@kungfu-tech/buildchain 3.0.5-alpha.7 → 3.0.5

package/scripts/aws-windows-jit-campaign.mjs

@@ -1,202 +0,0 @@
-#!/usr/bin/env node
-// SPDX-License-Identifier: Apache-2.0
-
-import { spawnSync } from "node:child_process";
-import { pathToFileURL } from "node:url";
-import {
-  createWindowsJitCampaignArmPlan,
-  windowsCampaignArmItems,
-  windowsCampaignKillArgs,
-} from "./aws-windows-jit-campaign-core.mjs";
-
-function arg(name, fallback = "") {
-  const index = process.argv.indexOf(`--${name}`);
-  return index === -1 ? fallback : process.argv[index + 1] || "";
-}
-
-function aws(plan, serviceArgs) {
-  const profile = arg("aws-profile");
-  const result = spawnSync(
-    "aws",
-    [
-      ...(profile ? ["--profile", profile] : []),
-      "--region",
-      plan.aws.region,
-      ...serviceArgs,
-    ],
-    { encoding: "utf8", maxBuffer: 16 * 1024 * 1024 },
-  );
-  if (result.status !== 0) {
-    const detail = String(result.stderr || result.stdout || "")
-      .trim()
-      .slice(0, 2000);
-    throw new Error(
-      `AWS campaign mutation failed${detail ? `: ${detail}` : ""}`,
-    );
-  }
-  return result.stdout ? JSON.parse(result.stdout) : {};
-}
-
-function armPlan() {
-  return createWindowsJitCampaignArmPlan({
-    campaignId: arg("campaign-id"),
-    sourceSha: arg("source-sha"),
-    stateTable: arg("state-table"),
-    region: arg("region", "us-east-1"),
-    armedAt: arg("armed-at", new Date().toISOString()),
-    expiresAt: arg("expires-at"),
-    phaseSpendBaselineUsd: arg("phase-spend-baseline-usd"),
-    maxAcceptedInstances: arg("max-accepted-instances"),
-  });
-}
-
-function confirm(
-  plan,
-  { phaseSpendBaseline = true, maxAcceptedInstances = true } = {},
-) {
-  if (arg("confirm-campaign-id") !== plan.campaign.id) {
-    throw new Error("--confirm-campaign-id must equal the campaign id");
-  }
-  if (arg("confirm-source-sha") !== plan.source.sha) {
-    throw new Error("--confirm-source-sha must equal the exact source SHA");
-  }
-  if (arg("confirm-state-table") !== plan.aws.stateTable) {
-    throw new Error(
-      "--confirm-state-table must equal the campaign state table",
-    );
-  }
-  if (
-    phaseSpendBaseline &&
-    (!arg("confirm-phase-spend-baseline-usd").trim() ||
-      Number(arg("confirm-phase-spend-baseline-usd")) !==
-        plan.limits.phaseSpendBaselineUsd)
-  ) {
-    throw new Error(
-      "--confirm-phase-spend-baseline-usd must equal the phase spend baseline",
-    );
-  }
-  if (
-    maxAcceptedInstances &&
-    (!arg("confirm-max-accepted-instances").trim() ||
-      Number(arg("confirm-max-accepted-instances")) !==
-        plan.limits.maxAcceptedInstances)
-  ) {
-    throw new Error(
-      "--confirm-max-accepted-instances must equal the campaign slot ceiling",
-    );
-  }
-}
-
-function killSwitchTopic() {
-  const topic = arg("kill-switch-topic");
-  if (
-    !/^arn:aws:sns:us-east-1:\d{12}:kungfu-buildchain-windows-jit-[A-Za-z0-9_-]+$/.test(
-      topic,
-    )
-  ) {
-    throw new Error(
-      "--kill-switch-topic must be the dedicated Windows JIT SNS ARN",
-    );
-  }
-  if (arg("confirm-kill-switch-topic") !== topic) {
-    throw new Error(
-      "--confirm-kill-switch-topic must equal the dedicated kill-switch topic",
-    );
-  }
-  return topic;
-}
-
-export function main() {
-  const mode = process.argv[2] || "plan-arm";
-  if (["plan-arm", "arm-campaign"].includes(mode)) {
-    const plan = armPlan();
-    if (mode === "plan-arm") {
-      process.stdout.write(`${JSON.stringify(plan, null, 2)}\n`);
-      return plan;
-    }
-    confirm(plan);
-    aws(plan, [
-      "dynamodb",
-      "transact-write-items",
-      "--transact-items",
-      JSON.stringify(windowsCampaignArmItems(plan)),
-      "--output",
-      "json",
-    ]);
-    const result = {
-      contract: plan.contract,
-      kind: "campaign-arm-result",
-      status: "armed",
-      campaign: plan.campaign,
-      source: plan.source,
-      aws: plan.aws,
-      limits: plan.limits,
-    };
-    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-    return result;
-  }
-  if (mode === "kill-campaign") {
-    const now = new Date();
-    const plan = createWindowsJitCampaignArmPlan({
-      campaignId: arg("campaign-id"),
-      sourceSha: arg("source-sha"),
-      stateTable: arg("state-table"),
-      region: arg("region", "us-east-1"),
-      armedAt: now.toISOString(),
-      expiresAt: new Date(now.getTime() + 1000).toISOString(),
-      phaseSpendBaselineUsd: 0,
-    });
-    confirm(plan, {
-      phaseSpendBaseline: false,
-      maxAcceptedInstances: false,
-    });
-    const topic = killSwitchTopic();
-    aws(
-      plan,
-      windowsCampaignKillArgs(
-        plan.aws.stateTable,
-        arg("reason", "operator-kill"),
-        new Date().toISOString(),
-      ),
-    );
-    const notification = aws(plan, [
-      "sns",
-      "publish",
-      "--topic-arn",
-      topic,
-      "--message",
-      JSON.stringify({
-        contract: plan.contract,
-        action: "kill-campaign",
-        campaignId: plan.campaign.id,
-        sourceSha: plan.source.sha,
-      }),
-      "--output",
-      "json",
-    ]);
-    const result = {
-      contract: plan.contract,
-      kind: "campaign-kill-result",
-      status: "killed",
-      campaign: plan.campaign,
-      source: plan.source,
-      killSwitchTopic: topic,
-      notificationMessageId: notification.MessageId || "",
-    };
-    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-    return result;
-  }
-  throw new Error(`unsupported Windows JIT campaign mode: ${mode}`);
-}
-
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
-  try {
-    main();
-  } catch (error) {
-    console.error(`::error::${error.message || error}`);
-    process.exitCode = 1;
-  }
-}

