc8c0f7450cdac739c93229e5b18c4a7e547d22bc735f550808747de74b
-  data.tar.gz: 8bac2935eb16a00898e10f132f8fb5260a71feae470719267111ea2118c3a2d25267130e8d71683936e4faa40473aa8616f2ba90060abdbcf1af29e2a8c721be
+  metadata.gz: 3113be1c65d2e3f356e82b0b3388f9a090fab3945dcc9c54720146f12f9f95d8c95e7dd7fae7af0c00687aa6e557cf84c7fc6de5754f16c7e831fe101b283770
+  data.tar.gz: 64b29afd0de7680e0a8c4aa57010268bc3e1e0bb6ec502c11d91e1ac518d633371d8b1b8f7fa368cb71b73f5e89754e42fecc36cbdd56e698077064269316e0a

data/CHANGELOG.md

@@ -4,6 +4,13 @@ Inspired by [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 Note: this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.2] - 2026-07-15
+### Fixed
+- Fixed the `--reconcile` sweep root for entries whose `subdirectory:` nests more than one level deep (e.g. `subdirectory: exclude-argocd/auth`). The sweep root is now the entry's canonical base — `<region>/<cluster_type>/<color>` for non-SPP entries and `<region>/<cluster_type>/<color>/spp/SPP-PLACEHOLDER` for SPP entries — regardless of `subdirectory:` depth, rather than the immediate parent of the rendered output directory. Previously a nested `subdirectory:` pushed the sweep root one level too deep, so when a `subdirectory:` was renamed or nested deeper the files left at the old shallower path were siblings of the sweep root and were never swept.
+
+### Changed
+- Under `--reconcile`, non-SPP entries must now render within their canonical `<region>/<cluster_type>/<color>` base; an entry that renders outside it (only reachable via the deprecated `directory:` field) hard-errors before any writes. This completes the reconcile layout hard-validation deferred in ADR-0001 — SPP entries were already constrained to the `spp/SPP-PLACEHOLDER` prefix. See ADR-0001.
+
 ## [0.6.1] - 2026-07-08
 ### Fixed
 - Fixed `variable_overrides` and `source_repo` not being forwarded to child `Resource` instances created by `DeployGroupedResource`. Previously, `--variable-override` values (e.g. `deploySha`) were silently unavailable inside all `*-deploy.jsonnet` and `*-deploy.yaml.erb` templates, causing a `KeyError` at render time. `DeployGroupedResource#initialize` now accepts both as optional keyword arguments and passes them through to each `Resource.new` call in `#render`. `ResourceSet#grouped_resources` is updated to supply both values.

data/lib/kubernetes_template_rendering/resource_set.rb

@@ -74,12 +74,13 @@ module KubernetesTemplateRendering
 
     # Bounded reconcile scope roots for this entry, one per region × color.
     #
-    # The sweep root is the parent directory of the entry's rendered `output_directory`, derived
-    # from the actual `directory:` pattern rather than assuming a fixed layout. For a
-    # `.../<service>` pattern that parent is the `<region>/<cluster_type>/<color>` base; for a
-    # `<region>/<service>` pattern it is `<region>`. The parent is shared with sibling entries, so
-    # leftovers from a deleted/renamed entry under it are swept. The renderer validates each
-    # `base_root` stays within `rendered_directory` (out-of-prefix, full or relative, is a hard error).
+    # The sweep root is the entry's canonical base — `<region>/<cluster_type>/<color>` for a non-SPP
+    # entry, or `<region>/<cluster_type>/<color>/spp/SPP-PLACEHOLDER` for an SPP one — independent of
+    # how deep the `subdirectory:` nests. Anchoring at the canonical base (rather than the rendered
+    # `output_directory`'s parent) keeps the sweep root fixed when a `subdirectory:` is renamed or
+    # nested deeper, so leftovers at the old shallower path are still swept. The renderer validates
+    # that the `output_directory` actually falls within this root before sweeping (an entry that
+    # renders elsewhere — only reachable via the deprecated `directory:` field — is a hard error).
     #
     # Each scope also carries `spp:` (whether this entry is an SPP definition) and `spp_base_root:`
     # (the canonical `<region>/<cluster_type>/<color>/spp/SPP-PLACEHOLDER` prefix for that region ×
@@ -88,8 +89,10 @@ module KubernetesTemplateRendering
       @regions.flat_map do |plain_region|
         @colors.map do |c|
           output_directory = File.join(@rendered_directory, format(@target_output_directory, plain_region: plain_region, color: c, type: @kubernetes_cluster_type))
+          base_path        = File.join(@rendered_directory, format(BASE_OUTPUT_DIRECTORY, plain_region: plain_region, color: c, type: @kubernetes_cluster_type))
           spp_base_root    = File.join(@rendered_directory, format(SPP_BASE_OUTPUT_DIRECTORY, plain_region: plain_region, color: c, type: @kubernetes_cluster_type))
-          { base_root: File.dirname(output_directory), output_directory: output_directory, spp: @spp, spp_base_root: spp_base_root }
+          base_root        = @spp ? spp_base_root : base_path
+          { base_root: base_root, output_directory: output_directory, spp: @spp, spp_base_root: spp_base_root }
         end
       end
     end

