@brutalsystems/dray 0.1.10 → 0.1.12

package/README.md

@@ -45,13 +45,18 @@ dray secrets sync <repo>
 ```
 
 Global flags: `--dry-run` (print the plan, run nothing), `--allow-dirty`
-(build a dirty tree, tags `:<sha>-dirty`), `--all` (every registered repo).
+(build a dirty tree, tags `:<sha>-dirty`), `--all` (every registered repo),
+`--skip-ci-check` (deploy even if CI is red — see [CI gate](#ci-gate)).
 
 ## `.dray/config.json` (per repo)
 
 ```jsonc
 {
   "name": "myrepo",
+  // optional per-repo overrides of ~/.dray/config.json defaults
+  // (profile, region, account, platform, context, namespace, ciGate);
+  // a workload may override them again.
+  "defaults": { "namespace": "bs", "ciGate": true },
   "images": [
     { "name": "app", "ecr": "app", "source": { "local": true },
       "dockerfile": "Dockerfile", "context": ".",
@@ -93,6 +98,49 @@ Global flags: `--dry-run` (print the plan, run nothing), `--allow-dirty`
 }
 ```
 
+### CI gate
+
+With `"ciGate": true` in a repo's `defaults`, `push`, `apply`, `rollout` and
+`ship` refuse to run unless that repo's GitHub Actions CI is green for the code
+being shipped. It reads `gh run list` (so `gh` must be installed and
+authenticated) and blocks on all three of:
+
+- **failed** — CI is red.
+- **pending** — CI is still running. This is the case that motivated the gate:
+  a deploy once pushed an image to ECR six minutes before the test suite it was
+  racing had finished, and nothing would have stopped a red result.
+- **absent** — no run exists for HEAD *or any recent ancestor*, i.e. CI has
+  never run for this line of work. "No run found" has to block: if it passed,
+  never pushing would be the way around the gate.
+
+It does *not* demand a run for HEAD itself. Workflows commonly use
+`paths-ignore`, so a docs-only commit produces no run at all; requiring one
+would refuse to ship a README change, and a gate that blocks legitimate work
+gets switched off. Instead dray walks back to the **newest CI-covered
+ancestor** and requires that verdict to be green.
+
+Default is off, so registering a repo does not change its behavior — arm it
+per repo. `--skip-ci-check` overrides the gate for one command and prints a
+loud warning. The gate also self-disables when `GITHUB_ACTIONS=true` (inside
+CI it would be waiting on the run that invoked it — a deadlock) and on
+`--dry-run`.
+
+**What it does not cover**, deliberately:
+
+- Images built from `source.git` — their code lives in another repository whose
+  CI is not this repo's to read, so those units are skipped rather than falsely
+  reported as verified.
+- `rollback`, which re-applies a SHA that was already deployed. Blocking a
+  rollback because `main` is red would be exactly backwards during an incident.
+- `publish` (pilets), which does not go through the deploy path.
+- A commit you have not pushed: with no run of its own it falls back to its
+  newest covered ancestor, so an unpushed change on top of a green commit
+  passes. The gate closes the red/racing cases, not "I never pushed it".
+
+It reads the repo's 100 most recent workflow runs. In a repo busy enough that
+HEAD's run has already fallen out of that window, the gate reports `absent` and
+blocks — noisy, but never the wrong way around.
+
 ### Image pinning
 
 Manifests reference managed images by a placeholder var — `${APP_IMAGE}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/dray",
-  "version": "0.1.10",
+  "version": "0.1.12",
   "description": "Convention-driven multi-repo deploy orchestrator (forge for shipping)",
   "bin": {
     "dray": "bin/dray.js"

package/src/cli/index.js

@@ -6,6 +6,7 @@ async function run(argv) {
   program.version(require('../../package.json').version, '-v, --version', 'show dray version');
   program.option('--dry-run', 'print planned commands, run nothing');
   program.option('--allow-dirty', 'allow building from a dirty tree (tags :<sha>-dirty)');
+  program.option('--skip-ci-check', 'deploy even if CI is red, pending, or absent');
   for (const c of ['version', 'init', 'add', 'remove', 'reload', 'list',
     'build', 'push', 'apply', 'rollout', 'ship', 'status', 'rollback', 'publish', 'secrets']) {
     require(`./commands/${c}`)(program);

package/src/cli/run-action.js

@@ -1,9 +1,14 @@
 const { loadGlobalConfig } = require('../config/global'); const { allRepos } = require('../config/registry');
 const { resolveTargets } = require('../core/resolve'); const { planFor } = require('../core/plan'); const { execute } = require('../core/engine');
-async function runAction(target, action, { dryRun, allowDirty, all }) {
+const { assertCiGreen } = require('../core/ciGate');
+// Actions that publish an artifact or touch the cluster. `build` is local and
+// leaves nothing behind, so it stays ungated.
