@monster-orange/den 0.0.0 → 0.2.0

package/src/shared/service-url.ts

@@ -0,0 +1,119 @@
+import type {
+  Environment,
+  RawManifest,
+  ServiceHealthConfig,
+} from "./types/index.js";
+
+export interface ResolveManifestBaseUrlOptions {
+  manifest: RawManifest;
+  repoName: string;
+  serviceName: string;
+  environment: Environment;
+  baseUrlKey: "api" | "web";
+}
+
+export interface ResolveServiceBaseUrlOptions {
+  baseUrlKey: "api" | "web";
+  configuredUrl: string;
+  manifestUrl?: string | null;
+  overrideUrl?: string | null;
+}
+
+function healthUrlForConfig(healthConfig?: ServiceHealthConfig): string | null {
+  if (!healthConfig) {
+    return null;
+  }
+
+  if ("type" in healthConfig && healthConfig.type === "shell") {
+    return null;
+  }
+
+  return healthConfig.url;
+}
+
+function normalizeServiceBaseUrl(
+  healthUrl: string,
+  baseUrlKey: "api" | "web",
+): string {
+  if (baseUrlKey !== "api") {
+    return healthUrl;
+  }
+
+  const url = new URL(healthUrl);
+  url.pathname =
+    url.pathname.replace(/\/(healthz|readyz|version)\/?$/, "") || "/";
+
+  const normalized = url.toString();
+  return normalized.endsWith("/") ? normalized.slice(0, -1) : normalized;
+}
+
+/**
+ * Derive a base URL from the manifest's `services.*.health.<env>` entry.
+ *
+ * Lookup order: `services[serviceName]`, then `services[repoName]`, then the
+ * manifest's declared `entrypoint`.
+ *
+ * The entrypoint step matters because `serviceName` here is the *pillar module*
+ * name (smoke passes `svcName` from `smoke.<name>`, perf passes
+ * `moduleConfig.service`), which need not match any `services:` key. A repo
+ * whose modules are named for what they test rather than for the service —
+ * `tier1`, `search`, `ingest` — matched neither of the first two lookups, so
+ * this returned null and callers silently fell back to
+ * `config/environments/<env>.json -> baseUrls.api`, i.e. shop's API. Repos
+ * appeared to work only when a module happened to share the service's name.
+ *
+ * `entrypoint` is precisely the manifest's statement of which service is the
+ * front door, and `service-runner.ts` already resolves an ambiguous subsystem
+ * the same way.
+ *
+ * For `baseUrlKey === "api"`, strips trailing `/healthz`, `/readyz`, or
+ * `/version` so the health endpoint becomes a usable API root.
+ */
+export function resolveManifestBaseUrl({
+  manifest,
+  repoName,
+  serviceName,
+  environment,
+  baseUrlKey,
+}: ResolveManifestBaseUrlOptions): string | null {
+  const entrypointConfig = manifest.entrypoint
+    ? manifest.services?.[manifest.entrypoint]
+    : undefined;
+  const serviceConfig =
+    manifest.services?.[serviceName] ??
+    manifest.services?.[repoName] ??
+    entrypointConfig;
+  const healthConfig = serviceConfig?.health?.[environment];
+  const healthUrl = healthUrlForConfig(healthConfig);
+  if (!healthUrl) {
+    return null;
+  }
+
+  return normalizeServiceBaseUrl(healthUrl, baseUrlKey);
+}
+
+/**
+ * Precedence-based URL resolver shared across pillars.
+ *
+ * 1. Explicit override (`BASE_API_URL` env, only for `baseUrlKey === "api"`)
+ * 2. Manifest-derived URL from `services.*.health.<env>`
+ * 3. Configured URL from `config/environments/<env>.json`
+ */
+export function resolveServiceBaseUrl({
+  baseUrlKey,
+  configuredUrl,
+  manifestUrl,
+  overrideUrl,
+}: ResolveServiceBaseUrlOptions): string {
+  const trimmedOverride = baseUrlKey === "api" ? overrideUrl?.trim() : "";
+  if (trimmedOverride) {
+    return trimmedOverride;
+  }
+
+  const trimmedManifestUrl = manifestUrl?.trim();
+  if (trimmedManifestUrl) {
+    return trimmedManifestUrl;
+  }
+
+  return configuredUrl;
+}

