@bongos/core 1.19.674 → 1.19.676

package/tests/go_live.mjs

@@ -144,9 +144,11 @@ test('a typo’d field is reported, never silently ignored', () => {
 
 test('missing required fields are named individually', () => {
   const errs = G.validateTarget('t', { ssh: 'box' });
-  for (const f of ['instanceDir', 'service', 'healthUrl', 'versionUrl', 'deployTimer']) {
+  for (const f of ['instanceDir', 'service', 'healthUrl', 'versionUrl']) {
     assert.match(errs.join(' '), new RegExp(`missing required field "${f}"`));
   }
+  // deployTimer is co-tenant-optional (task 1003521) and must NOT be demanded.
+  assert.ok(!/missing required field "deployTimer"/.test(errs.join(' ')));
 });
 
 test('a valid target passes clean', () => {
@@ -393,7 +395,7 @@ test('ssh is OPTIONAL — a local target validates clean', () => {
 
 test('the remaining required fields are still enforced for a local target', () => {
   const errs = G.validateTarget('local', { instanceDir: '/i' });
-  for (const f of ['service', 'healthUrl', 'versionUrl', 'deployTimer']) {
+  for (const f of ['service', 'healthUrl', 'versionUrl']) {
     assert.match(errs.join(' '), new RegExp(`missing required field "${f}"`));
   }
   // ssh must NOT be demanded any more.
@@ -411,3 +413,173 @@ test('gitRefExists reports rather than throwing', () => {
   assert.equal(G.gitRefExists('x', { run: () => ({ status: 1 }) }), false);
   assert.equal(G.gitRefExists('x', { run: () => ({ error: new Error('ENOENT') }) }), false);
 });
+
+// ---------------------------------------------------------------------------
+// Co-tenant mode (task 1003521)
+//
+// go-live drove the PLATFORM instance and could not drive a provisioned co-tenant,
+// for two structural reasons, so mercury had to be upgraded by hand from a box-side
+// script — the exact one-command path this file exists to provide:
+//
+//   1. deployTimer was REQUIRED. A co-tenant has no pull-deploy timer at all (only
+//      its <slug>-db-backup.timer), so the config could not even be AUTHORED without
+//      inventing a unit name that the script would then try to `systemctl stop`.
+//   2. The pin was always PUSHED. On a co-tenant the repo of record is the customer's
+//      own GitHub repo, so that push is both wrong and, in practice, uncredentialed.
+//
+// The assertions below are on the scripts applyGoLive COMPOSES and the verdicts it
+// reaches — `run` is injected, so nothing here touches a box.
+// ---------------------------------------------------------------------------
+
+const coTenant = {
+  ssh: 'my-box',
+  instanceDir: '/srv/my-host/their-slug',
+  service: 'their-slug.service',
+  healthUrl: 'http://127.0.0.1:3101/healthz',
+  versionUrl: 'http://127.0.0.1:3101/version',
+  pinMode: 'local-commit',
+};
+
+// Canned phase-C output. The sections are what applyGoLive parses its verdicts from.
+const phaseC = ({ timer = true, pin = '', version = '1.19.306', installed = '1.19.306' } = {}) => [
+  timer ? '##TIMERSTART##\nactive' : '',
+  `##PIN##\n${pin}`,
+  '##HEAD##\ndeadbee pin @bongos/core 1.19.306',
+  `##VERSION##\n{"coreVersion":"${version}"}`,
+  `##INSTALLED##\n${installed}`,
+  '##END##',
+].filter(Boolean).join('\n');
+
+// Records every script fed to a shell. `upgradeFails` drives the rollback path.
+function fakeShell({ upgradeFails = false, phaseCOut = phaseC() } = {}) {
+  const scripts = [];
+  const fn = (cmd, args, opts = {}) => {
+    const input = opts.input || '';
+    scripts.push(input);
