@kungfu-tech/buildchain 2.10.2 → 2.10.3

package/scripts/web-surface-core.mjs

@@ -1309,6 +1309,133 @@ function htmlLikeResponse(response, url = "") {
   return String(contentType).toLowerCase().includes("text/html") || /\/$|\.html(?:$|[?#])/.test(String(url || ""));
 }
 
+const managedNetworkRequiredEvidence = [
+  "sync-static-artifact",
+  "write-deployment-manifest",
+];
+
+function operationEvidenceStatus(operation, { plannedEvidence = false } = {}) {
+  if (plannedEvidence && operation.status === undefined) {
+    return true;
+  }
+  return operation.status === "applied" || operation.status === "planned";
+}
+
+function managedNetworkHealthEvidence({ target, result, plan }) {
+  const operationSource = Array.isArray(result?.operations) && result.operations.length > 0
+    ? "apply-result"
+    : "deploy-plan";
+  const operations = operationSource === "apply-result"
+    ? result.operations
+    : (Array.isArray(plan?.steps) ? plan.steps : []);
+  const surfaceOperations = operations.filter((operation) => operation.surface === target.surface);
+  const presentActions = new Set(
+    surfaceOperations
+      .filter((operation) => operationEvidenceStatus(operation, { plannedEvidence: operationSource === "deploy-plan" }))
+      .map((operation) => operation.action),
+  );
+  const missingActions = managedNetworkRequiredEvidence.filter((action) => !presentActions.has(action));
+  const missingFields = [];
+  if (!target.manifestKey) missingFields.push("manifestKey");
+  if (!target.bucket) missingFields.push("bucket");
+  if (!target.objectPrefix) missingFields.push("objectPrefix");
+  return {
+    source: operationSource,
+    actions: [...presentActions].sort(),
+    requiredActions: managedNetworkRequiredEvidence,
+    missingActions,
+    missingFields,
+    status: missingActions.length === 0 && missingFields.length === 0 ? "pass" : "fail",
+  };
+}
+
+function managedNetworkTargetObjectKey(target) {
+  const requestPath = String(target.requestPath || "/");
+  let relative = requestPath.replace(/^\/+/, "");
+  if (!relative) {
+    relative = "index.html";
+  } else if (requestPath.endsWith("/")) {
+    relative = `${relative.replace(/\/+$/, "")}/index.html`;
+  }
+  return joinS3Key(target.objectPrefix, relative);
+}
+
+function managedNetworkHeadObject({ target, kind, key, commandRunner }) {
+  return runAdapterOperation({
+    operation: {
+      action: `health-head-${kind}`,
+      surface: target.surface,
+      command: "aws",
+      args: ["s3api", "head-object", "--bucket", target.bucket, "--key", key],
+    },
+    dryRun: false,
+    commandRunner,
+  });
+}
+
+function managedNetworkS3HealthCheck({ target, evidence, commandRunner }) {
+  const objectKey = managedNetworkTargetObjectKey(target);
+  const headResults = [
+    managedNetworkHeadObject({ target, kind: "manifest", key: target.manifestKey, commandRunner }),
+    managedNetworkHeadObject({ target, kind: "object", key: objectKey, commandRunner }),
+  ];
+  const failed = headResults.filter((operation) => operation.status === "failed");
+  return {
+    surface: target.surface,
+    kind: target.kind,
+    requestPath: target.requestPath,
+    url: target.url,
+    accessControl: "managed-network",
+    healthStrategy: "s3-object",
+    status: evidence.status === "pass" && failed.length === 0 ? "pass" : "fail",
+    httpStatus: null,
+    finalUrl: "",
+    noindexHeader: false,
+    manifestKey: target.manifestKey || "",
+    bucket: target.bucket || "",
+    objectPrefix: target.objectPrefix || "",
+    objectKey,
+    evidence,
+    s3Checks: headResults.map((operation) => ({
+      action: operation.action,
+      bucket: target.bucket,
+      key: operation.args?.[operation.args.indexOf("--key") + 1] || "",
+      status: operation.status,
+      exitCode: operation.exitCode,
+      stderr: operation.stderr || "",
+    })),
+    message: evidence.status === "pass" && failed.length === 0
+      ? "managed-network surface health verified from S3 manifest and object head checks; direct public fetch skipped"
+      : `managed-network S3 object health failed: ${failed.map((operation) => `${operation.action}:${operation.stderr || operation.exitCode}`).join("; ") || "missing deployment evidence"}`,
+  };
+}
+
+function managedNetworkHealthCheck({ target, result, plan, commandRunner, verifyS3Objects = true }) {
+  const evidence = managedNetworkHealthEvidence({ target, result, plan });
+  if (verifyS3Objects && result?.status === "applied" && evidence.status === "pass") {
+    return managedNetworkS3HealthCheck({ target, evidence, commandRunner });
+  }
+  return {
+    surface: target.surface,
+    kind: target.kind,
+    requestPath: target.requestPath,
+    url: target.url,
+    accessControl: "managed-network",
+    healthStrategy: "deployment-evidence",
+    status: evidence.status,
+    httpStatus: null,
+    finalUrl: "",
+    noindexHeader: false,
+    manifestKey: target.manifestKey || "",
+    bucket: target.bucket || "",
+    objectPrefix: target.objectPrefix || "",
+    evidence,
+    message: evidence.status === "pass"
+      ? "managed-network surface health verified from deployment manifest and S3 object sync evidence; direct public fetch skipped"
+      : `managed-network surface health requires manifest and S3 object evidence; missing actions=${evidence.missingActions.join(",") || "none"}, missing fields=${evidence.missingFields.join(",") || "none"}`,
+  };
+}
+
 export async function checkWebSurfaceHealth({
   result = null,
   plan = null,
@@ -1316,6 +1443,9 @@ export async function checkWebSurfaceHealth({
   fetchImpl = fetch,
   checkedAt = new Date().toISOString(),
   allowedStatuses = [200],
+  allowedManagedNetworkRunner = false,
+  managedNetworkS3ObjectVerification = true,
+  commandRunner = defaultCommandRunner,
 } = {}) {
   const loadedConfig = loadBuildchainConfig(cwd);
   const config = assertWebSurfaceConfig(loadedConfig);
@@ -1351,6 +1481,10 @@ export async function checkWebSurfaceHealth({
           required: smoke.required !== false,
           missing: Boolean(smoke.missing),
           message: smoke.message || "",
+          accessControl: binding.accessControl || config.channels?.[channel]?.accessControl || "",
+          manifestKey: binding.manifestKey || "",
+          bucket: binding.bucket || "",
+          objectPrefix: binding.objectPrefix || "",
         }));
       })
     : Object.entries(urls).map(([surface, url]) => ({
@@ -1359,6 +1493,7 @@ export async function checkWebSurfaceHealth({
         requestPath: "/",
         url,
         required: true,
+        accessControl: config.channels?.[channel]?.accessControl || "",
       }));
 
   for (const target of smokeTargets) {
@@ -1377,6 +1512,16 @@ export async function checkWebSurfaceHealth({
       });
       continue;
     }
+    if (target.accessControl === "managed-network" && !allowedManagedNetworkRunner) {
+      checks.push(managedNetworkHealthCheck({
+        target,
+        result,
+        plan,
+        commandRunner,
+        verifyS3Objects: managedNetworkS3ObjectVerification,
+      }));
+      continue;
+    }
     try {
       const response = await fetchImpl(url, { redirect: "follow" });
       const expectedNoindex = Boolean(config.channels?.[channel]?.noindex);
@@ -1393,6 +1538,8 @@ export async function checkWebSurfaceHealth({
         kind: target.kind,
         requestPath: target.requestPath,
         url,
+        accessControl: target.accessControl || "",
+        healthStrategy: "http",
         status: statusOk && noindexOk ? "pass" : "fail",
         httpStatus: response.status,
         finalUrl: response.url || url,

package/scripts/web-surface.mjs

@@ -231,7 +231,22 @@ export function webSurfaceCli() {
     const resultFile = readArg("result", process.env.BUILDCHAIN_WEB_SURFACE_APPLY_RESULT || "");
     const result = resultFile ? JSON.parse(fs.readFileSync(path.resolve(resultFile), "utf8")) : null;
     const plan = readJsonFileArg("plan");
-    const health = checkWebSurfaceHealth({ cwd, result, plan });
+    const envAllowedManagedNetworkRunner = process.env.BUILDCHAIN_WEB_SURFACE_HEALTH_ALLOWED_RUNNER === "true" ||
+      process.env.BUILDCHAIN_WEB_SURFACE_HEALTH_ALLOWED_RUNNER === "1";
+    const health = checkWebSurfaceHealth({
+      cwd,
+      result,
+      plan,
+      allowedManagedNetworkRunner: readBooleanArg(
+        "allowed-managed-network-runner",
+        envAllowedManagedNetworkRunner,
+      ),
+      managedNetworkS3ObjectVerification: readBooleanArg(
+        "managed-network-s3-object-verification",
+        process.env.BUILDCHAIN_WEB_SURFACE_HEALTH_S3_OBJECTS !== "false" &&
+          process.env.BUILDCHAIN_WEB_SURFACE_HEALTH_S3_OBJECTS !== "0",
+      ),
+    });
     return Promise.resolve(health).then((resolved) => {
       writeJson(resolved, output);
       writeGitHubOutputs({