package/src/shared/smoke/branch-resolver.ts

@@ -0,0 +1,141 @@
+/**
+ * Deployed branch/SHA resolver
+ *
+ * Uses the GitHub Deployments API (via `gh`) to find the exact commit SHA
+ * that is currently deployed to a given environment.  This is the authoritative
+ * source of truth — more precise than a branch name, and independent of what
+ * happens to be on the local machine.
+ *
+ * Flow:
+ *   1. GET /repos/{owner}/{repo}/deployments?environment={env}&per_page=20
+ *   2. Walk deployments newest-first, fetch each one's statuses
+ *   3. Return the first deployment whose latest status is "success"
+ *
+ * Why not just take deployment[0]?  A deployment record is created when a
+ * deploy *starts*, not when it *succeeds*.  If the most recent deploy is still
+ * in progress or failed, we want the last known-good one.
+ *
+ * Requires: `gh` CLI authenticated (`gh auth login`).
+ */
+
+import { execSync } from "child_process";
+
+export interface DeployedRef {
+  /** Exact commit SHA deployed to this environment. */
+  sha: string;
+  /** Branch the commit was deployed from (informational). */
+  ref: string;
+  /** GitHub environment name. */
+  environment: string;
+  /** ISO timestamp of the deployment. */
+  deployedAt: string;
+  /** GitHub deployment ID. */
+  deploymentId: number;
+}
+
+interface GhDeployment {
+  id: number;
+  sha: string;
+  ref: string;
+  environment: string;
+  created_at: string;
+  statuses_url: string;
+}
+
+interface GhDeploymentStatus {
+  state: string; // "success" | "failure" | "error" | "pending" | "in_progress" | "queued" | "inactive"
+}
+
+function gh(args: string): string {
+  try {
+    return execSync(`gh ${args}`, {
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf-8",
+    }).trim();
+  } catch (err) {
+    const msg = (err as { stderr?: string }).stderr?.trim() ?? String(err);
+    throw new Error(`gh command failed: ${msg}`);
+  }
+}
+
+/**
+ * Fetch the latest deployment status state for a deployment.
+ * Returns null if no statuses exist yet (deployment just created).
+ */
+function getLatestDeploymentState(
+  owner: string,
+  repo: string,
+  deploymentId: number,
+): string | null {
+  try {
+    const raw = gh(
+      `api "/repos/${owner}/${repo}/deployments/${deploymentId}/statuses?per_page=1"`,
+    );
+    const statuses: GhDeploymentStatus[] = JSON.parse(raw);
+    return statuses[0]?.state ?? null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve the latest *successfully* deployed ref for a repo+environment.
+ *
+ * @param owner       GitHub org/user (e.g. "acme")
+ * @param repo        GitHub repo name (e.g. "api")
+ * @param environment GitHub environment name (e.g. "staging")
+ * @param limit       Max deployments to inspect before giving up (default 20)
+ */
+export async function resolveDeployedRef(
+  owner: string,
+  repo: string,
+  environment: string,
+  limit = 20,
+): Promise<DeployedRef> {
+  // Check gh is available and authenticated
+  try {
+    gh("auth status --active");
+  } catch {
+    throw new Error("GitHub CLI is not authenticated. Run: gh auth login");
+  }
+
+  const raw = gh(
+    `api "/repos/${owner}/${repo}/deployments?environment=${environment}&per_page=${limit}"`,
+  );
+  const deployments: GhDeployment[] = JSON.parse(raw);
+
+  if (!deployments.length) {
+    throw new Error(
+      `No deployments found for ${owner}/${repo} on environment "${environment}". ` +
+        `Has it been deployed via GitHub Actions?`,
+    );
+  }
+
+  // Walk newest-first, find the last successful one
+  for (const d of deployments) {
+    const state = getLatestDeploymentState(owner, repo, d.id);
+    if (state === "success") {
+      return {
+        sha: d.sha,
+        ref: d.ref,
+        environment: d.environment,
+        deployedAt: d.created_at,
+        deploymentId: d.id,
+      };
+    }
+  }
+
+  // No successful deployment found in the window — warn and use most recent
+  const latest = deployments[0];
+  console.warn(
+    `  ⚠  No successful deployment found for ${owner}/${repo}@${environment} ` +
+      `in the last ${limit} deploys. Using most recent (${latest.sha.slice(0, 8)}).`,
+  );
+  return {
+    sha: latest.sha,
+    ref: latest.ref,
+    environment: latest.environment,
+    deployedAt: latest.created_at,
+    deploymentId: latest.id,
+  };
+}