+    if (input.includes('bongos upgrade')) return { status: upgradeFails ? 1 : 0, stdout: '', stderr: upgradeFails ? 'boom' : '' };
+    if (input.includes('##PIN##')) return { status: 0, stdout: phaseCOut, stderr: '' };
+    return { status: 0, stdout: '##TIMER##\n##BACKUP##\n##END##', stderr: '' };
+  };
+  fn.scripts = scripts;
+  fn.all = () => scripts.join('\n');
+  return fn;
+}
+
+const stepNames = (r) => (r.steps || []).map((s) => s.name);
+
+test('pinMode defaults to push, so an existing config keeps its behaviour', () => {
+  assert.equal(G.pinModeOf(okTarget), 'push');
+  assert.equal(G.pinModeOf({}), 'push');
+  assert.equal(G.pinModeOf(undefined), 'push');
+  assert.equal(G.pinModeOf({ pinMode: 'leave-dirty' }), 'leave-dirty');
+});
+
+test('a bogus pinMode is REFUSED, and each documented one validates', () => {
+  assert.match(G.validateTarget('t', { ...okTarget, pinMode: 'shove-it' }).join(' '), /pinMode must be one of/);
+  for (const m of G.PIN_MODES) assert.deepEqual(G.validateTarget('t', { ...okTarget, pinMode: m }), []);
+});
+
+test('push mode pushes the pin; the two co-tenant modes never do', () => {
+  const cmd = (t) => G.upgradeCommand(t, '1.19.306');
+
+  // The platform instance: --commit-pin ALONE, which pushes (task 1002712 — thirteen
+  // releases were lost to an unpushed pin, so this is the regression that matters).
+  const push = cmd({ ...okTarget, pinMode: 'push' });
+  assert.ok(push.includes('--commit-pin'), 'push mode must still commit the pin');
+  assert.ok(!push.includes('--pin-no-push'), 'push mode must NOT suppress the push');
+
+  // local-commit: commit it, leave the customer's remote alone.
+  const local = cmd({ ...okTarget, pinMode: 'local-commit' });
+  assert.ok(local.includes('--commit-pin') && local.includes('--pin-no-push'));
+
+  // leave-dirty: no commit at all, and --pin-no-push so upgrade.js does not raise the
+  // pull-deploy alarm at an instance that has no pull-deploy.
+  const dirty = cmd({ ...okTarget, pinMode: 'leave-dirty' });
+  assert.ok(!dirty.includes('--commit-pin'), 'leave-dirty must not commit');
+  assert.ok(dirty.includes('--pin-no-push'));
+
+  // Unchanged for every mode: auto-rollback stays ON.
+  for (const c of [push, local, dirty]) assert.ok(!c.includes('--no-rollback-on-failure'));
+});
+
+test('a co-tenant target validates with NO deployTimer — the field that blocked the config', () => {
+  assert.deepEqual(G.validateTarget('a-co-tenant', coTenant), []);
+});
+
+test('with no deployTimer, nothing is stopped, started, or reported as restarted', () => {
+  const run = fakeShell({ phaseCOut: phaseC({ timer: false }) });
+  const r = G.applyGoLive(coTenant, 'a-co-tenant', '1.19.306', '1.19.300', { run });
+
+  assert.equal(r.ok, true, `expected a clean run, got ${JSON.stringify(stepNames(r))}`);
+  // The bug shape: an invented unit name reaching systemctl, or a literal `undefined`.
+  assert.ok(!/systemctl (stop|start)/.test(run.all()), 'must not touch a timer it has not got');
+  assert.ok(!run.all().includes('undefined'), 'no field may interpolate as undefined');
+  assert.ok(!stepNames(r).some((n) => /restart/.test(n)), 'no restart step for a timer that does not exist');
+  assert.match(stepNames(r)[0], /^backup \(no pull-deploy timer\)$/);
+});
+
+test('the platform instance still stops the timer and puts it back', () => {
+  const run = fakeShell();
+  const r = G.applyGoLive({ ...okTarget, deployTimer: 'inst-deploy.timer' }, 'web', '1.19.306', '1.19.300', { run });
+
