@intentius/chant 0.79.0 → 0.81.0

package/src/workspace/member-commands.e2e.test.ts

@@ -0,0 +1,244 @@
+/**
+ * `chant workspace build|lint|audit|graph` and the root refusal, end to end
+ * through the real CLI (#2537).
+ *
+ * The fixture is a small workspace in a temporary git repository:
+ *
+ * - `platform`, the root member `.`, a chant project;
+ * - `api` and `web` under `services/`, which share one toolchain: a
+ *   `services/node_modules/.bin/chant` that logs each start and then runs this
+ *   checkout's chant;
+ * - `legacy`, whose own `node_modules/.bin/chant` plays a chant older than
+ *   `workspace member-run` and the IR `version` field;
+ * - `docs`, kind `other`, holding a stray `.ts` declaration the root project
+ *   must not pick up once `docs` is a member;
+ * - an `examples` group with one project.
+ */
+
+import { execFileSync, spawnSync } from "node:child_process";
+import { chmodSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import Ajv2020 from "ajv/dist/2020";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import graphSchema from "./graph.schema.json";
+
+const REPO = realpathSync(join(import.meta.dirname, "..", "..", "..", ".."));
+const LOADER = join(REPO, "node_modules", "tsx", "dist", "loader.mjs");
+const MAIN = join(REPO, "packages", "core", "src", "cli", "main.ts");
+const TIMEOUT = 240_000;
+
+let root: string;
+let services: string;
+let legacyLog: string;
+
+function write(path: string, text: string, mode?: number): void {
+  mkdirSync(dirname(join(root, path)), { recursive: true });
+  writeFileSync(join(root, path), text);
+  if (mode) chmodSync(join(root, path), mode);
+}
+
+const CONFIG = 'export default { lexicons: ["k8s"] };\n';
+const ns = (exportName: string, name: string) =>
+  `import { Namespace } from "@intentius/chant-lexicon-k8s";\nexport const ${exportName} = new Namespace({ metadata: { name: "${name}" } });\n`;
+
+/** A chant from before member-run and the IR version field: it answers level-0 commands only. */
+const OLD_CHANT = (log: string) => `#!/bin/sh
+echo "$*" >> "${log}"
+case "$1" in
+  workspace) echo "Error: Unknown command: workspace" >&2; exit 1 ;;
+  graph) echo '{"nodes":[{"id":"Queue","kind":"Queue","lexicon":"old","attrs":{}}],"edges":[],"groups":{"byLexicon":{"old":["Queue"]}}}' ;;
+  lint) echo '{"version":"2.1.0","runs":[{"tool":{"driver":{"name":"chant","rules":[]}},"results":[]}]}' ;;
+  audit) echo "No auditable files found under .." ;;
+  *) echo '{}' ;;
+esac
+`;
+
+function chant(args: string[], cwd = root): { status: number | null; stdout: string; stderr: string } {
+  const r = spawnSync(process.execPath, ["--import", `file://${LOADER}`, MAIN, ...args], {
+    cwd,
+    encoding: "utf-8",
+    timeout: TIMEOUT,
+    env: { ...process.env, TSX_DISABLE_CACHE: "1", NO_COLOR: "1" },
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  return { status: r.status, stdout: r.stdout ?? "", stderr: r.stderr ?? "" };
+}
+
+function lines(path: string): string[] {
+  return existsSync(path) ? readFileSync(path, "utf-8").trim().split("\n").filter(Boolean) : [];
+}
+
+beforeAll(() => {
+  root = realpathSync(mkdtempSync(join(tmpdir(), "chant-ws-members-")));
+  services = join(root, "services.log");
+  legacyLog = join(root, "legacy.log");
+  write(
+    "chant.workspace.json",
+    JSON.stringify(
+      {
+        name: "acme",
+        schema: 1,
+        members: [
+          { name: "platform", dir: ".", kind: "chant" },
+          { name: "api", dir: "services/api", kind: "chant" },
+          { name: "web", dir: "services/web", kind: "chant" },
+          { name: "legacy", dir: "legacy", kind: "chant" },
+          { name: "docs", dir: "docs", kind: "other", because: "prose and one stray script" },
+          { name: "examples", kind: "examples", glob: "examples/*" },
+        ],
+      },
+      null,
+      2,
+    ),
+  );
+  write("chant.config.ts", CONFIG);
