@mriekki/lean 0.1.0 → 0.2.0

package/assets/generated/deployment/src/lean_poc_deployment/teardown_cli.py

@@ -1,120 +1,120 @@
-"""CLI for scoped destructive POC tear-down."""
-
-from __future__ import annotations
-
-import argparse
-import sys
-
-from .errors import DeploymentKitError
-from .teardown import (
-    PRODUCTION_DATA_DELETE_PHRASE,
-    SUPPORTED_SCOPES,
-    TEAR_DOWN_WRITE_PHRASE,
-    normalize_teardown_spec,
-    parse_environment_targets,
-    render_teardown_summary,
-    tear_down_poc,
-)
-
-
-def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
-    parser = argparse.ArgumentParser(
-        prog="lean-poc-deploy tear-down",
-        description=(
-            "Remove the selected Kit-managed POC environment(s) and/or exact-package local Docker state. "
-            "Remote tear-down deletes persistent application data for the selected environment."
-        ),
-    )
-    parser.add_argument("scope", choices=SUPPORTED_SCOPES)
-    parser.add_argument("--owner-repo", required=True)
-    parser.add_argument("--app-slug", required=True)
-    parser.add_argument(
-        "--environment-target",
-        action="append",
-        default=[],
-        metavar="ENV=TARGET",
-        help="Explicit staging/production environment-to-target binding; repeat as needed by the selected scope.",
-    )
-    parser.add_argument(
-        "--local-package",
-        help="Exact local Docker package identity, e.g. ghcr.io/owner/package; required for local and all scopes.",
-    )
-    parser.add_argument(
-        "--authorization",
-        help=f"Required destructive phrase: {TEAR_DOWN_WRITE_PHRASE}",
-    )
-    parser.add_argument(
-        "--production-data-authorization",
-        help=(
-            "Additional phrase required for production/all because persistent Production data is deleted: "
-            f"{PRODUCTION_DATA_DELETE_PHRASE}"
-        ),
-    )
-    return parser.parse_args(argv)
-
-
-def _preview(spec: dict[str, object]) -> dict[str, object]:
-    production = spec["scope"] in {"production", "all"}
-    return {
-        "schemaVersion": 1,
-        "ownerRepo": spec["ownerRepo"],
-        "appSlug": spec["appSlug"],
-        "scope": spec["scope"],
-        "environmentTargets": spec["environmentTargets"],
-        "localPackage": spec["localPackage"],
-        "destructive": True,
-        "deletesPersistentData": bool(spec["environmentTargets"]),
-        "deletesProductionData": production,
-        "preservesSharedPlatform": True,
-        "preservesUnrelatedPocs": True,
-        "deletesGhcrPackage": False,
-        "requiredAuthorization": TEAR_DOWN_WRITE_PHRASE,
-        "requiredProductionDataAuthorization": PRODUCTION_DATA_DELETE_PHRASE if production else None,
-    }
-
-
-def main(argv: list[str] | None = None) -> int:
-    try:
-        args = parse_args(argv)
-        bindings = parse_environment_targets(args.environment_target)
-        spec = normalize_teardown_spec(
-            owner_repo=args.owner_repo,
-            app_slug=args.app_slug,
-            scope=args.scope,
-            environment_targets=bindings,
-            local_package=args.local_package,
-        )
-        preview = _preview(spec)
-
-        missing_general = args.authorization != TEAR_DOWN_WRITE_PHRASE
-        needs_production = args.scope in {"production", "all"}
-        missing_production = needs_production and (
-            args.production_data_authorization != PRODUCTION_DATA_DELETE_PHRASE
-        )
-        if missing_general or missing_production:
-            print("POC TEAR-DOWN PREVIEW")
-            print(render_teardown_summary(preview))
-            if missing_general:
-                print(
-                    f"ERROR: destructive tear-down requires --authorization {TEAR_DOWN_WRITE_PHRASE!r}",
-                    file=sys.stderr,
-                )
-            if missing_production:
-                print(
-                    "ERROR: Production persistent-data deletion requires "
-                    f"--production-data-authorization {PRODUCTION_DATA_DELETE_PHRASE!r}",
-                    file=sys.stderr,
-                )
-            return 2
-
-        result = tear_down_poc(spec)
-        print("POC TEAR-DOWN COMPLETE")
-        print(render_teardown_summary(result))
-        return 0
-    except DeploymentKitError as exc:
-        print(f"ERROR: {exc}", file=sys.stderr)
-        return 2
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
+"""CLI for scoped destructive POC tear-down."""
