@intentius/plywood 0.3.0 → 0.3.2

package/dist/plywood.mjs

@@ -260,13 +260,16 @@ function approvalOf(doc) {
 function gateOf(doc) {
   return typeof doc.gate === "string" && GATES.includes(doc.gate) ? doc.gate : DEFAULT_GATE;
 }
+function previewOf(doc) {
+  return doc.preview === true;
+}
 function quorumOf(rules) {
   return Object.entries(rules).map(([glob, r]) => {
     const roles = [...r.role !== void 0 ? [r.role] : [], ...r.roles ?? []];
     return { targets: [glob], count: r.quorum ?? 1, ...roles.length ? { roles } : {}, notAuthor: true };
   });
 }
-var GATES, DEFAULT_GATE, APPROVALS, DEFAULT_APPROVAL, APPROVAL_RULE_KEYS, approval;
+var GATES, DEFAULT_GATE, APPROVALS, DEFAULT_APPROVAL, DEFAULT_PREVIEW, APPROVAL_RULE_KEYS, approval;
 var init_approval = __esm({
   "src/config/approval.ts"() {
     "use strict";
@@ -275,13 +278,19 @@ var init_approval = __esm({
     DEFAULT_GATE = "on-destructive";
     APPROVALS = ["ledger", "sealed", "pr-review"];
     DEFAULT_APPROVAL = "ledger";
+    DEFAULT_PREVIEW = false;
     APPROVAL_RULE_KEYS = ["role", "roles", "quorum"];
     approval = {
       name: "approval",
-      keys: ["gate", "approval", "approval_rules"],
+      keys: ["gate", "approval", "approval_rules", "preview"],
       schema: {
         gate: { type: "string", enum: [...GATES], default: DEFAULT_GATE, description: "always, on-destructive or never." },
         approval: { type: "string", enum: [...APPROVALS], default: DEFAULT_APPROVAL, description: "ledger, sealed or pr-review." },
+        preview: {
+          type: "boolean",
+          default: DEFAULT_PREVIEW,
+          description: "true: plywood init sets approvals.preview in the waves spec, so a merged wave applies only the plans its pull request previewed, or exits 4. Known limits: plywood#55 (the second of two disjoint merges is refused) and plywood#56 (a pull request that creates an autonamed resource is refused)."
+        },
         approval_rules: {
           type: "object",
           description: "Role and quorum per stack glob. Read at base.",
@@ -298,6 +307,7 @@ var init_approval = __esm({
       },
       check(doc) {
         const out = [...oneOf(doc.gate, GATES, "gate"), ...oneOf(doc.approval, APPROVALS, "approval")];
+        if (doc.preview !== void 0 && typeof doc.preview !== "boolean") out.push(error("preview", "must be true or false"));
         const rules = doc.approval_rules;
         if (rules === void 0) return out;
         if (!isObject(rules)) return [...out, error("approval_rules", "must map a stack glob to { role, quorum }")];
@@ -422,7 +432,7 @@ var init_words = __esm({
   "src/words.ts"() {
     "use strict";
     PRODUCT = "plywood";
-    TAGLINE = "Sophisticated automation for Pulumi.";
+    TAGLINE = "Pulumi ops and governance.";
     OP_NAME = "pulumi-up";
     PR_GATE = "up";
     VERBS = [
@@ -587,13 +597,13 @@ var init_control = __esm({
 var version, dependencies;
 var init_package = __esm({
   "package.json"() {
-    version = "0.3.0";
+    version = "0.3.2";
     dependencies = {
-      "@intentius/chant": "0.124.59",
-      "@intentius/chant-lexicon-forgejo": "0.124.59",
-      "@intentius/chant-lexicon-github": "0.124.59",
-      "@intentius/chant-lexicon-gitlab": "0.124.59",
-      "@intentius/chant-lexicon-pulumi": "0.124.59"
+      "@intentius/chant": "0.124.67",
+      "@intentius/chant-lexicon-forgejo": "0.124.67",
+      "@intentius/chant-lexicon-github": "0.124.67",
+      "@intentius/chant-lexicon-gitlab": "0.124.67",
+      "@intentius/chant-lexicon-pulumi": "0.124.67"
     };
   }
 });
@@ -603,8 +613,8 @@ var image_digests_default;
 var init_image_digests = __esm({
   "src/image-digests.json"() {
     image_digests_default = {
-      "ghcr.io/intentius/plywood-pulumi:0.3.0-pulumi3.272.0": "sha256:39fc85f67be6a281aa5f01b02239aa1f02c492f40f1fb0d145c848cc608aaecd",
-      "ghcr.io/intentius/plywood-plunge:0.3.0-plunge0.2.0": "sha256:6647f67defb1719395b29d1a6c9d977b6900e228547c4569563962e4234847e3"
+      "ghcr.io/intentius/plywood-pulumi:0.3.2-pulumi3.272.0": "sha256:eeb44ac18dc594acd8a56dfc1a6ed00751154f6b6bfba8bbdff97a513f4b9f84",
+      "ghcr.io/intentius/plywood-plunge:0.3.2-plunge0.2.0": "sha256:5239ffabd5f5b7a4ffc5cbbe1628a34990bc95549cd4a1bef27953d3dfb7d8a9"
     };
   }
 });
@@ -2458,7 +2468,7 @@ var init_chant_product = __esm({
   "src/chant-product.ts"() {
     "use strict";
     REQUIRED2 = ["assertProductWords", "productPipelineJobs", "approveLine", "runChantInProcess"];
-    BUILT_CHANT = true ? "0.124.59" : "unknown";
+    BUILT_CHANT = true ? "0.124.67" : "unknown";
   }
 });
 
