@hellopearl/dv-gitlab 0.4.4 → 0.5.0

package/src/commands/migration-contract.mjs

@@ -0,0 +1,318 @@
+import { execFileSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import { basename } from 'node:path';
+
+import { log } from '../lib/logger.mjs';
+
+/** Destructive operations that break N-1 compatibility. */
+export const DESTRUCTIVE_RULES = [
+  { re: /\bdropColumns?\s*\(/, rule: 'dropColumn' },
+  { re: /\bdropTable(IfExists)?\s*\(/, rule: 'dropTable' },
+  { re: /\brenameColumn\s*\(/, rule: 'renameColumn' },
+  { re: /\brenameTable\s*\(/, rule: 'renameTable' },
+  { re: /\.alter\s*\(/, rule: '.alter()' },
+  { re: /\bDROP\s+TABLE\b/i, rule: 'raw DROP TABLE' },
+  { re: /\bDROP\s+COLUMN\b/i, rule: 'raw DROP COLUMN' },
+  { re: /\bALTER\s+COLUMN\b/i, rule: 'raw ALTER COLUMN' },
+  { re: /\bRENAME\s+(TO|COLUMN)\b/i, rule: 'raw RENAME' },
+];
+
+const ACK_RE = /^\s*(\/\/|\*)\s*contract-ack:\s*\S+/m;
+
+/**
+ * True when the file carries an acknowledgement with a stated reason.
+ * @param {string} source
+ * @returns {boolean}
+ */
+export function hasContractAck(source) {
+  return ACK_RE.test(source);
+}
+
+/**
+ * Blanks out block comments and whole-line // comments, preserving line
+ * numbering so reported lines still point at the real file.
+ * @param {string} source
+ * @returns {string}
+ */
+export function stripComments(source) {
+  const withoutBlocks = source.replace(/\/\*[\s\S]*?\*\//g, m =>
+    m.replace(/[^\n]/g, ' '),
+  );
+  return withoutBlocks
+    .split('\n')
+    .map(line => (/^\s*\/\//.test(line) ? '' : line))
+    .join('\n');
+}
+
+const DOWN_RE =
+  /^\s*(?:export\s+(?:async\s+)?function\s+down\b|export\s+const\s+down\s*=|exports\.down\s*=|module\.exports\.down\s*=)/m;
+
+/**
+ * Index just past the `}` that closes the brace opened at `open`.
+ * @param {string} source
+ * @param {number} open
+ * @returns {number}
+ */
+function matchBraces(source, open) {
+  let depth = 0;
+  let quote = null;
+  for (let i = open; i < source.length; i++) {
+    const c = source[i];
+    if (quote) {
+      if (c === '\\') {
+        i += 1;
+      } else if (c === quote) {
+        quote = null;
+      }
+    } else if (c === "'" || c === '"' || c === '`') {
+      quote = c;
+    } else if (c === '{') {
+      depth += 1;
+    } else if (c === '}') {
+      depth -= 1;
+      if (depth === 0) {
+        return i + 1;
+      }
+    }
+  }
+  return source.length;
+}
+
+/**
+ * Index just past the `;` that ends the expression starting at `from`.
+ * @param {string} source
+ * @param {number} from
+ * @returns {number}
+ */
+function endOfExpression(source, from) {
+  let depth = 0;
+  let quote = null;
+  for (let i = from; i < source.length; i++) {
+    const c = source[i];
+    if (quote) {
+      if (c === '\\') {
+        i += 1;
+      } else if (c === quote) {
+        quote = null;
+      }
+    } else if (c === "'" || c === '"' || c === '`') {
+      quote = c;
+    } else if (c === '(' || c === '[' || c === '{') {
+      depth += 1;
+    } else if (c === ')' || c === ']' || c === '}') {
+      depth -= 1;
+    } else if (c === ';' && depth === 0) {
+      return i + 1;
+    }
+  }
+  return source.length;
+}
+
+/**
+ * Returns the whole file with the down() body blanked out.
+ * @param {string} source - comment-stripped source
+ * @returns {string}
+ */
+export function blankDownBlock(source) {
+  const downMatch = DOWN_RE.exec(source);
+  if (!downMatch) {
+    return source;
+  }
+
+  const start = downMatch.index;
+  const declEnd = start + downMatch[0].length;
+
+  const brace = source.indexOf('{', declEnd);
+  const arrow = source.indexOf('=>', declEnd);
+
+  let end;
+  if (arrow !== -1 && (brace === -1 || arrow < brace)) {
+    const body = arrow + 2;
+    const token = /\S/.exec(source.slice(body));
+    end =
+      token && token[0] === '{'
+        ? matchBraces(source, body + token.index)
+        : endOfExpression(source, body);
+  } else if (brace !== -1) {
+    end = matchBraces(source, brace);
+  } else {
+    end = source.length;
+  }
+
+  return (
+    source.slice(0, start) +
+    source.slice(start, end).replace(/[^\n]/g, ' ') +
+    source.slice(end)
+  );
+}
+
+/**
+ * @param {string} source - raw file contents
+ * @returns {{ rule: string, line: number, text: string }[]}
+ */
+export function findViolations(source) {
+  const scannable = blankDownBlock(stripComments(source));
+  const violations = [];
+
+  scannable.split('\n').forEach((text, i) => {