+  write("src/infra.ts", ns("rootNs", "root"));
+  write("services/api/chant.config.ts", CONFIG);
+  write("services/api/src/infra.ts", ns("apiNs", "api"));
+  write(
+    "services/api/manifests/pod.yaml",
+    "apiVersion: v1\nkind: Pod\nmetadata:\n  name: bad\nspec:\n  containers:\n    - name: c\n      image: nginx:1.27\n      securityContext:\n        privileged: true\n",
+  );
+  write("services/web/chant.config.ts", CONFIG);
+  write("services/web/src/infra.ts", ns("webNs", "web"));
+  write(
+    "services/node_modules/.bin/chant",
+    `#!/bin/sh\necho "$*" >> "${services}"\nexec "${process.execPath}" --import "file://${LOADER}" "${MAIN}" "$@"\n`,
+    0o755,
+  );
+  write("legacy/chant.config.ts", CONFIG);
+  write("legacy/node_modules/.bin/chant", OLD_CHANT(legacyLog), 0o755);
+  write("docs/stray.ts", ns("strayNs", "docs-stray"));
+  write("examples/demo/chant.config.ts", CONFIG);
+  write("examples/demo/src/infra.ts", ns("demoNs", "demo"));
+  write(".gitignore", "node_modules\n*.log\nout\n");
+  mkdirSync(join(root, "node_modules", "@intentius"), { recursive: true });
+  symlinkSync(join(REPO, "lexicons", "k8s"), join(root, "node_modules", "@intentius", "chant-lexicon-k8s"), "dir");
+  const git = (...args: string[]) =>
+    execFileSync("git", ["-c", "user.name=t", "-c", "user.email=t@example.com", "-c", "commit.gpgsign=false", ...args], { cwd: root, stdio: "ignore" });
+  git("init", "-q");
+  git("add", "-A");
+  git("commit", "-qm", "fixture");
+}, TIMEOUT);
+
+afterAll(() => {
+  if (root) rmSync(root, { recursive: true, force: true });
+});
+
+describe("the root refusal (#2524 D0)", () => {
+  test("build and lint at a declared root refuse with WSP000 and point to the workspace commands", () => {
+    for (const verb of ["build", "lint"]) {
+      const r = chant([verb]);
+      expect(r.status, verb).toBe(1);
+      expect(r.stderr, verb).toMatch(new RegExp(`WSP000: .*chant workspace ${verb}.*--root-only`));
+    }
+  }, TIMEOUT);
+
+  test("--root-only builds the root project without the member directories", () => {
+    const r = chant(["build", "--root-only"]);
+    expect(r.status, r.stderr).toBe(0);
+    expect(r.stdout).toContain("name: root");
+    expect(r.stdout).not.toContain("docs-stray");
+  }, TIMEOUT);
+
+  test("a build inside a member is not refused", () => {
+    const r = chant(["build", "."], join(root, "services", "api"));
+    expect(r.status, r.stderr).toBe(0);
+    expect(r.stdout).toContain("name: api");
+  }, TIMEOUT);
+});
+
+describe("chant workspace graph", () => {
+  let doc: {
+    version: number;
+    members: Array<{ name: string; status: string; irVersion: number | null; chant: string | null; reason: { code: string } | null }>;
+    nodes: Array<{ id: string; member: string }>;
+    groups: { byMember: Record<string, string[]> };
+  };
+
+  beforeAll(() => {
+    rmSync(services, { force: true });
+    rmSync(legacyLog, { force: true });
+    const r = chant(["workspace", "graph"]);
+    expect(r.status, r.stderr).toBe(0);
+    doc = JSON.parse(r.stdout);
+  }, TIMEOUT);
+
+  test("composes members with <member>/<id> ids and groups.byMember", () => {
+    expect(doc.version).toBe(1);
+    expect(doc.nodes.map((n) => n.id)).toEqual(["api/apiNs", "legacy/Queue", "platform/rootNs", "web/webNs"]);
+    expect(doc.groups.byMember).toEqual({
+      platform: ["platform/rootNs"],
+      api: ["api/apiNs"],
+      web: ["web/webNs"],
+      legacy: ["legacy/Queue"],
+    });
+    expect(doc.members.find((m) => m.name === "docs")).toMatchObject({ status: "skipped", reason: { code: "kind-not-run" } });
+  });
+
+  test("upgrades an old chant's unversioned IR in place", () => {
+    expect(doc.members.find((m) => m.name === "legacy")).toMatchObject({ status: "composed", irVersion: null, chant: null });
+    expect(doc.members.find((m) => m.name === "api")).toMatchObject({ status: "composed", irVersion: 1 });
