@brutalsystems/dray 0.1.5 → 0.1.8

package/README.md

@@ -60,7 +60,11 @@ Global flags: `--dry-run` (print the plan, run nothing), `--allow-dirty`
       // optional: inject --build-arg from an env file (e.g. VITE_* from .env.production),
       // or from a sops-encrypted file decrypted in memory at build time (no plaintext on disk):
       //   "buildArgs": { "sopsEnvFile": "secrets.env", "prefix": "VITE_" }
-      "buildArgs": { "envFile": ".env.production", "prefix": "VITE_" } },
+      "buildArgs": { "envFile": ".env.production", "prefix": "VITE_" },
+      // optional: also move a mutable <ecr>:latest tag onto every (non-dirty)
+      // push, so workloads that reference <ecr>:latest track the newest build
+      // without being re-shipped (e.g. rarely-shipped cronjobs sharing an image).
+      "latest": true },
     // image from another repo (cloned to a tmp dir, built, pushed):
     { "name": "svc", "ecr": "svc", "source": { "git": "https://github.com/org/svc", "ref": "main" } }
   ],
@@ -91,3 +95,12 @@ Manifests reference managed images by a placeholder var — `${APP_IMAGE}`
 substitutes `<ecr>:<gitSHA>` for that var across the listed files (container
 image, env-var image refs, cronjob images — uniformly). A raw `kubectl apply`
 of an unrendered manifest fails loud, so applies always go through dray.
+
+An image with `"latest": true` additionally gets a mutable `<ecr>:latest` tag
+moved onto each non-dirty push. This is for the opposite need: a workload that
+should track the newest build of a shared image *without* being re-shipped
+(e.g. a low-frequency cronjob sharing an image with a frequently-shipped
+service). Reference `<ecr>:latest` literally in that manifest (with
+`imagePullPolicy: Always`) instead of the `${..._IMAGE}` placeholder. You trade
+away per-commit reproducibility/rollback for that workload — use it only where
+that's the point.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/dray",
-  "version": "0.1.5",
+  "version": "0.1.8",
   "description": "Convention-driven multi-repo deploy orchestrator (forge for shipping)",
   "bin": {
     "dray": "bin/dray.js"

package/src/cli/index.js

@@ -3,6 +3,7 @@ async function run(argv) {
   if (argv.length <= 2) { await require('./menu').menu(); return; }
   const program = new Command();
   program.name('dray').description('Convention-driven multi-repo deploy orchestrator');
+  program.version(require('../../package.json').version, '-v, --version', 'show dray version');
   program.option('--dry-run', 'print planned commands, run nothing');
   program.option('--allow-dirty', 'allow building from a dirty tree (tags :<sha>-dirty)');
   for (const c of ['version', 'init', 'add', 'remove', 'reload', 'list',

package/src/config/registry.js

@@ -1,8 +1,26 @@
 const fs = require('node:fs'); const path = require('node:path'); const { REGISTRY } = require('../constants');
+const { loadRepoConfig } = require('./repo');
 function loadRegistry(file = REGISTRY) { return fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : {}; }
 function saveRegistry(file = REGISTRY, reg = {}) { fs.mkdirSync(path.dirname(file), { recursive: true }); fs.writeFileSync(file, JSON.stringify(reg, null, 2)); }
 function addRepo(file, { name, path: p, config }) { const r = loadRegistry(file); r[name] = { path: p, config, addedAt: new Date().toISOString() }; saveRegistry(file, r); return r[name]; }
 function getRepo(file, name) { return loadRegistry(file)[name]; }
 function removeRepo(file, name) { const r = loadRegistry(file); delete r[name]; saveRegistry(file, r); }
-function allRepos(file) { return loadRegistry(file); }
+// The registry caches a copy of each repo's config. Auto-reload it when the
+// live .dray/config.json is newer than that snapshot, so edits take effect
+// without a manual `dray reload`. Falls back to the snapshot when the repo
+// isn't checked out here (stat throws) or its config is momentarily invalid
+// (loadRepoConfig throws) — a broken repo must not break `list`/`--all`.
+function refreshEntry(entry) {
+  try {
+    const mtime = Math.floor(fs.statSync(path.join(entry.path, '.dray', 'config.json')).mtimeMs);
+    if (mtime <= (Date.parse(entry.addedAt) || 0)) return entry;
+    return { ...entry, config: loadRepoConfig(entry.path), addedAt: new Date(mtime).toISOString() };
+  } catch { return entry; }
+}
+function allRepos(file = REGISTRY) {
+  const reg = loadRegistry(file); let changed = false;
+  for (const [n, e] of Object.entries(reg)) { const f = refreshEntry(e); if (f !== e) { reg[n] = f; changed = true; } }
+  if (changed) saveRegistry(file, reg);
+  return reg;
+}
 module.exports = { loadRegistry, saveRegistry, addRepo, getRepo, removeRepo, allRepos };