+
+from __future__ import annotations
+
+import argparse
+import sys
+
+from .errors import DeploymentKitError
+from .teardown import (
+    PRODUCTION_DATA_DELETE_PHRASE,
+    SUPPORTED_SCOPES,
+    TEAR_DOWN_WRITE_PHRASE,
+    normalize_teardown_spec,
+    parse_environment_targets,
+    render_teardown_summary,
+    tear_down_poc,
+)
+
+
+def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        prog="lean-poc-deploy tear-down",
+        description=(
+            "Remove the selected Kit-managed POC environment(s) and/or exact-package local Docker state. "
+            "Remote tear-down deletes persistent application data for the selected environment."
+        ),
+    )
+    parser.add_argument("scope", choices=SUPPORTED_SCOPES)
+    parser.add_argument("--owner-repo", required=True)
+    parser.add_argument("--app-slug", required=True)
+    parser.add_argument(
+        "--environment-target",
+        action="append",
+        default=[],
+        metavar="ENV=TARGET",
+        help="Explicit staging/production environment-to-target binding; repeat as needed by the selected scope.",
+    )
+    parser.add_argument(
+        "--local-package",
+        help="Exact local Docker package identity, e.g. ghcr.io/owner/package; required for local and all scopes.",
+    )
+    parser.add_argument(
+        "--authorization",
+        help=f"Required destructive phrase: {TEAR_DOWN_WRITE_PHRASE}",
+    )
+    parser.add_argument(
+        "--production-data-authorization",
+        help=(
+            "Additional phrase required for production/all because persistent Production data is deleted: "
+            f"{PRODUCTION_DATA_DELETE_PHRASE}"
+        ),
+    )
+    return parser.parse_args(argv)
+
+
+def _preview(spec: dict[str, object]) -> dict[str, object]:
+    production = spec["scope"] in {"production", "all"}
+    return {
+        "schemaVersion": 1,
+        "ownerRepo": spec["ownerRepo"],
+        "appSlug": spec["appSlug"],
+        "scope": spec["scope"],
+        "environmentTargets": spec["environmentTargets"],
+        "localPackage": spec["localPackage"],
+        "destructive": True,
+        "deletesPersistentData": bool(spec["environmentTargets"]),
+        "deletesProductionData": production,
+        "preservesSharedPlatform": True,
+        "preservesUnrelatedPocs": True,
+        "deletesGhcrPackage": False,
+        "requiredAuthorization": TEAR_DOWN_WRITE_PHRASE,
+        "requiredProductionDataAuthorization": PRODUCTION_DATA_DELETE_PHRASE if production else None,
+    }
+
+
+def main(argv: list[str] | None = None) -> int:
+    try:
+        args = parse_args(argv)
+        bindings = parse_environment_targets(args.environment_target)
+        spec = normalize_teardown_spec(
+            owner_repo=args.owner_repo,
+            app_slug=args.app_slug,
+            scope=args.scope,
+            environment_targets=bindings,
+            local_package=args.local_package,
+        )
+        preview = _preview(spec)
+
+        missing_general = args.authorization != TEAR_DOWN_WRITE_PHRASE
+        needs_production = args.scope in {"production", "all"}
+        missing_production = needs_production and (
+            args.production_data_authorization != PRODUCTION_DATA_DELETE_PHRASE
+        )
+        if missing_general or missing_production:
+            print("POC TEAR-DOWN PREVIEW")
+            print(render_teardown_summary(preview))
+            if missing_general:
+                print(
+                    f"ERROR: destructive tear-down requires --authorization {TEAR_DOWN_WRITE_PHRASE!r}",
+                    file=sys.stderr,
+                )
+            if missing_production:
+                print(
+                    "ERROR: Production persistent-data deletion requires "
+                    f"--production-data-authorization {PRODUCTION_DATA_DELETE_PHRASE!r}",
+                    file=sys.stderr,
+                )
+            return 2
+
+        result = tear_down_poc(spec)
+        print("POC TEAR-DOWN COMPLETE")
+        print(render_teardown_summary(result))
+        return 0
+    except DeploymentKitError as exc:
+        print(f"ERROR: {exc}", file=sys.stderr)
+        return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/assets/generated/deployment/src/lean_poc_deployment/teardown_remote.py

@@ -1,100 +1,100 @@
-"""Remote destructive tear-down for one Kit-managed POC environment."""