+  });
+
+  test("starts one process per toolchain identity, and one per member only for a chant without member-run", () => {
+    expect(lines(services)).toEqual(["workspace member-run"]);
+    expect(lines(legacyLog)).toEqual(["workspace member-run", "graph . --format ir"]);
+  });
+
+  test("--at reads each member's source at the revision, under the toolchains installed now (#2536)", () => {
+    const web = join(root, "services", "web", "src", "infra.ts");
+    const before = readFileSync(web, "utf-8");
+    writeFileSync(web, ns("webNsChanged", "web"));
+    try {
+      const r = chant(["workspace", "graph", "--at", "HEAD"]);
+      expect(r.status, r.stderr).toBe(0);
+      const at = JSON.parse(r.stdout) as { at: string; contract: number; nodes: Array<{ id: string }> };
+      const validate = new Ajv2020({ strict: true, allErrors: true }).compile(graphSchema);
+      expect(validate(at), JSON.stringify(validate.errors)).toBe(true);
+      expect(at.at).toMatch(/^[0-9a-f]{40}$/);
+      expect(at.nodes.map((n) => n.id)).toEqual(["api/apiNs", "legacy/Queue", "platform/rootNs", "web/webNs"]);
+    } finally {
+      writeFileSync(web, before);
+    }
+  }, TIMEOUT);
+
+  test("leaves chant graph at the root as the single-project IR", () => {
+    const r = chant(["graph", "--format", "ir"]);
+    expect(r.status, r.stderr).toBe(0);
+    const ir = JSON.parse(r.stdout) as { version: number; nodes: Array<{ id: string }>; groups: Record<string, unknown> };
+    expect(ir.version).toBe(1);
+    expect(ir.groups.byMember).toBeUndefined();
+    expect(ir.nodes.every((n) => !n.id.includes("/"))).toBe(true);
+  }, TIMEOUT);
+});
+
+describe("chant workspace lint, audit and build", () => {
+  test("lint --format sarif writes one run per member and example project", () => {
+    const r = chant(["workspace", "lint", "--format", "sarif"]);
+    expect(r.status, r.stderr).toBe(0);
+    const log = JSON.parse(r.stdout) as { runs: Array<{ automationDetails: { id: string }; results: Array<{ locations: Array<{ physicalLocation: { artifactLocation: { uri: string } } }> }> }> };
+    expect(log.runs.map((run) => run.automationDetails.id)).toEqual(["platform/", "examples:examples/demo/", "api/", "web/", "legacy/"]);
+    const uris = log.runs.flatMap((run) => run.results.map((res) => res.locations[0].physicalLocation.artifactLocation.uri));
+    expect(uris).toContain("services/api/src/infra.ts");
+    expect(uris.some((u) => u.startsWith("docs/"))).toBe(false);
+  }, TIMEOUT);
+
+  test("audit adds a member field, and member . leaves other members' files to them", () => {
+    const r = chant(["workspace", "audit", "--json"]);
+    expect(r.status, r.stderr).toBe(0);
+    const doc = JSON.parse(r.stdout) as { members: Array<{ member: string }>; findings: Array<{ member: string; file: string; checkId: string }> };
+    expect(doc.members.map((m) => m.member)).toEqual(["platform", "api", "web", "legacy"]);
+    const privileged = doc.findings.filter((f) => f.checkId === "WK8202");
+    expect(privileged.map((f) => [f.member, f.file])).toEqual([["api", "manifests/pod.yaml"]]);
+  }, TIMEOUT);
+
+  test("build -o writes each member's output under its name", () => {
+    const r = chant(["workspace", "build", "-o", "out"]);
+    expect(r.status, r.stderr).toBe(0);
+    expect(r.stderr).toMatch(/chant workspace build: 5 projects, 5 passed, 0 failed; 1 skipped; 3 toolchains/);
+    expect(readFileSync(join(root, "out", "api.json"), "utf-8")).toContain("api");
+    expect(existsSync(join(root, "out", "examples", "examples", "demo.json"))).toBe(true);
+  }, TIMEOUT);
+});

package/src/workspace/member-commands.test.ts

@@ -0,0 +1,217 @@
+/**
+ * Planning the per-member commands (#2537): which projects run, under which
+ * chant, and what a root `build` or `lint` does. No chant is spawned here;
+ * `member-commands.e2e.test.ts` runs the real CLI.