+  assert.equal(r.ok, true);
+  assert.match(run.all(), /systemctl stop inst-deploy\.timer/);
+  assert.match(run.all(), /systemctl start inst-deploy\.timer/);
+  assert.ok(stepNames(r).includes('restart inst-deploy.timer'));
+});
+
+test('a failed upgrade restarts the timer it stopped — and asks for none when it stopped none', () => {
+  const withTimer = fakeShell({ upgradeFails: true });
+  const a = G.applyGoLive(okTarget, 'web', '1.19.306', '1.19.300', { run: withTimer });
+  assert.equal(a.ok, false);
+  assert.equal(a.failedAt, 'UPGRADE');
+  assert.match(withTimer.all(), /systemctl start inst-deploy\.timer/);
+
+  const coT = fakeShell({ upgradeFails: true });
+  const b = G.applyGoLive(coTenant, 'a-co-tenant', '1.19.306', '1.19.300', { run: coT });
+  assert.equal(b.ok, false);
+  assert.ok(!/systemctl start/.test(coT.all()), 'nothing was stopped, so nothing is restarted');
+});
+
+test('a dirty pin is the durability failure it is under push and local-commit', () => {
+  for (const pinMode of ['push', 'local-commit']) {
+    const run = fakeShell({ phaseCOut: phaseC({ pin: ' M package.json' }) });
+    const r = G.applyGoLive({ ...okTarget, pinMode }, 'web', '1.19.306', '1.19.300', { run });
+    assert.equal(r.ok, false, `${pinMode} must fail on an uncommitted pin`);
+    assert.equal(r.pinCommitted, false);
+  }
+});
+
+test('under leave-dirty the SAME dirty pin is the configured outcome, not a failure', () => {
+  const run = fakeShell({ phaseCOut: phaseC({ pin: ' M package.json' }) });
+  const r = G.applyGoLive({ ...okTarget, pinMode: 'leave-dirty' }, 'web', '1.19.306', '1.19.300', { run });
+  assert.equal(r.ok, true, `a correct leave-dirty run must not read as broken: ${JSON.stringify(stepNames(r))}`);
+  assert.match(stepNames(r).join(' '), /leave-dirty/);
+});
+
+test('the health and version gates are untouched by pin mode', () => {
+  // A co-tenant serving the WRONG version must still fail, or co-tenant mode would be
+  // a way to get a green report out of a bump that did not take.
+  const run = fakeShell({ phaseCOut: phaseC({ timer: false, version: '1.19.300' }) });
+  const r = G.applyGoLive(coTenant, 'a-co-tenant', '1.19.306', '1.19.300', { run });
+  assert.equal(r.ok, false);
+  assert.match(stepNames(r).join(' '), /live reads back/);
+});
+
+test('the report does not promise a push it did not make', () => {
+  const base = { targetName: 'x', from: '1.19.300', to: '1.19.306', steps: [], liveVersion: '1.19.306', ok: true };
+  assert.match(G.renderReport({ ...base, pinMode: 'push', pinCommitted: true }), /pin committed {5}yes$/m);
+  assert.match(G.renderReport({ ...base, pinMode: 'local-commit', pinCommitted: true }), /local commit/);
+  assert.match(G.renderReport({ ...base, pinMode: 'leave-dirty', pinCommitted: false }), /left in the working tree/);
+  // An absent pinMode (a failure return from an older path) still reads as push.
+  assert.match(G.renderReport({ ...base, pinCommitted: false }), /next pull-deploy reset will revert/);
+});
+
+test('the shipped co-tenant template is itself valid config', () => {
+  const r = G.loadConfig({ configPath: 'x.json', exists: () => true, readFile: () => G.CONFIG_TEMPLATE });
+  assert.ok(r.ok, `template did not parse: ${r.detail || ''}`);
+  const sel = G.selectTarget(r.config, 'a-co-tenant');
+  assert.ok(sel.ok, `co-tenant template target invalid: ${sel.detail || ''}`);
+  assert.equal(sel.target.pinMode, 'local-commit');
+  assert.equal(sel.target.deployTimer, undefined);
+});