+const GATED = new Set(['push', 'apply', 'rollout', 'ship']);
+async function runAction(target, action, { dryRun, allowDirty, all, skipCiCheck }) {
   const registry = allRepos(); const { defaults } = loadGlobalConfig();
   const spec = all ? '--all' : target;
   const units = resolveTargets({ registry, globalDefaults: defaults, spec });
+  if (GATED.has(action)) await assertCiGreen(units, { dryRun, allowDirty, skipCiCheck });
   await execute(planFor(units, action), { dryRun, allowDirty });
 }
 module.exports = { runAction };

package/src/config/repo.js

@@ -24,12 +24,17 @@ function validateRepoConfig(cfg) {
     // Both gate deployment on truthiness, so a JSON string ("false", "no") would
     // silently skip the workload -- in `manual`'s case, silently drop it from CI.
     // Fail loud instead of deploying something different from what was meant.
-    for (const flag of ['disabled', 'manual']) {
+    for (const flag of ['disabled', 'manual', 'ciGate']) {
       if (w[flag] !== undefined && typeof w[flag] !== 'boolean') {
         e.push(`workload "${w.name}" ${flag} must be a boolean, got ${typeof w[flag]}`);
       }
     }
   }
+  // A JSON string ("false") is truthy and would silently ARM the gate -- or, as
+  // "true" in the wrong place, silently disarm it. Both are worth failing loud.
+  if (cfg.defaults && cfg.defaults.ciGate !== undefined && typeof cfg.defaults.ciGate !== 'boolean') {
+    e.push(`defaults.ciGate must be a boolean, got ${typeof cfg.defaults.ciGate}`);
+  }
   for (const s of cfg.secrets || []) {
     if (!s.name) e.push('secret missing name');
     if (!SECRET_KINDS.has(s.kind)) e.push(`secret "${s.name}" kind must be sops-manifest|literal-from-env|sops-exec-env`);

package/src/core/ciGate.js

@@ -0,0 +1,98 @@
+const real = { gh: require('../primitives/gh'), git: require('../primitives/git') };
+
+const PASSING = new Set(['success', 'skipped', 'neutral']);
+
+// Pure decision: given HEAD's ancestry (newest first) and the repo's recent
+// workflow runs, may we deploy?
+//
+// Why walk back through history instead of demanding a run for HEAD itself:
+// workflows commonly use paths-ignore, so a docs-only commit produces NO run
+// at all -- not a skipped one. Requiring a run for HEAD would refuse to ship a
+// README change, and a gate that blocks legitimate work is a gate that gets
+// switched off. Instead we require the newest CI-COVERED ancestor to be green:
+// if the commits after it were deemed unable to affect the artifact, the last
+// verdict still stands.
+function evaluate({ commits, runs }) {
+  const byShaPrefix = new Map();
+  for (const r of runs) {
+    if (!r.headSha) continue;
+    const list = byShaPrefix.get(r.headSha) || [];
+    list.push(r);
+    byShaPrefix.set(r.headSha, list);
+  }
+  for (const sha of commits) {
+    const hits = byShaPrefix.get(sha);
+    if (!hits || !hits.length) continue; // not CI-covered; keep walking back
+    const short = sha.slice(0, 7);
+    const pending = hits.filter((r) => r.status !== 'completed');
+    if (pending.length) {
+      return { ok: false, sha: short, reason: 'pending',
+        detail: `CI is still running for ${short} (${pending.map((r) => r.workflowName).join(', ')}). Wait for it to finish.`,
+        url: pending[0].url };
+    }
+    const failed = hits.filter((r) => !PASSING.has(r.conclusion));
+    if (failed.length) {
+      return { ok: false, sha: short, reason: 'failed',
+        detail: `CI failed for ${short}: ${failed.map((r) => `${r.workflowName}=${r.conclusion}`).join(', ')}`,
+        url: failed[0].url };
+    }
+    return { ok: true, sha: short, reason: 'green',
+      detail: `CI green for ${short} (${hits.map((r) => r.workflowName).join(', ')})` };
+  }
+  return { ok: false, reason: 'absent',
+    detail: `no CI run found for HEAD or any of its ${commits.length} most recent ancestors. `
+      + 'Push the branch and let CI run, or override.' };
+}
+
+// Repos to gate, deduped by path. Images sourced from a remote git ref are
+// skipped: their code lives in another repository and its CI is not this
+// repo's to read. That is a real hole -- see README -- not an oversight.