+ */
+
+import { chmodSync, mkdirSync, mkdtempSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { afterAll, describe, expect, test } from "vitest";
+import type { ParsedArgs } from "../cli/registry";
+import { WorkspaceReadError } from "./declaration";
+import { buildOutputPath, memberArgv, parseMemberRunOutput, planMembers, resolveToolchain, type Toolchain } from "./member-commands";
+import { captureRun, PROTOCOL_PREFIX } from "./member-run";
+import { decideRootCommand } from "./root-refusal";
+
+const REPO = realpathSync(join(import.meta.dirname, "..", "..", "..", ".."));
+
+const scratch: string[] = [];
+afterAll(() => {
+  for (const d of scratch) rmSync(d, { recursive: true, force: true });
+});
+
+function tree(files: Record<string, string>): string {
+  const root = realpathSync(mkdtempSync(join(tmpdir(), "chant-members-")));
+  scratch.push(root);
+  for (const [path, text] of Object.entries(files)) {
+    mkdirSync(dirname(join(root, path)), { recursive: true });
+    writeFileSync(join(root, path), text);
+    if (path.endsWith(".bin/chant")) chmodSync(join(root, path), 0o755);
+  }
+  return root;
+}
+
+const CONFIG = 'export default { lexicons: ["k8s"] };\n';
+const declaration = (members: unknown[]) => JSON.stringify({ name: "acme", schema: 1, members });
+const reader: Toolchain = { command: ["/opt/reader/chant"], identity: "/opt/reader/chant", source: "reader" };
+
+const acme = () =>
+  tree({
+    "chant.workspace.json": declaration([
+      { name: "platform", dir: ".", kind: "chant" },
+      { name: "api", dir: "services/api", kind: "chant" },
+      { name: "web", dir: "services/web", kind: "chant" },
+      { name: "legacy", dir: "legacy", kind: "chant" },
+      { name: "docs", dir: "docs", kind: "other", because: "markdown" },
+      { name: "gone", dir: "gone", kind: "chant" },
+      { name: "examples", kind: "examples", glob: "examples/*" },
+    ]),
+    "chant.config.ts": CONFIG,
+    "services/api/chant.config.ts": CONFIG,
+    "services/web/chant.config.ts": CONFIG,
+    "services/node_modules/.bin/chant": "#!/bin/sh\n",
+    "legacy/chant.config.ts": CONFIG,
+    "legacy/node_modules/.bin/chant": "#!/bin/sh\n",
+    "docs/README.md": "# docs\n",
+    "examples/demo/chant.config.ts": CONFIG,
+    "examples/notes/README.md": "not a project\n",
+  });
+
+describe("planMembers", () => {
+  const root = acme();
+
+  test("runs chant members and example matches for build, one group per toolchain", () => {
+    const plan = planMembers("build", root, { reader });
+    expect(plan.groups.map((g) => [g.toolchain.source, g.units.map((u) => u.id)])).toEqual([
+      ["reader", ["platform", "examples:examples/demo"]],
+      ["member", ["api", "web"]],
+      ["member", ["legacy"]],
+    ]);
+    expect(plan.groups[1].toolchain.identity).toBe(join(root, "services/node_modules/.bin/chant"));
+    expect(plan.skipped.map((s) => [s.name, s.reason.code])).toEqual([["docs", "kind-not-run"]]);
+    expect(plan.unreadable.map((s) => [s.name, s.reason.code])).toEqual([["gone", "dir-missing"]]);
+  });
+
+  test("leaves the other members and the group matches out of member `.`", () => {
+    const platform = planMembers("lint", root, { reader }).groups[0].units[0];
+    expect(platform.dir).toBe(".");
+    expect(platform.exclude).toEqual(["docs", "examples/demo", "gone", "legacy", "services/api", "services/web"]);
+  });
+
+  test("leaves example groups out of audit and graph", () => {
+    for (const verb of ["audit", "graph"] as const) {
