@brutalsystems/dray 0.1.7 → 0.1.9

package/README.md

@@ -35,7 +35,7 @@ Requires `docker buildx`, `kubectl`, `git`, `aws`, and (for pilets/secrets) `sop
 dray                        # interactive menu
 dray list                   # registered repos + targets
 dray ship <repo>:<target>   # deps?→build→push(SHA)→render+apply→rollout
-dray ship <repo>            # all enabled workloads in the repo
+dray ship <repo>            # all enabled workloads in the repo (skips manual ones)
 dray apply  <repo>:<target> # render + apply manifests only
 dray rollout <repo>:<target>
 dray status <repo>          # running image SHA vs HEAD
@@ -72,8 +72,13 @@ Global flags: `--dry-run` (print the plan, run nothing), `--allow-dirty`
     // kind: deployment (rolled out) or cronjob (applied only)
     { "name": "app", "kind": "deployment", "image": "app",
       "manifests": [".k8s/deployment.yaml", ".k8s/service.yaml"], "stampImages": ["app"] },
-    // disabled: kept in config but skipped (e.g. served elsewhere)
+    // disabled: kept in config but skipped (e.g. served elsewhere).
+    // Targeting it by name is an error.
     { "name": "legacy", "kind": "deployment", "image": "app", "manifests": ["..."], "disabled": true },
+    // manual: deployed only by `dray ship <repo>:<name>`, never by a bare-repo
+    // ship or --all. Use it to keep a workload out of CI (which ships the bare
+    // repo) while still deploying it on demand. Its image is skipped too.
+    { "name": "jobs", "kind": "deployment", "image": "jobs", "manifests": ["..."], "manual": true },
     // image-less: apply-only (third-party image lives literally in the manifest)
     { "name": "searxng", "kind": "deployment", "manifests": [".k8s/searxng.yaml"] }
   ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/dray",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Convention-driven multi-repo deploy orchestrator (forge for shipping)",
   "bin": {
     "dray": "bin/dray.js"

package/src/cli/commands/status.js

@@ -1,5 +1,5 @@
 const { loadGlobalConfig } = require('../../config/global'); const { allRepos } = require('../../config/registry');
-const { resolveTargets } = require('../../core/resolve'); const { runningImage } = require('../../primitives/kubectl'); const { currentSha } = require('../../primitives/git');
+const { resolveTargets } = require('../../core/resolve'); const { runningImage } = require('../../primitives/kubectl'); const { currentSha, lsRemote } = require('../../primitives/git');
 module.exports = function registerStatus(program) {
   program.command('status [target]').description('Running image SHA vs HEAD').option('--all', 'all repos')
     .action(async (target, opts) => {
@@ -7,7 +7,12 @@ module.exports = function registerStatus(program) {
       const units = resolveTargets({ registry: allRepos(), globalDefaults: defaults, spec: opts.all || !target ? '--all' : target }).filter((u) => u.workload);
       for (const u of units) {
         const live = await runningImage({ workload: u.workload, kind: u.kind, context: u.defaults.context, namespace: u.defaults.namespace });
-        const head = await currentSha(u.repoPath).catch(() => '?');
+        // A git-source image builds from its remote, not the repo `status` runs in —
+        // so compare against the remote HEAD, not the local (unrelated) repo's.
+        const src = u.image && u.image.source;
+        const head = src && src.git
+          ? await lsRemote({ git: src.git, ref: src.ref || 'HEAD' }).catch(() => '?')
+          : await currentSha(u.repoPath).catch(() => '?');
         const tag = live.includes(':') ? live.split(':').pop() : '(none)';
         console.log(`${u.repo}:${u.workload}  running ${tag}  ${tag === head ? 'up-to-date' : `behind (HEAD ${head})`}`);
       }

package/src/config/repo.js

@@ -21,6 +21,14 @@ function validateRepoConfig(cfg) {
     if (!WORKLOAD_KINDS.has(w.kind)) e.push(`workload "${w.name}" kind must be deployment|cronjob`);
     if (w.image !== undefined && !imageNames.has(w.image)) e.push(`workload "${w.name}" references unknown image "${w.image}"`);
     if (!Array.isArray(w.manifests) || w.manifests.length === 0) e.push(`workload "${w.name}" needs a non-empty manifests list`);
+    // Both gate deployment on truthiness, so a JSON string ("false", "no") would
+    // silently skip the workload -- in `manual`'s case, silently drop it from CI.
+    // Fail loud instead of deploying something different from what was meant.
+    for (const flag of ['disabled', 'manual']) {
+      if (w[flag] !== undefined && typeof w[flag] !== 'boolean') {
+        e.push(`workload "${w.name}" ${flag} must be a boolean, got ${typeof w[flag]}`);
+      }
+    }
   }
   for (const s of cfg.secrets || []) {
     if (!s.name) e.push('secret missing name');