+function gatedRepos(units) {
+  const out = new Map();
+  for (const u of units) {
+    if (!u.defaults || !u.defaults.ciGate) continue;
+    if (u.image && u.image.source && u.image.source.git) continue;
+    if (!out.has(u.repoPath)) out.set(u.repoPath, u.repo);
+  }
+  return out;
+}
+
+async function assertCiGreen(units, { dryRun = false, allowDirty = false, skipCiCheck = false, deps, log = console.error } = {}) {
+  const d = { ...real, ...deps };
+  const repos = gatedRepos(units);
+  if (!repos.size) return;
+  if (dryRun) return;
+  // Running inside GitHub Actions, the gate would be checking the very run that
+  // invoked it -- always "pending", a guaranteed deadlock. CI reaching dray at
+  // all means the pipeline already decided to deploy.
+  if (process.env.GITHUB_ACTIONS === 'true') return;
+  if (skipCiCheck) {
+    for (const [, name] of repos) log(`!! CI gate SKIPPED for ${name} (--skip-ci-check) -- deploying unverified code`);
+    return;
+  }
+  for (const [repoPath, name] of repos) {
+    if (allowDirty && await d.git.isDirty(repoPath)) {
+      throw new Error(`${name}: working tree is dirty, so no CI run can exist for what you are about to ship.\n`
+        + '  Commit and push it, or pass --skip-ci-check to override.');
+    }
+    let commits, runs;
+    try {
+      [commits, runs] = await Promise.all([d.gh.recentCommits(repoPath), d.gh.recentRuns(repoPath)]);
+    } catch (err) {
+      // A gh that cannot answer is not a green suite. Say it in the gate's own
+      // voice: a bare "gh CLI not authenticated" reads like an unrelated tool
+      // failure rather than like the deploy having been stopped on purpose.
+      throw new Error(`${name}: CI gate could not check CI, so it is refusing to deploy.\n  ${err.message}`
+        + '\n  Fix that, or pass --skip-ci-check to deploy without the check.');
+    }
+    const verdict = evaluate({ commits, runs });
+    if (!verdict.ok) {
+      throw new Error(`${name}: CI gate blocked this deploy.\n  ${verdict.detail}`
+        + (verdict.url ? `\n  ${verdict.url}` : '')
+        + '\n  Override with --skip-ci-check if you must ship anyway.');
+    }
+    log(`✓ ${name}: ${verdict.detail}`);
+  }
+}
+
+module.exports = { evaluate, gatedRepos, assertCiGreen };

package/src/core/engine.js

@@ -52,9 +52,25 @@ async function execute(steps, { dryRun = false, allowDirty = false, deps } = {})
         const vars = {}; for (const s of u.stamp) vars[s.var] = `${s.repoUri}:${sha}`;
         const files = d.render.renderManifests(u.manifests, vars, u.repoPath, { dryRun });
         if (files[0]) renderDirs.push(path.dirname(files[0]));
+        // Read the running image BEFORE applying. If it differs from what we
+        // are about to stamp, this apply changes the pod template and the
+        // Deployment controller starts a rollout on its own — so the rollout
+        // step that follows must wait rather than restart, or every ship
+        // produces two ReplicaSets and replaces the pod twice.
+        //
+        // Deliberately conservative: any doubt (dry run, cronjob, unreadable
+        // deployment) leaves the restart in place, which is the previous
+        // behaviour.