package/tests/upgrade_persist_pin.mjs

@@ -146,6 +146,67 @@ test('the copy-pasteable fix line is shell-quoted', () => {
   assert.equal((cmd.match(/'/g) || []).length % 2, 0, 'every quote is closed');
 });
 
+// ── push: false — co-tenant mode (task 1003521) ─────────────────────────────
+//
+// The reasoning above assumes the repo of record is OURS. On a PROVISIONED instance it
+// is the customer's own GitHub repo, so the push is both wrong and, in practice,
+// uncredentialed — and with no pull-deploy timer nothing will reset the pin away, so
+// the commit alone is durable. go-live.js passes --pin-no-push for such a target.
+
+test('push: false commits the pin and stops there', () => {
+  const run = fakeRun({ status: DIRTY, 'rev-parse': ON_MAIN });
+  const r = persistPin({ ...base, commitPin: true, push: false }, run, quiet, quiet);
+
+  assert.equal(r.committed, true);
+  assert.equal(r.pushed, false);
+  assert.equal(r.pushSkipped, true);
+  assert.ok(!r.error, 'a skipped push is not a failure');
+  assert.ok(run.calls.some((c) => c === `git add ${PIN_FILES.join(' ')}`), 'still stages the pin files');
+  assert.ok(run.calls.some((c) => c.startsWith('git commit -m pin @bongos/core')), 'still commits');
+  assert.ok(!run.calls.some((c) => c.startsWith('git push')), 'must NOT touch a remote that is not ours');
+});
+
+test('push defaults to true, so every existing caller still pushes', () => {
+  // The absent field must not silently become co-tenant mode: that is how thirteen
+  // releases were lost the first time.
+  const run = fakeRun({ status: DIRTY, 'rev-parse': ON_MAIN });
+  const r = persistPin({ ...base, commitPin: true }, run, quiet, quiet);
+  assert.equal(r.pushed, true);
+  assert.ok(run.calls.some((c) => c === 'git push origin HEAD:main'));
+});
+
+test('a co-tenant with no --commit-pin gets a NOTE, not the pull-deploy alarm', () => {
+  // The loud warning is correct on a pull-deploy instance and false here. An alarm an
+  // operator learns to ignore is worse than no alarm.
+  const warnings = [];
+  const run = fakeRun({ status: DIRTY, 'rev-parse': ON_MAIN });
+  const r = persistPin({ ...base, commitPin: false, push: false }, run, quiet, (m) => warnings.push(m));
+
+  assert.equal(r.warned, true);
+  assert.equal(r.committed, false);
+  const text = warnings.join('\n');
+  assert.ok(!/PIN NOT COMMITTED/.test(text), 'no shouting about a revert that cannot happen');
+  assert.ok(!/reset --hard/.test(text), 'and no claim that a pull-deploy will revert it');
+  assert.match(text, /not ours/, 'says why the push is off');
+  assert.match(text, /--commit-pin/, 'still names the fix for the dirty tree');
+});
+
+test('--dry-run under push: false does not promise a push', () => {
+  const logs = [];
+  const run = fakeRun({ status: DIRTY, 'rev-parse': ON_MAIN });
+  const r = persistPin({ ...base, commitPin: true, push: false, dryRun: true }, run, (m) => logs.push(m), quiet);
+  assert.equal(r.dryRun, true);
+  assert.ok(!/push/.test(logs.join('\n').replace(/no push/g, '')), `dry-run must not claim a push: ${logs.join('\n')}`);
+  assert.ok(!run.calls.some((c) => c.includes('git commit') || c.includes('git push')));
+});
+
+test('a failed commit under push: false still reports the failure', () => {
+  const run = fakeRun({ status: DIRTY, 'rev-parse': ON_MAIN, commit: { status: 1, stdout: '' } });
+  const r = persistPin({ ...base, commitPin: true, push: false }, run, quiet, quiet);
+  assert.equal(r.committed, false);
+  assert.ok(!r.pushSkipped, 'nothing was skipped — the commit never happened');
+});
+
 // ── preflightDbIdentity (task 1002712) ──────────────────────────────────────
 // migrate.sh uses peer auth, so `sudo bongos upgrade` connects as root, which is
 // almost never a Postgres role. That surfaced as a raw FATAL mid-run, AFTER the