+    for (const { rule, re } of DESTRUCTIVE_RULES) {
+      if (re.test(text)) {
+        violations.push({ line: i + 1, rule, text: text.trim() });
+      }
+    }
+  });
+  return violations;
+}
+
+/**
+ * Verdict for one migration file.
+ * @param {string} path
+ * @param {string} source
+ * @param {Set<string>} [grandfathered]
+ * @returns {{ path: string, violations: object[], acked: boolean, ok: boolean, grandfathered: boolean }}
+ */
+export function checkFile(path, source, grandfathered = new Set()) {
+  if (grandfathered.has(basename(path))) {
+    return {
+      acked: false,
+      grandfathered: true,
+      ok: true,
+      path,
+      violations: [],
+    };
+  }
+  const violations = findViolations(source);
+  const acked = hasContractAck(source);
+  return {
+    acked,
+    grandfathered: false,
+    ok: violations.length === 0 || acked,
+    path,
+    violations,
+  };
+}
+
+/**
+ * Migration files added or modified relative to baseRef.
+ * @param {string} baseRef
+ * @param {string} [migrationsDir]
+ * @returns {string[]}
+ */
+export function changedMigrationFiles(baseRef, migrationsDir = 'migrations/') {
+  const out = execFileSync(
+    'git',
+    [
+      'diff',
+      '--no-renames',
+      '--name-only',
+      '--diff-filter=AM',
+      `${baseRef}...HEAD`,
+      '--',
+      migrationsDir,
+    ],
+    { encoding: 'utf8' },
+  );
+  return out
+    .split('\n')
+    .map(s => s.trim())
+    .filter(s => s.endsWith('.js'));
+}
+
+/**
+ * Resolves the base ref from environment or CLI arg.
+ * @param {Record<string, string>} env
+ * @param {string} [argBase]
+ * @returns {string | undefined}
+ */
+export function resolveBaseRef(env, argBase) {
+  return (
+    argBase ||
+    env.CI_MERGE_REQUEST_DIFF_BASE_SHA ||
+    (env.CI_MERGE_REQUEST_TARGET_BRANCH_NAME
+      ? `origin/${env.CI_MERGE_REQUEST_TARGET_BRANCH_NAME}`
+      : undefined)
+  );
+}
+
+/**
+ * CLI entry point for the migration contract checker.
+ * @param {Record<string, string>} flags
+ */
+export function migrationContract(flags) {
+  const grandfatheredList = (flags.grandfathered || '')
+    .split(',')
+    .filter(Boolean);
+  const grandfathered = new Set(grandfatheredList);
+  const migrationsDir = flags['migrations-dir'] || 'migrations/';
+
+  const baseRef = resolveBaseRef(process.env, flags['base-ref']);
+  if (!baseRef) {
+    log(
+      '[migration-contract] no base ref — pass --base-ref or set CI_MERGE_REQUEST_DIFF_BASE_SHA',
+    );
+    process.exit(2);
+  }
+
+  let files;
+  try {
+    files = changedMigrationFiles(baseRef, migrationsDir);
+  } catch (err) {
+    log(
+      `[migration-contract] could not diff against ${baseRef}: ${err.message}`,
+    );
+    process.exit(2);
+  }
+
+  if (files.length === 0) {
+    log(
+      '[migration-contract] no migrations added or changed — nothing to check',
+    );
+    return;
+  }
+
+  log(
+    `[migration-contract] checking ${files.length} migration(s) against ${baseRef}`,
+  );
+
+  const failures = [];
+  for (const path of files) {
+    const result = checkFile(path, readFileSync(path, 'utf8'), grandfathered);
+    if (result.grandfathered) {
+      log(`  skipped   ${path} (predates this check; already applied)`);
+    } else if (result.violations.length === 0) {
+      log(`  ok        ${path}`);
+    } else if (result.acked) {
+      log(
+        `  ack'd     ${path} (${result.violations.map(v => v.rule).join(', ')})`,
+      );
+    } else {
+      log(`  BLOCKED   ${path}`);
+      for (const v of result.violations) {
+        log(`              line ${v.line}: ${v.rule} — ${v.text}`);
+      }
+      failures.push(result);
+    }
+  }
+
+  if (failures.length === 0) {
+    return;
+  }
+
+  log(`
+[migration-contract] ${failures.length} migration(s) would make a rollback impossible.
+
+Migrations run on pod boot. During a canary the new pod migrates the shared
+database while stable pods still serve the old code, and an abort does not
+un-migrate — so dropping or renaming something strands the release you would
+roll back to.
+
+Split it: expand now (add the new column/table, backfill, dual-write), contract
+in a later release once nothing reads the old shape.
+
+If it really is safe today — the column was added this same release, or nothing
+has ever read it — say so in the migration file and this check will pass:
+
+    // contract-ack: <why this is safe to ship now>
+`);
+  process.exit(1);
+}

package/src/commands/postbuild.mjs

@@ -1,3 +1,4 @@
+/* eslint-disable no-use-before-define */
 import { GitLabClient } from '../lib/gitlab-client.mjs';
 import { debug, log } from '../lib/logger.mjs';
 import { renderTemplate } from '../lib/template.mjs';
@@ -44,44 +45,118 @@ function resolveProjectId() {
 }
 
 async function triggerPipelineSimple() {
-  const pipelineUrl = env('QA_PIPELINE_URL');
-  const token = process.env.QA_PIPELINE_TRIGGER_TOKEN || resolveToken();
+  const triggerToken = process.env.QA_PIPELINE_TRIGGER_TOKEN || '';
+  const apiToken = resolveToken();
 
-  if (!token || !pipelineUrl) {
-    log('[postbuild] missing pipeline trigger config -- skipping');
+  if (!triggerToken && !apiToken) {
+    log('[postbuild] no trigger token available -- skipping');
     return;
   }
 
-  const payload = {
-    inputs: {
-      capture: process.env.QA_PIPELINE_CAPTURE || '',
-      environment: process.env.QA_PIPELINE_ENVIRONMENT || '',
-      project: process.env.QA_PIPELINE_PROJECT || '',
-      scope: process.env.QA_PIPELINE_SCOPE || '',
-    },
-    ref: process.env.QA_PIPELINE_REF || '',
+  const ref = process.env.QA_PIPELINE_REF || 'main';
+  const variables = {
+    CAPTURE: process.env.QA_PIPELINE_CAPTURE || '',
+    ENV: process.env.QA_PIPELINE_ENVIRONMENT || '',
+    PROJECT: process.env.QA_PIPELINE_PROJECT || '',
+    SCOPE: process.env.QA_PIPELINE_SCOPE || '',
   };
 
-  debug(`[trigger-simple] payload=${JSON.stringify(payload)}`);
-
-  const res = await fetch(pipelineUrl, {
-    body: JSON.stringify(payload),
-    headers: {
-      'Content-Type': 'application/json',
-      'PRIVATE-TOKEN': token,
-    },
-    method: 'POST',
+  const res = await triggerQaPipeline({
+    apiToken,
+    ref,
+    triggerToken,
+    variables,
   });
 