package/scripts/workflow-call-contract.mjs

@@ -1,133 +0,0 @@
-#!/usr/bin/env node
-import fs from "node:fs";
-import path from "node:path";
-import { execFileSync } from "node:child_process";
-import { pathToFileURL } from "node:url";
-import { evaluateWorkflowCallContract } from "../packages/core/workflow-call-contract.js";
-
-function usage() {
-  return `usage: node scripts/workflow-call-contract.mjs check \\
-  --caller-workflow <path> --job <id> --caller-repository <owner/repo> \\
-  --callee-root <checkout> --callee-workflow <path> --callee-repository <owner/repo> \\
-  --trusted-event <event[:type]> [--trusted-event ...] \\
-  [--expected-contract-root sha256:...] [--allow-dirty] [--output <path>]`;
-}
-
-function parseArgs(argv) {
-  const options = { trustedEvents: [] };
-  for (let index = 0; index < argv.length; index += 1) {
-    const arg = argv[index];
-    if (arg === "--allow-dirty") {
-      options.allowDirty = true;
-      continue;
-    }
-    if (!arg.startsWith("--") || !argv[index + 1])
-      throw new Error(`invalid argument: ${arg}`);
-    const value = argv[index + 1];
-    index += 1;
-    if (arg === "--trusted-event") options.trustedEvents.push(value);
-    else
-      options[
-        arg.slice(2).replace(/-([a-z])/g, (_, char) => char.toUpperCase())
-      ] = value;
-  }
-  return options;
-}
-
-function git(root, ...args) {
-  return execFileSync("git", ["-C", root, ...args], {
-    encoding: "utf8",
-  }).trim();
-}
-
-function required(options, names) {
-  const missing = names.filter((name) => !options[name]);
-  if (missing.length)
-    throw new Error(`missing required options: ${missing.join(", ")}`);
-}
-
-export function checkWorkflowCall(options) {
-  const callerRoot = path.resolve(options.callerRoot || process.cwd());
-  const calleeRoot = path.resolve(options.calleeRoot);
-  const callerStatus = git(
-    callerRoot,
-    "status",
-    "--porcelain",
-    "--untracked-files=no",
-  );
-  if (callerStatus && !options.allowDirty) {
-    throw new Error(
-      "caller checkout is dirty; use --allow-dirty only for local diagnostic validation",
-    );
-  }
-  const calleeStatus = git(
-    calleeRoot,
-    "status",
-    "--porcelain",
-    "--untracked-files=no",
-  );
-  if (calleeStatus) {
-    throw new Error("callee checkout is dirty; exact pinned-ref bytes are required");
-  }
-  const callerSha = git(callerRoot, "rev-parse", "HEAD");
-  const callerTree = git(callerRoot, "rev-parse", "HEAD^{tree}");
-  const calleeSha = git(calleeRoot, "rev-parse", "HEAD");
-  const report = evaluateWorkflowCallContract({
-    callerText: fs.readFileSync(
-      path.join(callerRoot, options.callerWorkflow),
-      "utf8",
-    ),
-    calleeText: fs.readFileSync(
-      path.join(calleeRoot, options.calleeWorkflow),
-      "utf8",
-    ),
-    callerRepository: options.callerRepository,
-    callerWorkflowPath: options.callerWorkflow,
-    callerSha,
-    callerTree,
-    callerSourceState: callerStatus ? "diagnostic-dirty" : "clean",
-    calleeRepository: options.calleeRepository,
-    calleeWorkflowPath: options.calleeWorkflow,
-    calleeSha,
-    jobId: options.job,
-    trustedEventClasses: options.trustedEvents,
-    expectedContractRoot: options.expectedContractRoot || "",
-  });
-  if (options.output) {
-    const output = path.resolve(callerRoot, options.output);
-    fs.mkdirSync(path.dirname(output), { recursive: true });
-    fs.writeFileSync(output, `${JSON.stringify(report, null, 2)}\n`);
-  }
-  return report;
-}
-
-function main(argv = process.argv.slice(2)) {
-  const command = argv.shift();
-  if (command !== "check") throw new Error(usage());
-  const options = parseArgs(argv);
-  required(options, [
-    "callerWorkflow",
-    "job",
-    "callerRepository",
-    "calleeRoot",
-    "calleeWorkflow",
-    "calleeRepository",
-  ]);
-  if (!options.trustedEvents.length)
-    throw new Error("at least one --trusted-event is required");
-  const report = checkWorkflowCall(options);
-  process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
-  if (!report.ok) process.exitCode = 1;
-}
-
-if (
-  process.argv[1] &&
-  import.meta.url === pathToFileURL(process.argv[1]).href
-) {
-  try {
-    main();
-  } catch (error) {
-    console.error(`workflow call contract: ${error.message}`);
-    process.exitCode = 1;
-  }
-}