+        u._applyStartsRollout = false;
+        if (!dryRun && u.workload && u.kind !== 'cronjob') {
+          try {
+            const before = await d.kubectl.runningImage({ workload: u.workload, kind: u.kind, context: u.defaults.context, namespace: u.defaults.namespace });
+            u._applyStartsRollout = before !== `${u.repoUri}:${sha}`;
+          } catch { u._applyStartsRollout = false; }
+        }
         for (const f of files) await d.kubectl.applyFile({ file: f, context: u.defaults.context, namespace: u.defaults.namespace, dryRun });
       } else if (step.kind === 'rollout') {
-        try { await d.kubectl.rollout({ deployment: u.workload, context: u.defaults.context, namespace: u.defaults.namespace, dryRun }); }
+        try { await d.kubectl.rollout({ deployment: u.workload, context: u.defaults.context, namespace: u.defaults.namespace, dryRun, restart: !u._applyStartsRollout }); }
         catch (err) { await d.kubectl.rolloutUndo({ deployment: u.workload, context: u.defaults.context, namespace: u.defaults.namespace, dryRun }); throw err; }
       }
     }

package/src/core/resolve.js

@@ -1,4 +1,4 @@
-const KEYS = ['profile', 'region', 'account', 'platform', 'context', 'namespace'];
+const KEYS = ['profile', 'region', 'account', 'platform', 'context', 'namespace', 'ciGate'];
 const upperSnake = (s) => s.replace(/[^a-zA-Z0-9]+/g, '_').toUpperCase();
 function imageVar(image) { return image.templateVar || `${upperSnake(image.name)}_IMAGE`; }
 function mergeDefaults(globalDefaults = {}, repoCfg = {}, entry = {}) {

package/src/primitives/gh.js

@@ -0,0 +1,37 @@
+let _run = require('./exec').run; function _withRun(fn) { _run = fn; }
+
+// Runs for the last `limit` workflow executions in this repo, newest first.
+// One call for the whole repo rather than one per commit: the gate walks back
+// through history looking for the newest CI-covered ancestor, and N lookups
+// would be N round trips to the API.
+async function recentRuns(cwd, limit = 100) {
+  let code, stdout, stderr;
+  try {
+    ({ code, stdout, stderr } = await _run('gh',
+      ['run', 'list', '--limit', String(limit), '--json', 'headSha,status,conclusion,workflowName,url'],
+      { cwd, capture: true, allowFail: true }));
+  } catch (err) {
+    // spawn() itself failed -- with no `gh` on PATH the process never starts, so
+    // there is no exit code or stderr to inspect below.
+    if (/ENOENT/i.test(err.message)) throw new Error('gh CLI not installed (brew install gh)');
+    throw err;
+  }
+  if (code !== 0) {
+    const msg = (stderr || '').trim();
+    // Distinguish "gh cannot answer" from "gh says no". A missing binary, an
+    // expired token or a repo with Actions disabled must not read as a green
+    // suite -- the caller turns this into a block, not a pass.
+    if (/not found|ENOENT/i.test(msg)) throw new Error('gh CLI not installed (brew install gh)');
+    if (/auth|login|token/i.test(msg)) throw new Error('gh CLI not authenticated (gh auth login)');
+    throw new Error(`gh run list failed: ${msg || `exit ${code}`}`);
+  }
+  try { return JSON.parse(stdout || '[]'); } catch { throw new Error('gh run list returned unparseable JSON'); }
+}
+
+// Commit shas from HEAD backwards, newest first.
+async function recentCommits(cwd, limit = 50) {
+  const { stdout } = await _run('git', ['rev-list', '-n', String(limit), 'HEAD'], { cwd, capture: true });
+  return stdout.trim().split('\n').filter(Boolean);
+}
+
+module.exports = { recentRuns, recentCommits, _withRun };

package/src/primitives/kubectl.js

@@ -1,8 +1,12 @@
 let _run = require('./exec').run; function _withRun(fn) { _run = fn; }
 const ns = (c, n) => ['-n', n, '--context', c];
 function applyFile({ file, context, namespace, dryRun }) { return _run('kubectl', ['apply', '-f', file, ...ns(context, namespace)], { dryRun }); }
-async function rollout({ deployment, context, namespace, dryRun }) {
-  await _run('kubectl', ['rollout', 'restart', `deployment/${deployment}`, ...ns(context, namespace)], { dryRun });
+// `restart: false` waits without restarting. Used when the preceding apply
+// stamped a new image SHA and therefore already started a rollout — issuing
+// `rollout restart` on top of that produces a SECOND ReplicaSet and a second
+// pod replacement, doubling the disruption window on every deploy.
+async function rollout({ deployment, context, namespace, dryRun, restart = true }) {
+  if (restart) await _run('kubectl', ['rollout', 'restart', `deployment/${deployment}`, ...ns(context, namespace)], { dryRun });
   return _run('kubectl', ['rollout', 'status', `deployment/${deployment}`, '--timeout=180s', ...ns(context, namespace)], { dryRun });
 }
 function rolloutUndo({ deployment, context, namespace, dryRun }) { return _run('kubectl', ['rollout', 'undo', `deployment/${deployment}`, ...ns(context, namespace)], { dryRun }); }