-  if (res.ok) {
-    log(`[postbuild] QA pipeline triggered (http=${res.status})`);
-  } else {
-    log(`[postbuild] QA pipeline trigger failed (http=${res.status})`);
+  if (res) {
+    log(`[postbuild] QA pipeline triggered id=${res.id}`);
   }
 }
 
 /**
- * @param {{token: string, projectId: string, mrIid: string, branch: string, appId: string}} opts
+ * Triggers a pipeline on pearl-test-automation.
+ * Prefers the pipeline trigger token (/trigger/pipeline endpoint) which
+ * requires no cross-project access. Falls back to the regular pipeline API
+ * with a PAT/project token if no trigger token is set.
+ */
+async function triggerQaPipeline({
+  triggerToken,
+  apiToken,
+  ref,
+  variables,
+  extraVars = [],
+}) {
+  const projectId = process.env.QA_PROJECT_ID || '59469690';
+  const base = 'https://gitlab.com/api/v4/projects';
+
+  if (triggerToken) {
+    const form = new URLSearchParams();
+    form.append('token', triggerToken);
+    form.append('ref', ref);
+    for (const [k, v] of Object.entries(variables)) {
+      if (v) {
+        form.append(`variables[${k}]`, v);
+      }
+    }
+    for (const { key, value } of extraVars) {
+      form.append(`variables[${key}]`, value);
+    }
+
+    debug(`[trigger] POST /trigger/pipeline vars=${JSON.stringify(variables)}`);
+
+    const res = await fetch(`${base}/${projectId}/trigger/pipeline`, {
+      body: form,
+      method: 'POST',
+    });
+
+    if (!res.ok) {
+      const body = await res.text();
+      log(`[postbuild] pipeline trigger failed (http=${res.status}) ${body}`);
+      return null;
+    }
+
+    const data = await res.json();
+    return { id: data.id, webUrl: data.web_url };
+  }
+
+  if (apiToken) {
+    const payload = {
+      ref,
+      variables: [
+        ...Object.entries(variables)
+          .filter(([, v]) => v)
+          .map(([key, value]) => ({ key, value })),
+        ...extraVars,
+      ],
+    };
+
+    debug(`[trigger] POST /pipeline payload=${JSON.stringify(payload)}`);
+
+    const res = await fetch(`${base}/${projectId}/pipeline`, {
+      body: JSON.stringify(payload),
+      headers: {
+        'Content-Type': 'application/json',
+        'PRIVATE-TOKEN': apiToken,
+      },
+      method: 'POST',
+    });
+
+    if (!res.ok) {
+      const body = await res.text();
+      log(`[postbuild] pipeline trigger failed (http=${res.status}) ${body}`);
+      return null;
+    }
+
+    const data = await res.json();
+    return { id: data.id, webUrl: data.web_url };
+  }
+
+  log('[postbuild] no token available for pipeline trigger');
+  return null;
+}
+
+/**
+ * @param {{token: string, projectId: string, mrIid: string, branch: string, appId: string, previewUrl: string}} opts
  * @returns {Promise<{id: number, webUrl: string} | null>}
  */
 async function triggerPipelinePreview({
@@ -92,53 +167,41 @@ async function triggerPipelinePreview({
   appId,
   previewUrl,
 }) {
-  const pipelineUrl = process.env.QA_PIPELINE_URL;
-  const triggerToken = process.env.QA_PIPELINE_TRIGGER_TOKEN || token;
+  const triggerToken = process.env.QA_PIPELINE_TRIGGER_TOKEN || '';
 
-  if (!pipelineUrl) {
-    log('[postbuild] QA_PIPELINE_URL not set -- skipping trigger');
+  if (!triggerToken && !token) {
+    log('[postbuild] no trigger token available -- skipping');
     return null;
   }
 