data/lib/kubernetes_template_rendering/template_directory_renderer.rb

@@ -92,6 +92,11 @@ module KubernetesTemplateRendering
       scopes.each do |scope|
         validate_within_scope!(scope[:base_root], @rendered_directory)
         validate_spp_layout!(scope)
+        # Every entry must render within its canonical root so reconcile owns exactly what it sweeps.
+        # SPP entries are already constrained to the spp/SPP-PLACEHOLDER prefix by validate_spp_layout!;
+        # a non-SPP entry can only escape its base via the deprecated `directory:` field, which reconcile
+        # cannot own — so reject it before any writes rather than sweep a tree it does not render into.
+        validate_within_scope!(scope[:output_directory], scope[:base_root]) unless scope[:spp]
       end
 
       base_roots = []
@@ -142,7 +147,8 @@ module KubernetesTemplateRendering
     # is always re-rendered (it is the expansion source) and each target is freshly expanded from it,
     # so both are marker-safe. Unrequested SPP siblings are not re-rendered this run and stay excluded.
     def spp_reconcile_roots(scope)
-      root = spp_sweep_root(scope)
+      # base_root is the canonical `.../spp/SPP-PLACEHOLDER` prefix for SPP entries.
+      root = scope[:base_root]
       return [root] if @spps.empty?
       return [root] unless root.include?(ResourceSet::SPP_PLACEHOLDER)
 
@@ -153,13 +159,6 @@ module KubernetesTemplateRendering
       Pathname.new(root).relative_path_from(Pathname.new(@rendered_directory)).each_filename.include?(SPP_FENCE_DIRNAME)
     end
 
-    # When the directory pattern has no service subdirectory (e.g. `.../spp/SPP-PLACEHOLDER`),
-    # base_root lands at the `spp/` level itself — sweeping that would touch all SPP siblings.
-    # Use output_directory (= `spp/<spp-name>`) in that case instead.
-    def spp_sweep_root(scope)
-      File.basename(scope[:base_root]) == SPP_FENCE_DIRNAME ? scope[:output_directory] : scope[:base_root]
-    end
-
     def reconcile_sweep(reconciler, scopes)
       scopes[:base_roots].each { |r| reconciler.sweep!(root: r, fences: [File.join(r, SPP_FENCE_DIRNAME)]) }
       scopes[:spp_roots].each  { |r| reconciler.sweep!(root: r) }

data/lib/kubernetes_template_rendering/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module KubernetesTemplateRendering
-  VERSION = "0.6.1"
+  VERSION = "0.6.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kubernetes_template_rendering
 version: !ruby/object:Gem::Version
-  version: 0.6.1
+  version: 0.6.2
 platform: ruby
 authors:
 - Octothorpe
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-08 00:00:00.000000000 Z
+date: 2026-07-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport