@empire-builder-kit/nx 1.0.0-rc.38 → 1.0.0-rc.39

package/src/generators/slice/built-in-plan-data-retention-launcher-files.js

@@ -4,7 +4,8 @@ exports.renderProductDataRetentionLauncherFiles = renderProductDataRetentionLaun
 /** @internal */
 function renderProductDataRetentionLauncherFiles(name) {
     return {
-        'scripts/data-retention.mjs': `import { randomUUID } from 'node:crypto';
+        'scripts/data-retention.mjs': `import { execFileSync } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { dirname, join, resolve } from 'node:path';
@@ -44,9 +45,9 @@ if (
     'Retention apply requires exact UUID --run-ref and --approval-request values.',
   );
 }
-if (report && (requestedRunId || approvalRequestId)) {
+if (report && (approvalRequestId !== undefined || (requestedRunId !== undefined && !UUID.test(requestedRunId)))) {
   throw new Error(
-    'Retention report creates a new run and accepts no references.',
+    'Retention report accepts only an optional exact UUID --run-ref to resume, never an approval reference.',
   );
 }
 const stage =
@@ -57,8 +58,29 @@ const stages = resolveFoundationStages({
   foundationStage:
     argument('foundation-stage') ?? process.env.EBK_FOUNDATION_STAGE,
 });
+const workspaceRoot = resolve(import.meta.dirname, '../../..');
+// Caller source metadata, not deployment or retention-apply authority. The
+// deployed worker independently enforces its workload and approved run.
+let sourceCommit = process.env.EBK_SOURCE_COMMIT;
+if (sourceCommit === undefined) {
+  try {
+    sourceCommit = execFileSync('git', ['rev-parse', '--verify', 'HEAD^{commit}'], {
+      cwd: workspaceRoot,
+      env: Object.fromEntries(Object.entries(process.env).filter(([key]) => !key.startsWith('GIT_'))),
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 10000,
+      windowsHide: true,
+    }).trim();
+  } catch {
+    throw new Error('Retention source identity requires a readable workspace HEAD or a full EBK_SOURCE_COMMIT.');
+  }
+}
+if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(sourceCommit)) {
+  throw new Error('Retention source identity requires a full commit SHA.');
+}
 const ownership = await assertWorkspaceStageOwnershipForWorkspace(
-  resolve(import.meta.dirname, '../../..'),
+  workspaceRoot,
   stages.consumerStage,
   {
     ...(process.env.AWS_PROFILE ? { profile: process.env.AWS_PROFILE } : {}),
@@ -100,9 +122,10 @@ const started = await sfn.send(
       asOf,
       correlationId: randomUUID(),
       mode: apply ? 'apply' : 'report',
+      ...(report && requestedRunId ? { resume: true } : {}),
       runId,
       slice: '${name}',
-      sourceCommit: process.env.EBK_SOURCE_COMMIT ?? 'unresolved',
+      sourceCommit,
       stage: stages.consumerStage,
     }),
     name:
@@ -136,7 +159,8 @@ if (execution?.status !== 'SUCCEEDED' || !execution.output) {
   throw new Error(
     'Retention workflow failed with status ' +
       (execution?.status ?? 'timeout') +
-      '. Inspect its content-free workflow logs.',
+      '. Inspect its content-free workflow logs.' +
+      (report ? ' Resume this report from its original source: EBK_SOURCE_COMMIT=' + sourceCommit + ' pnpm nx run ${name}:data-retention -- --report --stage=' + stages.consumerStage + ' --run-ref=' + runId + '. Keep the original source/artifacts; a different source cannot resume this run.' : ''),
   );
 }
 const result = JSON.parse(execution.output);