package/src/shared/smoke/git-remote.ts

@@ -0,0 +1,70 @@
+/**
+ * Git remote URL utilities
+ *
+ * Extracts the GitHub owner/repo from a git remote URL so the rest of the
+ * smoke pipeline can call the GitHub API without requiring this info to be
+ * hardcoded in .den.yml.
+ *
+ * Supported URL formats:
+ *   https://github.com/acme/api.git
+ *   https://github.com/acme/api
+ *   git@github.com:acme/api.git
+ */
+
+import { execSync } from "child_process";
+
+export interface GitHubCoords {
+  owner: string;
+  repo: string;
+}
+
+/**
+ * Run `git remote get-url origin` inside the given directory.
+ * Returns the raw remote URL string, or null if the directory is not a git
+ * repo or has no origin remote.
+ */
+export function getGitRemoteOrigin(repoPath: string): string | null {
+  try {
+    return execSync("git remote get-url origin", {
+      cwd: repoPath,
+      stdio: ["ignore", "pipe", "ignore"],
+      encoding: "utf-8",
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Parse GitHub owner and repo from a remote URL.
+ * Returns null if the URL is not a recognisable GitHub URL.
+ */
+export function parseGitHubOwnerRepo(remoteUrl: string): GitHubCoords | null {
+  // HTTPS: https://github.com/owner/repo[.git]
+  const httpsMatch = remoteUrl.match(
+    /^https?:\/\/github\.com\/([^/]+)\/([^/]+?)(?:\.git)?$/,
+  );
+  if (httpsMatch) {
+    return { owner: httpsMatch[1], repo: httpsMatch[2] };
+  }
+
+  // SSH: git@github.com:owner/repo[.git]
+  const sshMatch = remoteUrl.match(
+    /^git@github\.com:([^/]+)\/([^/]+?)(?:\.git)?$/,
+  );
+  if (sshMatch) {
+    return { owner: sshMatch[1], repo: sshMatch[2] };
+  }
+
+  return null;
+}
+
+/**
+ * Convenience: get GitHub coords for a local repo path.
+ * Returns null if the remote is absent or not a GitHub remote.
+ */
+export function getGitHubCoords(repoPath: string): GitHubCoords | null {
+  const origin = getGitRemoteOrigin(repoPath);
+  if (!origin) return null;
+  return parseGitHubOwnerRepo(origin);
+}