+      const plan = planMembers(verb, root, { reader });
+      expect(plan.groups.flatMap((g) => g.units.map((u) => u.id)).sort(), verb).toEqual(["api", "legacy", "platform", "web"]);
+      expect(plan.skipped.map((s) => s.name), verb).toEqual(["docs", "examples"]);
+    }
+  });
+
+  test("--member narrows the run, and an unknown name is an error", () => {
+    const plan = planMembers("build", root, { reader, only: ["api", "examples"] });
+    expect(plan.groups.flatMap((g) => g.units.map((u) => u.id))).toEqual(["api", "examples:examples/demo"]);
+    expect(() => planMembers("build", root, { reader, only: ["nope"] })).toThrow(WorkspaceReadError);
+  });
+});
+
+describe("resolveToolchain", () => {
+  const root = acme();
+
+  test("walks up from the member to the root, and falls back to the reader", () => {
+    expect(resolveToolchain(join(root, "services/api"), root, reader).source).toBe("member");
+    expect(resolveToolchain(join(root, "docs"), root, reader)).toEqual(reader);
+  });
+
+  test("uses the root's chant for a member with none, and starts the reader's own chant the reader's way", () => {
+    const withRootBin = tree({ "node_modules/.bin/chant": "#!/bin/sh\n", "a/chant.config.ts": CONFIG });
+    const tc = resolveToolchain(join(withRootBin, "a"), withRootBin, reader);
+    expect(tc).toMatchObject({ source: "root", command: [join(withRootBin, "node_modules/.bin/chant")] });
+    const same = resolveToolchain(join(withRootBin, "a"), withRootBin, { ...reader, identity: tc.identity });
+    expect(same).toEqual({ ...reader, identity: tc.identity, source: "root" });
+  });
+});
+
+describe("the chant repo's own declaration (#2557)", () => {
+  test("declares no chant members, so build runs the example groups under one toolchain", () => {
+    const plan = planMembers("build", REPO);
+    expect(plan.workspace.name).toBe("chant");
+    expect(plan.unreadable).toEqual([]);
+    expect(plan.groups).toHaveLength(1);
+    const units = plan.groups[0].units;
+    expect(units.every((u) => u.group)).toBe(true);
+    expect(units.map((u) => u.id)).toContain("fixtures:test/leftness");
+    expect(plan.skipped.every((s) => s.reason.code === "kind-not-run")).toBe(true);
+    expect(plan.skipped.map((s) => s.name)).toContain("core");
+  });
+
+  test("graph and audit run nothing there: every member is kind other", () => {
+    for (const verb of ["graph", "audit"] as const) {
+      const plan = planMembers(verb, REPO);
+      expect(plan.groups, verb).toEqual([]);
+    }
+  });
+
+  test("--member fixtures picks the two test fixtures", () => {
+    const plan = planMembers("lint", REPO, { only: ["fixtures"] });
+    expect(plan.groups.flatMap((g) => g.units.map((u) => u.dir))).toEqual(["test/forgejo-preview-e2e", "test/leftness"]);
+  });
+});
+
+describe("member command lines", () => {
+  const args = (over: Partial<ParsedArgs>): ParsedArgs => ({ command: "workspace", path: "build", format: "", ...over }) as ParsedArgs;
+  const unit = { id: "api", member: "api", kind: "chant", group: false, dir: "services/api", abs: "/w/services/api", exclude: [] };
+  const match = { ...unit, id: "examples:examples/demo", member: "examples", group: true, dir: "examples/demo" };
+
+  test("build keeps the member's default format and writes -o per member", () => {
+    expect(memberArgv("build", unit, args({}))).toEqual(["build", "."]);
+    expect(memberArgv("build", unit, args({ output: "/out", env: "prod", param: ["a=b"] }))).toEqual([
+      "build", ".", "--env", "prod", "--param", "a=b", "--output", "/out/api.json",
+    ]);
+    expect(buildOutputPath("/out", match, "yaml")).toBe("/out/examples/examples/demo.yaml");
+  });
+
+  test("lint asks each member for the format the workspace prints, audit always for JSON, graph for the IR", () => {
+    expect(memberArgv("lint", unit, args({ format: "sarif" }))).toEqual(["lint", ".", "--format", "sarif"]);
+    expect(memberArgv("lint", unit, args({}))).toEqual(["lint", ".", "--format", "stylish"]);
+    expect(memberArgv("audit", unit, args({ failOn: "error" }))).toEqual(["audit", ".", "--format", "json", "--fail-on", "error"]);
+    expect(memberArgv("graph", unit, args({ format: "mermaid" }))).toEqual(["graph", ".", "--format", "ir"]);
+  });
+});
+
+describe("the member-run protocol", () => {
+  test("an answer with no header is an old chant", () => {
+    expect(parseMemberRunOutput("Error: Unknown workspace subcommand: member-run\n")).toBeUndefined();
+  });
+
+  test("results after the header are read, and anything else is stray output", () => {
+    const text = [
+      `${PROTOCOL_PREFIX}${JSON.stringify({ type: "header", protocol: 1, chant: "9.9.9" })}`,
+      "a stray line",
+      `${PROTOCOL_PREFIX}${JSON.stringify({ type: "result", id: "api", exitCode: 0, stdout: "x", stderr: "" })}`,
+    ].join("\n");
+    const parsed = parseMemberRunOutput(text)!;
+    expect(parsed.chant).toBe("9.9.9");
+    expect(parsed.results.get("api")).toMatchObject({ exitCode: 0, stdout: "x" });
+    expect(parsed.stray).toBe("a stray line");
+  });
+
+  // The CLI prints through console, which writes through these streams. vitest
+  // replaces console in a test, so the test writes to the streams directly.
+  test("captureRun keeps a command's output and turns process.exit into its exit code", async () => {
+    const r = await captureRun(async () => {
+      process.stdout.write("to stdout\n");
+      process.stderr.write("to stderr\n");
+      process.exit(3);
+    });
+    expect(r).toEqual({ exitCode: 3, stdout: "to stdout\n", stderr: "to stderr\n" });
+  });
+});
+
+describe("decideRootCommand", () => {
+  const root = acme();
+  const decide = (target: string, rootOnly = false) => decideRootCommand({ verb: "build", target, workspaceDir: root, rootOnly });
+
+  test("refuses at the root with WSP000, pointing to the workspace command", () => {
+    const d = decide(root);
+    expect(d.action).toBe("refuse");
+    expect(d.action === "refuse" && d.message).toMatch(/^WSP000: .*chant workspace build.*--root-only.*rootOnly: true/);
+  });
+
+  test("with root-only, runs the root project without the members", () => {
+    expect(decide(root, true)).toEqual({
+      action: "root-only",
+      excluded: ["docs", "examples/demo", "gone", "legacy", "services/api", "services/web"],
+    });
+  });
+
+  test("leaves a target inside a member or a group match alone", () => {
+    expect(decide(join(root, "docs"))).toEqual({ action: "not-root" });
+    expect(decide(join(root, "examples/demo/src"))).toEqual({ action: "not-root" });
+  });
+
+  test("still refuses when the declaration can't be read", () => {
+    const broken = tree({ "chant.workspace.json": "{ nope", "chant.config.ts": CONFIG });
+    const d = decideRootCommand({ verb: "lint", target: broken, workspaceDir: broken, rootOnly: true });
+    expect(d.action === "refuse" && d.message).toMatch(/^WSP000: .*declaration-unparseable/);
+  });
+});