@brutalsystems/dray 0.1.8 → 0.1.10

package/README.md

@@ -35,7 +35,7 @@ Requires `docker buildx`, `kubectl`, `git`, `aws`, and (for pilets/secrets) `sop
 dray                        # interactive menu
 dray list                   # registered repos + targets
 dray ship <repo>:<target>   # deps?→build→push(SHA)→render+apply→rollout
-dray ship <repo>            # all enabled workloads in the repo
+dray ship <repo>            # all enabled workloads in the repo (skips manual ones)
 dray apply  <repo>:<target> # render + apply manifests only
 dray rollout <repo>:<target>
 dray status <repo>          # running image SHA vs HEAD
@@ -72,8 +72,13 @@ Global flags: `--dry-run` (print the plan, run nothing), `--allow-dirty`
     // kind: deployment (rolled out) or cronjob (applied only)
     { "name": "app", "kind": "deployment", "image": "app",
       "manifests": [".k8s/deployment.yaml", ".k8s/service.yaml"], "stampImages": ["app"] },
-    // disabled: kept in config but skipped (e.g. served elsewhere)
+    // disabled: kept in config but skipped (e.g. served elsewhere).
+    // Targeting it by name is an error.
     { "name": "legacy", "kind": "deployment", "image": "app", "manifests": ["..."], "disabled": true },
+    // manual: deployed only by `dray ship <repo>:<name>`, never by a bare-repo
+    // ship or --all. Use it to keep a workload out of CI (which ships the bare
+    // repo) while still deploying it on demand. Its image is skipped too.
+    { "name": "jobs", "kind": "deployment", "image": "jobs", "manifests": ["..."], "manual": true },
     // image-less: apply-only (third-party image lives literally in the manifest)
     { "name": "searxng", "kind": "deployment", "manifests": [".k8s/searxng.yaml"] }
   ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@brutalsystems/dray",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Convention-driven multi-repo deploy orchestrator (forge for shipping)",
   "bin": {
     "dray": "bin/dray.js"

package/src/cli/commands/add.js

@@ -1,7 +1,20 @@
+const fs = require('node:fs'); const path = require('node:path');
 const { loadRepoConfig } = require('../../config/repo'); const { addRepo } = require('../../config/registry');
+
+// The registry is consulted from arbitrary working directories, so a stored path
+// MUST be absolute. `dray add .` used to store "." verbatim, which then resolved
+// against whatever cwd dray ran in later -- two repos added that way both pointed
+// at "the current directory", and `dray ship <a>` from repo b deployed b under a's
+// name. realpath so symlinked checkouts land on one canonical path.
+function resolveRepoPath(repoPath) {
+  const p = path.resolve(repoPath || process.cwd());
+  try { return fs.realpathSync(p); } catch { return p; }
+}
+
 module.exports = function registerAdd(program) {
   program.command('add [repoPath]').description('Register a repo').action((repoPath) => {
-    const p = repoPath || process.cwd(); const config = loadRepoConfig(p);
+    const p = resolveRepoPath(repoPath); const config = loadRepoConfig(p);
     addRepo(undefined, { name: config.name, path: p, config }); console.log(`registered ${config.name} → ${p}`);
   });
 };
+module.exports.resolveRepoPath = resolveRepoPath;

package/src/cli/commands/status.js

@@ -1,5 +1,5 @@
 const { loadGlobalConfig } = require('../../config/global'); const { allRepos } = require('../../config/registry');
-const { resolveTargets } = require('../../core/resolve'); const { runningImage } = require('../../primitives/kubectl'); const { currentSha } = require('../../primitives/git');
+const { resolveTargets } = require('../../core/resolve'); const { runningImage } = require('../../primitives/kubectl'); const { currentSha, lsRemote } = require('../../primitives/git');
 module.exports = function registerStatus(program) {
   program.command('status [target]').description('Running image SHA vs HEAD').option('--all', 'all repos')
     .action(async (target, opts) => {
@@ -7,7 +7,12 @@ module.exports = function registerStatus(program) {
       const units = resolveTargets({ registry: allRepos(), globalDefaults: defaults, spec: opts.all || !target ? '--all' : target }).filter((u) => u.workload);
       for (const u of units) {
         const live = await runningImage({ workload: u.workload, kind: u.kind, context: u.defaults.context, namespace: u.defaults.namespace });
-        const head = await currentSha(u.repoPath).catch(() => '?');
+        // A git-source image builds from its remote, not the repo `status` runs in —
+        // so compare against the remote HEAD, not the local (unrelated) repo's.
+        const src = u.image && u.image.source;
+        const head = src && src.git
+          ? await lsRemote({ git: src.git, ref: src.ref || 'HEAD' }).catch(() => '?')
+          : await currentSha(u.repoPath).catch(() => '?');
         const tag = live.includes(':') ? live.split(':').pop() : '(none)';
         console.log(`${u.repo}:${u.workload}  running ${tag}  ${tag === head ? 'up-to-date' : `behind (HEAD ${head})`}`);
       }