package/src/shared/smoke/repo-cloner.ts

@@ -0,0 +1,151 @@
+/**
+ * Smoke test repo cloner
+ *
+ * Manages .smoke-clones/{repoName}/{environment}/ — shallow clones of
+ * registered repos checked out at the exact SHA deployed to each environment.
+ *
+ * Directory layout:
+ *   .smoke-clones/
+ *     api/
+ *       staging/          ← shallow clone at deployed SHA
+ *         .deployed-sha   ← cached SHA (avoids redundant re-clones)
+ *
+ * Freshness strategy:
+ *   - Read .deployed-sha from disk
+ *   - If it matches the target SHA → already up to date, return path immediately
+ *   - If it differs (or file absent) → fetch + checkout + update stamp
+ *
+ * Git authentication:
+ *   Uses `gh auth git-credential` as the git credential helper so the
+ *   existing `gh` session covers private repos without separate SSH setup.
+ */
+
+import { execSync } from "child_process";
+import * as fs from "fs";
+import * as path from "path";
+import type { DeployedRef } from "./branch-resolver.js";
+import { getDistRoot } from "../paths.js";
+import { assertSafeCloneDestination } from "../environment-manager/clone-guard.js";
+
+// Anchored to the den root, NOT process.cwd() — this module CLONES repos,
+// and a cwd-derived destination once bulk-cloned into an unrelated checkout.
+const CLONES_DIR = path.resolve(getDistRoot(), ".smoke-clones");
+const DEPLOYED_SHA_FILE = ".deployed-sha";
+
+/** Absolute path to the clone directory for a repo+environment pair. */
+export function cloneDirFor(repoName: string, environment: string): string {
+  return path.join(CLONES_DIR, repoName, environment);
+}
+
+function run(cmd: string, cwd?: string): void {
+  execSync(cmd, {
+    cwd,
+    stdio: "inherit",
+    env: {
+      ...process.env,
+      // Route git credentials through `gh` so private repos work without SSH
+      GIT_CREDENTIAL_HELPER: "!gh auth git-credential",
+    },
+  });
+}
+
+function runCapture(cmd: string, cwd?: string): string {
+  return execSync(cmd, {
+    cwd,
+    stdio: ["ignore", "pipe", "pipe"],
+    encoding: "utf-8",
+    env: {
+      ...process.env,
+      GIT_CREDENTIAL_HELPER: "!gh auth git-credential",
+    },
+  }).trim();
+}
+
+/**
+ * Ensure the repo is cloned at the given SHA.
+ * Returns the absolute path to the clone root.
+ *
+ * @param repoName   Short name (matches .den.yml `name` field, e.g. "api")
+ * @param environment  Den environment key (e.g. "staging") — used for path only
+ * @param originUrl  Git remote URL to clone from
+ * @param ref        Deployed ref from branch-resolver
+ */
+export function ensureRepoAtSha(
+  repoName: string,
+  environment: string,
+  originUrl: string,
+  ref: DeployedRef,
+): string {
+  const cloneDir = cloneDirFor(repoName, environment);
+  const shaFile = path.join(cloneDir, DEPLOYED_SHA_FILE);
+
+  // Fast path: already at the right SHA
+  if (fs.existsSync(shaFile)) {
+    const cached = fs.readFileSync(shaFile, "utf-8").trim();
+    if (cached === ref.sha) {
+      console.log(
+        `  ✓ ${repoName}@${environment}: already at ${ref.sha.slice(0, 8)} (${ref.ref})`,
+      );
+      return cloneDir;
+    }
+    console.log(
+      `  ↻ ${repoName}@${environment}: updating ${cached.slice(0, 8)} → ${ref.sha.slice(0, 8)} (${ref.ref})`,
+    );
+  } else {
+    console.log(
+      `  ⬇ ${repoName}@${environment}: cloning at ${ref.sha.slice(0, 8)} (${ref.ref})`,
+    );
+  }
+
+  if (!fs.existsSync(cloneDir)) {
+    assertSafeCloneDestination(cloneDir, repoName);
+    // Initial clone — shallow, blobless (history not needed, just the tree)
+    fs.mkdirSync(cloneDir, { recursive: true });
+    try {
+      run(
+        `git clone --filter=blob:none --depth=1 --branch "${ref.ref}" ` +
+          `-c credential.helper="!gh auth git-credential" ` +
+          `"${originUrl}" "${cloneDir}"`,
+      );
+    } catch {
+      // Branch may not exist by that name (e.g. detached SHA) — try bare clone
+      fs.rmSync(cloneDir, { recursive: true, force: true });
+      fs.mkdirSync(cloneDir, { recursive: true });
+      run(
+        `git clone --filter=blob:none --depth=1 ` +
+          `-c credential.helper="!gh auth git-credential" ` +
+          `"${originUrl}" "${cloneDir}"`,
+      );
+    }
+  }
+
+  // Fetch the exact SHA (in case shallow clone landed on a different commit)
+  const currentSha = runCapture("git rev-parse HEAD", cloneDir);
+  if (currentSha !== ref.sha) {
+    try {
+      run(
+        `git -c credential.helper="!gh auth git-credential" ` +
+          `fetch --depth=1 origin "${ref.sha}"`,
+        cloneDir,
+      );
+      run(`git checkout "${ref.sha}"`, cloneDir);
+    } catch {
+      // Some git servers don't allow fetching by SHA directly — fall back to
+      // fetching the branch and checking out the SHA
+      run(
+        `git -c credential.helper="!gh auth git-credential" ` +
+          `fetch --depth=1 origin "${ref.ref}"`,
+        cloneDir,
+      );
+      run(`git checkout "${ref.sha}"`, cloneDir);
+    }
+  }
+
+  // Write stamp file
+  fs.writeFileSync(shaFile, ref.sha);
+
+  console.log(
+    `  ✓ ${repoName}@${environment}: ready at ${ref.sha.slice(0, 8)}`,
+  );
+  return cloneDir;
+}

package/src/shared/stacks/config.ts

@@ -0,0 +1,137 @@
+/**
+ * Stacks come from two places:
+ *  - a repo's own `.den.yml` `compose:` section (preferred), for every
+ *    repo in the focused workspace;
+ *  - `stacks:` in config/den.yml, for repos that don't carry a manifest.
+ * A manifest stack wins over a config stack of the same name.
+ */
+import * as fs from "fs";
+import * as path from "path";
+import * as yaml from "yaml";
+import { getDistRoot } from "../paths.js";
+import { readCatalog } from "../environment-manager/catalog.js";
+import {
+  getActiveWorkspace,
+  getWorkspaceByName,
+  listWorkspaceServices,
+} from "../environment-manager/workspaces.js";
+import { readManifest } from "../manifest/read-manifest.js";
+import type { ManifestComposeConfig } from "../types/index.js";
+import { assertStackName, parseTarget } from "./render.js";
+import type { StackConfig } from "./types.js";
+
+import { product } from "../product.js";
+type Raw = Partial<Omit<StackConfig, "name">>;
+
+function list(v: unknown, what: string): string[] {
+  if (v === undefined) return [];
+  if (!Array.isArray(v) || v.some((x) => typeof x !== "string"))
+    throw new Error(`${what} must be a list of strings`);
+  return v as string[];
+}
+
+function toStack(
+  name: string,
+  raw: Raw | ManifestComposeConfig,
+  repo: string,
+  repoPath: string | undefined,
+  where: string,
+): StackConfig {
+  assertStackName(name);
+  const routes = raw.routes ?? {};
+  Object.values(routes).forEach(parseTarget);
+  const files = list(raw.files, `${where}.files`);
+  return {
+    name,
+    repo,
+    ...(repoPath ? { repoPath } : {}),
+    dir: raw.dir,
+    files: files.length ? files : ["docker-compose.yml"],
+    routes,
+    generate: list(raw.generate, `${where}.generate`),
+    uses: list(raw.uses, `${where}.uses`),
+    env: Object.fromEntries(
+      Object.entries(raw.env ?? {}).map(([k, v]) => [k, String(v)]),
+    ),
+    profiles: list(raw.profiles, `${where}.profiles`),
+    ...("healthchecks" in raw && raw.healthchecks
+      ? { healthchecks: raw.healthchecks }
+      : {}),
+    ...("service_env" in raw && raw.service_env
+      ? {
+          serviceEnv: Object.fromEntries(
+            Object.entries(raw.service_env).map(([svc, vars]) => [
+              svc,
+              Object.fromEntries(
+                Object.entries(vars).map(([k, v]) => [k, String(v)]),
+              ),
+            ]),
+          ),
+        }
+      : {}),
+  };
+}
+
+/** Stack name for a repo's manifest compose section. */
+export function manifestStackName(
+  manifest: { name: string; compose?: ManifestComposeConfig },
+  repoName: string,
+): string {
+  return manifest.compose?.name ?? manifest.name ?? repoName;
+}
+
+/** `compose:` stacks declared by repos in a workspace (default: focused). */
+export function readManifestStacks(
+  workspace?: string,
+): Record<string, StackConfig> {
+  const ws = workspace ? getWorkspaceByName(workspace) : getActiveWorkspace();
+  if (!ws) return {};
+  const out: Record<string, StackConfig> = {};
+  const seen = new Set<string>();
+  for (const svc of listWorkspaceServices(ws.config, readCatalog(), ws.name)) {
+    if (seen.has(svc.repoPath) || !fs.existsSync(svc.repoPath)) continue;
+    seen.add(svc.repoPath);
+    const m = readManifest(svc.repoPath);
+    if (!m?.compose) continue;
+    const name = manifestStackName(m, svc.repoName);
+    out[name] = toStack(
+      name,
+      m.compose,
+      svc.repoName,
+      svc.repoPath,
+      `${svc.repoName}/${product().manifestYml} compose`,
+    );
+  }
+  return out;
+}
+
+export function readStacks(
+  root: string = getDistRoot(),
+  opts: { workspace?: string; manifests?: boolean } = {},
+): Record<string, StackConfig> {
+  let parsed: { stacks?: Record<string, Raw> } | null = null;
+  try {
+    parsed = yaml.parse(
+      fs.readFileSync(path.join(root, product().configFile), "utf-8"),
+    );
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
+  }
+  const out: Record<string, StackConfig> = {};
+  for (const [name, raw] of Object.entries(parsed?.stacks ?? {})) {
+    if (!raw?.repo) throw new Error(`stacks.${name}.repo is required`);
+    out[name] = toStack(name, raw, raw.repo, undefined, `stacks.${name}`);
+  }
+  if (opts.manifests !== false)
+    Object.assign(out, readManifestStacks(opts.workspace));
+
+  // `uses` may name a stack or the repo that declares it.
+  const byRepo = new Map(Object.values(out).map((s) => [s.repo, s.name]));
+  for (const s of Object.values(out)) {
+    s.uses = s.uses.map((u) => (out[u] ? u : (byRepo.get(u) ?? u)));
+    for (const u of s.uses)
+      if (!out[u])
+        throw new Error(`stack ${s.name}: uses names unknown stack "${u}"`);
+  }
+  return out;
+}