-  const payload = {
-    inputs: {
-      capture: process.env.QA_PIPELINE_CAPTURE || '',
-      environment: process.env.QA_PIPELINE_ENVIRONMENT || '',
-      project: process.env.QA_PIPELINE_PROJECT || '',
-      scope: process.env.QA_PIPELINE_SCOPE || '',
-    },
-    ref: process.env.QA_PIPELINE_REF || '',
-    variables: [
-      { key: 'SOURCE_PROJECT_ID', value: projectId },
-      { key: 'SOURCE_MR_IID', value: mrIid },
-      { key: 'BRANCH', value: branch },
-      { key: 'AMPLIFY_APP_ID', value: appId },
-      { key: 'PREVIEW_DOMAIN', value: process.env.PREVIEW_DOMAIN || '' },
-      { key: 'PREVIEW_URL', value: previewUrl || '' },
-    ],
+  const ref = process.env.QA_PIPELINE_REF || 'main';
+  const variables = {
+    CAPTURE: process.env.QA_PIPELINE_CAPTURE || '',
+    ENV: process.env.QA_PIPELINE_ENVIRONMENT || '',
+    PROJECT: process.env.QA_PIPELINE_PROJECT || '',
+    SCOPE: process.env.QA_PIPELINE_SCOPE || '',
   };
+  const extraVars = [
+    { key: 'SOURCE_PROJECT_ID', value: projectId },
+    { key: 'SOURCE_MR_IID', value: mrIid },
+    { key: 'BRANCH', value: branch },
+    { key: 'AMPLIFY_APP_ID', value: appId },
+    { key: 'PREVIEW_DOMAIN', value: process.env.PREVIEW_DOMAIN || '' },
+    { key: 'PREVIEW_URL', value: previewUrl || '' },
+  ];
 
-  debug(`[trigger-preview] payload=${JSON.stringify(payload)}`);
-
-  const res = await fetch(pipelineUrl, {
-    body: JSON.stringify(payload),
-    headers: {
-      'Content-Type': 'application/json',
-      'PRIVATE-TOKEN': triggerToken,
-    },
-    method: 'POST',
+  const result = await triggerQaPipeline({
+    apiToken: token,
+    extraVars,
+    ref,
+    triggerToken,
+    variables,
   });
 
-  debug(`[trigger-preview] http=${res.status}`);
-
-  if (!res.ok) {
-    log(`[postbuild] pipeline trigger failed (http=${res.status})`);
-    return null;
+  if (result) {
+    log(`[postbuild] pipeline triggered id=${result.id} url=${result.webUrl}`);
   }
-
-  const data = await res.json();
-  log(`[postbuild] pipeline triggered id=${data.id} url=${data.web_url}`);
-  return { id: data.id, webUrl: data.web_url };
+  return result;
 }
 
 /**
@@ -181,10 +244,19 @@ export async function postbuild() {
 
   const projectId = resolveProjectId();
   const client = new GitLabClient({ token });
-  const mr = await client.findOpenMr(projectId, branch);
+  let mr = await client.findOpenMr(projectId, branch);
 
   if (!mr) {
-    log(`[postbuild] no open MR for branch=${branch} -- skipping`);
+    const retrySec = parseInt(process.env.POSTBUILD_MR_RETRY_DELAY || '45', 10);
+    log(
+      `[postbuild] no open MR for branch=${branch} -- retrying in ${retrySec}s`,
+    );
+    await new Promise(r => setTimeout(r, retrySec * 1000));
+    mr = await client.findOpenMr(projectId, branch);
+  }
+
+  if (!mr) {
+    log(`[postbuild] no open MR for branch=${branch} after retry -- skipping`);
     return;
   }
 
@@ -193,7 +265,7 @@ export async function postbuild() {
     return;
   }
 
-  const previewBranch = branch.toLowerCase().replace(/\//g, '-');
+  const previewBranch = branch.toLowerCase().replace(/\//g, '-').slice(0, 63);
   const previewDomain = process.env.PREVIEW_DOMAIN || '';
   const previewUrl = previewDomain
     ? `https://${previewBranch}.${previewDomain}`
@@ -235,11 +307,7 @@ export async function postbuild() {
     '<!-- qa:automation-results -->',
   ];
   for (const marker of markers) {
-    const deleted = await client.deleteNotesByMarker(
-      projectId,
-      mr.iid,
-      marker,
-    );
+    const deleted = await client.deleteNotesByMarker(projectId, mr.iid, marker);
     if (deleted) {
       debug(`[postbuild] removed ${deleted} stale comment(s) [${marker}]`);
     }