package/src/core/depsCache.js

@@ -1,6 +1,18 @@
 const fs = require('node:fs'); const path = require('node:path'); const crypto = require('node:crypto');
+const { execFileSync } = require('node:child_process');
 const { DRAY_HOME } = require('../constants');
-function needsDepsRebuild(image, repoPath, repo, stateDir = path.join(DRAY_HOME, 'depshash')) {
+
+// Whether the deps base image tag exists in the local Docker image store. A
+// `docker system prune` can evict it while the lockfiles are unchanged — the hash
+// check alone would then skip the rebuild and the main build fails at
+// `FROM <depsImage.tag>: not found`.
+function depsImagePresent(tag) {
+  try { execFileSync('docker', ['image', 'inspect', tag], { stdio: 'ignore' }); return true; }
+  catch { return false; }
+}
+
+// `imagePresent` is injectable for tests; defaults to the real docker check.
+function needsDepsRebuild(image, repoPath, repo, stateDir = path.join(DRAY_HOME, 'depshash'), imagePresent = depsImagePresent) {
   if (!image.depsImage) return false;
   const h = crypto.createHash('sha256');
   for (const rel of image.depsImage.rebuildOn || []) {
@@ -11,7 +23,9 @@ function needsDepsRebuild(image, repoPath, repo, stateDir = path.join(DRAY_HOME,
   fs.mkdirSync(stateDir, { recursive: true });
   const file = path.join(stateDir, `${repo}__${image.name}.depshash`);
   const prev = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : null;
-  if (prev === digest) return false;
+  // Rebuild when the lockfiles changed OR the cached deps image tag is gone.
+  const present = !image.depsImage.tag || imagePresent(image.depsImage.tag);
+  if (prev === digest && present) return false;
   fs.writeFileSync(file, digest); return true;
 }
-module.exports = { needsDepsRebuild };
+module.exports = { needsDepsRebuild, depsImagePresent };

package/src/core/engine.js

@@ -42,7 +42,7 @@ async function execute(steps, { dryRun = false, allowDirty = false, deps } = {})
       else if (step.kind === 'build') await d.docker.buildImage({ ecrUri: u.repoUri, sha, dockerfile: u.image.dockerfile, context: u.image.context || '.', platform: u.defaults.platform, cwd, dryRun, buildArgs: await d.buildArgs.resolveBuildArgs(u.image, cwd, { dryRun }) });
       else if (step.kind === 'push') {
         if (!loggedIn) { await d.docker.ecrLogin({ account: u.defaults.account, region: u.defaults.region, profile: u.defaults.profile, dryRun }); await d.docker.ensureRepo({ ecr: u.image.ecr, account: u.defaults.account, region: u.defaults.region, profile: u.defaults.profile, dryRun }); loggedIn = true; }
-        await d.docker.pushImage({ ecrUri: u.repoUri, sha, dryRun });
+        await d.docker.pushImage({ ecrUri: u.repoUri, sha, latest: !!u.image.latest, dryRun });
       } else if (step.kind === 'apply') {
         const vars = {}; for (const s of u.stamp) vars[s.var] = `${s.repoUri}:${sha}`;
         const files = d.render.renderManifests(u.manifests, vars, u.repoPath, { dryRun });

package/src/primitives/docker.js

@@ -6,7 +6,17 @@ function buildImage({ ecrUri, sha, dockerfile, context, platform, cwd, dryRun, b
   args.push('--load', context);
   return _run('docker', args, { cwd, dryRun });
 }
-function pushImage({ ecrUri, sha, dryRun }) { return _run('docker', ['push', `${ecrUri}:${sha}`], { dryRun }); }
+// Push the immutable :<sha> tag. When the image opts into `latest: true`, also
+// move a mutable :latest tag onto this build so workloads that reference
+// <ecr>:latest (e.g. rarely-shipped cronjobs) track the newest build without
+// being re-shipped. Never advance :latest for a dirty (`-dirty`) build.
+async function pushImage({ ecrUri, sha, latest = false, dryRun }) {
+  await _run('docker', ['push', `${ecrUri}:${sha}`], { dryRun });
+  if (latest && !String(sha).endsWith('-dirty')) {
+    await _run('docker', ['tag', `${ecrUri}:${sha}`, `${ecrUri}:latest`], { dryRun });
+    await _run('docker', ['push', `${ecrUri}:latest`], { dryRun });
+  }
+}
 function buildDeps(image, cwd, dryRun) {
   const d = image.depsImage;
   return _run('docker', ['buildx', 'build', '--platform', 'linux/arm64', '-f', d.dockerfile, '-t', d.tag, '--load', '.'], { cwd, dryRun });