package/src/core/depsCache.js

@@ -1,6 +1,18 @@
 const fs = require('node:fs'); const path = require('node:path'); const crypto = require('node:crypto');
+const { execFileSync } = require('node:child_process');
 const { DRAY_HOME } = require('../constants');
-function needsDepsRebuild(image, repoPath, repo, stateDir = path.join(DRAY_HOME, 'depshash')) {
+
+// Whether the deps base image tag exists in the local Docker image store. A
+// `docker system prune` can evict it while the lockfiles are unchanged — the hash
+// check alone would then skip the rebuild and the main build fails at
+// `FROM <depsImage.tag>: not found`.
+function depsImagePresent(tag) {
+  try { execFileSync('docker', ['image', 'inspect', tag], { stdio: 'ignore' }); return true; }
+  catch { return false; }
+}
+
+// `imagePresent` is injectable for tests; defaults to the real docker check.
+function needsDepsRebuild(image, repoPath, repo, stateDir = path.join(DRAY_HOME, 'depshash'), imagePresent = depsImagePresent) {
   if (!image.depsImage) return false;
   const h = crypto.createHash('sha256');
   for (const rel of image.depsImage.rebuildOn || []) {
@@ -11,7 +23,9 @@ function needsDepsRebuild(image, repoPath, repo, stateDir = path.join(DRAY_HOME,
   fs.mkdirSync(stateDir, { recursive: true });
   const file = path.join(stateDir, `${repo}__${image.name}.depshash`);
   const prev = fs.existsSync(file) ? fs.readFileSync(file, 'utf8') : null;
-  if (prev === digest) return false;
+  // Rebuild when the lockfiles changed OR the cached deps image tag is gone.
+  const present = !image.depsImage.tag || imagePresent(image.depsImage.tag);
+  if (prev === digest && present) return false;
   fs.writeFileSync(file, digest); return true;
 }
-module.exports = { needsDepsRebuild };
+module.exports = { needsDepsRebuild, depsImagePresent };

package/src/core/engine.js

@@ -37,7 +37,12 @@ async function execute(steps, { dryRun = false, allowDirty = false, deps } = {})
       }
       const sha = await shaForUnit(u, d, shaCache, dryRun, allowDirty);
       if (u._clone && !clones.includes(u._clone)) clones.push(u._clone);
-      const cwd = u._clone ? u._clone.dir : u.repoPath;
+      // Real builds use the clone dir. On dry-run we skip the clone, so show the
+      // git source (not the local repo `dray` was invoked from) — otherwise the
+      // printed command misleadingly implies the local Dockerfile is built.
+      const src = u.image && u.image.source;
+      const cwd = u._clone ? u._clone.dir
+        : (dryRun && src && src.git ? `<git ${src.git}@${src.ref || 'HEAD'} — cloned at build>` : u.repoPath);
       if (step.kind === 'deps') { if (d.depsCache.needsDepsRebuild(u.image, cwd, u.repo)) await d.docker.buildDeps(u.image, cwd, dryRun); }
       else if (step.kind === 'build') await d.docker.buildImage({ ecrUri: u.repoUri, sha, dockerfile: u.image.dockerfile, context: u.image.context || '.', platform: u.defaults.platform, cwd, dryRun, buildArgs: await d.buildArgs.resolveBuildArgs(u.image, cwd, { dryRun }) });
       else if (step.kind === 'push') {

package/src/core/resolve.js

@@ -38,6 +38,13 @@ function unitsForRepo(name, entry, globalDefaults, filter) {
       }
       continue;
     }
+    // Deployed only when explicitly targeted (dray ship repo:name). Skipped by a
+    // bare-repo ship and --all -- that is what CI runs, so `manual` keeps a
+    // workload out of the automatic pipeline while still allowing an on-demand
+    // deploy. Unlike `disabled`, targeting it by name is not an error. The image
+    // is skipped with it: the image-only fallback below only fires when NO
+    // workload claims the image, and a skipped manual workload still claims it.
+    if (w.manual && !filter) continue;
     mk(images.get(w.image), w);
   }
   for (const img of images.values()) {

package/src/primitives/git.js

@@ -2,6 +2,10 @@ const fs = require('node:fs'); const os = require('node:os'); const path = requi
 const { run } = require('./exec');
 async function currentSha(cwd) { const { stdout } = await run('git', ['rev-parse', '--short', 'HEAD'], { cwd, capture: true }); return stdout.trim(); }
 async function isDirty(cwd) { const { stdout } = await run('git', ['status', '--porcelain'], { cwd, capture: true }); return stdout.trim().length > 0; }
+// The HEAD sha of a git-source image's REMOTE ref, without cloning — so `status`
+// compares against the actual build source, not the local repo it happens to be
+// invoked from. Short form to match `currentSha`.
+async function lsRemote({ git, ref }) { const { stdout } = await run('git', ['ls-remote', git, ref], { capture: true }); return (stdout.trim().split(/\s+/)[0] || '').slice(0, 7); }
 async function cloneToTmp({ git, ref }) {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dray-clone-'));
   // Works for branch/tag refs always; arbitrary commit SHAs require the remote
@@ -13,4 +17,4 @@ async function cloneToTmp({ git, ref }) {
   const sha = await currentSha(dir);
   return { dir, sha, cleanup: () => fs.rmSync(dir, { recursive: true, force: true }) };
 }
-module.exports = { currentSha, isDirty, cloneToTmp };
+module.exports = { currentSha, isDirty, cloneToTmp, lsRemote };