package/src/config/registry.js

@@ -10,16 +10,22 @@ function removeRepo(file, name) { const r = loadRegistry(file); delete r[name];
 // without a manual `dray reload`. Falls back to the snapshot when the repo
 // isn't checked out here (stat throws) or its config is momentarily invalid
 // (loadRepoConfig throws) — a broken repo must not break `list`/`--all`.
-function refreshEntry(entry) {
+function refreshEntry(entry, name) {
   try {
     const mtime = Math.floor(fs.statSync(path.join(entry.path, '.dray', 'config.json')).mtimeMs);
     if (mtime <= (Date.parse(entry.addedAt) || 0)) return entry;
-    return { ...entry, config: loadRepoConfig(entry.path), addedAt: new Date(mtime).toISOString() };
+    const config = loadRepoConfig(entry.path);
+    // Only adopt a config that still belongs to this entry. A path pointing at a
+    // different project (a relative path left by an old `dray add .`, or a moved
+    // checkout) would otherwise have its config silently written into this key and
+    // PERSISTED -- turning `dray ship <name>` into a deploy of someone else's repo.
+    if (name !== undefined && config.name !== name) return entry;
+    return { ...entry, config, addedAt: new Date(mtime).toISOString() };
   } catch { return entry; }
 }
 function allRepos(file = REGISTRY) {
   const reg = loadRegistry(file); let changed = false;
-  for (const [n, e] of Object.entries(reg)) { const f = refreshEntry(e); if (f !== e) { reg[n] = f; changed = true; } }
+  for (const [n, e] of Object.entries(reg)) { const f = refreshEntry(e, n); if (f !== e) { reg[n] = f; changed = true; } }
   if (changed) saveRegistry(file, reg);
   return reg;
 }

package/src/config/repo.js

@@ -21,6 +21,14 @@ function validateRepoConfig(cfg) {
     if (!WORKLOAD_KINDS.has(w.kind)) e.push(`workload "${w.name}" kind must be deployment|cronjob`);
     if (w.image !== undefined && !imageNames.has(w.image)) e.push(`workload "${w.name}" references unknown image "${w.image}"`);
     if (!Array.isArray(w.manifests) || w.manifests.length === 0) e.push(`workload "${w.name}" needs a non-empty manifests list`);
+    // Both gate deployment on truthiness, so a JSON string ("false", "no") would
+    // silently skip the workload -- in `manual`'s case, silently drop it from CI.
+    // Fail loud instead of deploying something different from what was meant.
+    for (const flag of ['disabled', 'manual']) {
+      if (w[flag] !== undefined && typeof w[flag] !== 'boolean') {
+        e.push(`workload "${w.name}" ${flag} must be a boolean, got ${typeof w[flag]}`);
+      }
+    }
   }
   for (const s of cfg.secrets || []) {
     if (!s.name) e.push('secret missing name');

package/src/core/engine.js

@@ -37,7 +37,12 @@ async function execute(steps, { dryRun = false, allowDirty = false, deps } = {})
       }
       const sha = await shaForUnit(u, d, shaCache, dryRun, allowDirty);
       if (u._clone && !clones.includes(u._clone)) clones.push(u._clone);
-      const cwd = u._clone ? u._clone.dir : u.repoPath;
+      // Real builds use the clone dir. On dry-run we skip the clone, so show the
+      // git source (not the local repo `dray` was invoked from) — otherwise the
+      // printed command misleadingly implies the local Dockerfile is built.
+      const src = u.image && u.image.source;
+      const cwd = u._clone ? u._clone.dir
+        : (dryRun && src && src.git ? `<git ${src.git}@${src.ref || 'HEAD'} — cloned at build>` : u.repoPath);
       if (step.kind === 'deps') { if (d.depsCache.needsDepsRebuild(u.image, cwd, u.repo)) await d.docker.buildDeps(u.image, cwd, dryRun); }
       else if (step.kind === 'build') await d.docker.buildImage({ ecrUri: u.repoUri, sha, dockerfile: u.image.dockerfile, context: u.image.context || '.', platform: u.defaults.platform, cwd, dryRun, buildArgs: await d.buildArgs.resolveBuildArgs(u.image, cwd, { dryRun }) });
       else if (step.kind === 'push') {

package/src/core/resolve.js

@@ -38,6 +38,13 @@ function unitsForRepo(name, entry, globalDefaults, filter) {
       }
       continue;
     }
+    // Deployed only when explicitly targeted (dray ship repo:name). Skipped by a
+    // bare-repo ship and --all -- that is what CI runs, so `manual` keeps a
+    // workload out of the automatic pipeline while still allowing an on-demand
+    // deploy. Unlike `disabled`, targeting it by name is not an error. The image
+    // is skipped with it: the image-only fallback below only fires when NO
+    // workload claims the image, and a skipped manual workload still claims it.
+    if (w.manual && !filter) continue;
     mk(images.get(w.image), w);
   }
   for (const img of images.values()) {

package/src/primitives/git.js

@@ -2,6 +2,10 @@ const fs = require('node:fs'); const os = require('node:os'); const path = requi
 const { run } = require('./exec');
 async function currentSha(cwd) { const { stdout } = await run('git', ['rev-parse', '--short', 'HEAD'], { cwd, capture: true }); return stdout.trim(); }
 async function isDirty(cwd) { const { stdout } = await run('git', ['status', '--porcelain'], { cwd, capture: true }); return stdout.trim().length > 0; }
+// The HEAD sha of a git-source image's REMOTE ref, without cloning — so `status`
+// compares against the actual build source, not the local repo it happens to be
+// invoked from. Short form to match `currentSha`.
+async function lsRemote({ git, ref }) { const { stdout } = await run('git', ['ls-remote', git, ref], { capture: true }); return (stdout.trim().split(/\s+/)[0] || '').slice(0, 7); }
 async function cloneToTmp({ git, ref }) {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'dray-clone-'));
   // Works for branch/tag refs always; arbitrary commit SHAs require the remote
@@ -13,4 +17,4 @@ async function cloneToTmp({ git, ref }) {
   const sha = await currentSha(dir);
   return { dir, sha, cleanup: () => fs.rmSync(dir, { recursive: true, force: true }) };
 }
-module.exports = { currentSha, isDirty, cloneToTmp };
+module.exports = { currentSha, isDirty, cloneToTmp, lsRemote };