@@ -3493,6 +3503,7 @@ function wavesSpec(input) {
     step: { kind: "pulumi-up" },
     ...input.quorum && input.quorum.length > 0 ? { approvals: { quorum: input.quorum } } : {},
     ...input.notify ? { notify: input.notify } : {},
+    ...input.policy ? { holds: { policy: true } } : {},
     waves: waves.map((w) => {
       const gate = w.stacks.map((s) => s.gate ?? input.gate).reduce((a, b) => STRICTNESS[b] > STRICTNESS[a] ? b : a);
       return { name: w.name, gate, runs: w.stacks.map((s) => ({ target: s.key, input: stepInput(s) })) };
@@ -3989,7 +4000,10 @@ async function drift2(args, json, table, io) {
     try {
       const attribute = await attributionFor(doc, io);
       const root = dirname6(path);
-      for (const stack of stacks2) results.push(await readStack(chant, stack, driftMember(root, doc, stack), dir, { resource: resource.value, env: envFlag.value, ...attribute ? { attribute } : {} }));
+      for (const stack of stacks2) {
+        const backend = stacksOf(doc)[stack]?.backend ?? (typeof doc.backend === "string" ? doc.backend : void 0);
+        results.push(await withBackend(backend, () => readStack(chant, stack, driftMember(root, doc, stack), dir, { resource: resource.value, env: envFlag.value, ...attribute ? { attribute } : {} })));
+      }
     } finally {
       rmSync(dir, { recursive: true, force: true });
     }
@@ -4096,9 +4110,26 @@ async function readStack(chant, stack, member, dir, opts) {
     return { stack, ok: false, drifted: 0, rows: [], error: doc?.error ? `${doc.error.code}: ${doc.error.message}` : `chant workspace drift exited ${code}` };
   }
   const rows = driftRows(doc);
+  const unread = (doc.records ?? []).filter((r) => r.status === "not-observed");
+  if (rows.length === 0 && unread.length > 0) {
+    const first = unread[0];
+    const why = first.unobserved?.detail ?? first.unobserved?.reason ?? "no reason given";
+    return { stack, ok: false, drifted: 0, rows: [], error: `${unread.length} resource${unread.length === 1 ? "" : "s"} could not be read, so the stack's drift is unknown: ${first.address}: ${why}` };
+  }
   const attribution = rows.length && opts.attribute ? await attributeStack(opts.attribute, stack, doc) : void 0;
   return { stack, ok: true, drifted: rows.length, rows, observedAt: observedAt(doc), ...attribution ? { attribution } : {} };
 }
+async function withBackend(backend, read) {
+  if (backend === void 0) return read();
+  const before = process.env.PULUMI_BACKEND_URL;
+  process.env.PULUMI_BACKEND_URL = backend;
+  try {
+    return await read();
+  } finally {
+    if (before === void 0) delete process.env.PULUMI_BACKEND_URL;
+    else process.env.PULUMI_BACKEND_URL = before;
+  }
+}
 async function attributionFor(doc, io) {
   const logs = driftSettingsOf(doc).auditLogs;
   if (!logs) return void 0;
@@ -5729,7 +5760,7 @@ async function runInit(opts, table, io) {
   if (opts.bucketCheck) notes.push(...await bucketStep(detected2, doc, io.env, buckets));
   adopt.push(...await adoptStep(root, detected2, doc, io.env, declaration.doc, opts.dryRun, files, notes, todo));
   todo.push(...todoLines(detected2, doc, forge.kind, io.env));
-  if (forge.kind === "gitlab" && chant && stacks2.length > 0 && await hasChantWavePreview()) {
+  if (forge.kind === "gitlab" && chant && stacks2.length > 0 && previewOf(doc) && await hasChantWavePreview()) {
     todo.push(`Add a ${GITLAB_READ_TOKEN} CI/CD variable (a project access token with the read_api scope, masked and protected) so a wave can read the merge request it applies; without it the wave refuses`);
   }
   const failed = files.find((f) => f.status === "failed");
@@ -5798,7 +5829,9 @@ async function preCommitStep(root, config2, dryRun) {
 }
 async function wavesSpecStep(chant, stacks2, doc, settings, branch, ordered, forge) {
   const runner = waveRunner(chantPipelineOptions(settings.pipeline, false).runner);
+  const rego = isObject(doc.policy) && (typeof doc.policy.rego === "string" || doc.policy.source !== void 0 || doc.policy.command !== void 0);
   const base = wavesSpec({
+    ...rego ? { policy: true } : {},
     stacks: stacks2,
     ordered,
     gate: gateOf(doc),
@@ -5809,7 +5842,7 @@ async function wavesSpecStep(chant, stacks2, doc, settings, branch, ordered, for
     ...settings.pipeline.notify ? { notify: { ...notifyForChant(settings.pipeline.notify, chant) } } : {}
   });
   const named = chant.productWavesSpec ? chant.productWavesSpec(base, PRODUCT_WORDS) : base;
-  return await hasChantWavePreview() ? withWavePreview(named, forge) : named;
+  return previewOf(doc) && await hasChantWavePreview() ? withWavePreview(named, forge) : named;
 }
 async function workflowStep(chant, root, doc, settings, forge, opts, spec, table, io) {
   const output = WORKFLOW_FILE[forge];
@@ -7918,7 +7951,7 @@ var execChild = (bin, args, opts) => new Promise((done) => {
 
 // src/cli.ts
 init_words();
-var VERSION3 = true ? "0.3.0" : "0.0.0-dev";
+var VERSION3 = true ? "0.3.2" : "0.0.0-dev";
 var stdio = {
   out: (s) => process.stdout.write(s + "\n"),
   err: (s) => process.stderr.write(s + "\n")