-
-REMOTE_SCRIPT = r'''#!/usr/bin/env bash
-set -Eeuo pipefail
-
-APP_ROOT="/srv/lean-poc-apps"
-OWNER="$1"
-APP="$2"
-ENVIRONMENT="$3"
-
-valid_slug() { [[ "$1" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]]; }
-valid_repo() { [[ "$1" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; }
-meta_value() {
-    local path="$1" key="$2"
-    [[ -f "$path" && ! -L "$path" ]] || return 1
-    sed -n "s/^${key}=//p" "$path" | head -n1
-}
-assert_owned_marker() {
-    local path="$1"
-    [[ -f "$path" && ! -L "$path" ]] || return 1
-    [[ "$(meta_value "$path" OWNER_REPO || true)" == "$OWNER" && \
-       "$(meta_value "$path" APP_SLUG || true)" == "$APP" && \
-       "$(meta_value "$path" ENVIRONMENT || true)" == "$ENVIRONMENT" ]]
-}
-
-valid_repo "$OWNER" || { echo "Invalid owner repository." >&2; exit 20; }
-valid_slug "$APP" || { echo "Invalid application slug." >&2; exit 20; }
-valid_slug "$ENVIRONMENT" || { echo "Invalid environment slug." >&2; exit 20; }
-
-ROOT="$APP_ROOT/$APP/$ENVIRONMENT"
-STATE="$ROOT/deployment.env"
-PERSISTENCE="$ROOT/persistence.env"
-
-if [[ ! -e "$ROOT" ]]; then
-    printf 'TEAR_DOWN\tabsent\t%s\t%s\n' "$APP" "$ENVIRONMENT"
-    exit 0
-fi
-
-[[ -d "$ROOT" && ! -L "$ROOT" ]] || {
-    echo "POC environment root is not a safe managed directory: $ROOT" >&2
-    exit 21
-}
-
-HAS_STATE=false
-HAS_PERSISTENCE=false
-[[ -f "$STATE" && ! -L "$STATE" ]] && HAS_STATE=true
-[[ -f "$PERSISTENCE" && ! -L "$PERSISTENCE" ]] && HAS_PERSISTENCE=true
-[[ "$HAS_STATE" == true || "$HAS_PERSISTENCE" == true ]] || {
-    echo "POC environment root has no managed ownership marker: $ROOT" >&2
-    exit 21
-}
-
-if [[ "$HAS_STATE" == true ]] && ! assert_owned_marker "$STATE"; then
-    echo "POC deployment ownership mismatch for $ROOT" >&2
-    exit 22
-fi
-if [[ "$HAS_PERSISTENCE" == true ]] && ! assert_owned_marker "$PERSISTENCE"; then
-    echo "POC persistence ownership mismatch for $ROOT" >&2
-    exit 22
-fi
-
-CONTAINER=""
-if [[ "$HAS_STATE" == true ]]; then
-    CURRENT_RELEASE="$(meta_value "$STATE" CURRENT_RELEASE || true)"
-    [[ -n "$CURRENT_RELEASE" && "$CURRENT_RELEASE" != */* && "$CURRENT_RELEASE" != *..* ]] || {
-        echo "Managed deployment state has an invalid current release." >&2
-        exit 23
-    }
-
-    RELEASE_FILE="$ROOT/releases/$CURRENT_RELEASE/release.env"
-    [[ -f "$RELEASE_FILE" && ! -L "$RELEASE_FILE" ]] || {
-        echo "Managed current release metadata is missing: $RELEASE_FILE" >&2
-        exit 23
-    }
-    assert_owned_marker "$RELEASE_FILE" || {
-        echo "Managed release ownership does not match deployment state." >&2
-        exit 23
-    }
-    CONTAINER="$(meta_value "$RELEASE_FILE" CONTAINER_NAME || true)"
-    [[ "$CONTAINER" =~ ^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$ ]] || {
-        echo "Managed release contains an invalid container name." >&2
-        exit 23
-    }
-
-    if docker inspect "$CONTAINER" >/dev/null 2>&1; then
-        docker rm -f "$CONTAINER" >/dev/null
-    fi
-fi
-
-# The verified environment root is owned by this POC/environment. Tear-down
-# removes releases, evidence, persistent data, and backups together.
-rm -rf --one-file-system -- "$ROOT"
-
-APP_DIR="$APP_ROOT/$APP"
-if [[ -d "$APP_DIR" ]] && ! find "$APP_DIR" -mindepth 1 -print -quit | grep -q .; then
-    rmdir "$APP_DIR"
-fi
-
-printf 'TEAR_DOWN\tremoved\t%s\t%s\t%s\n' "$APP" "$ENVIRONMENT" "$CONTAINER"
-'''
+"""Remote destructive tear-down for one Kit-managed POC environment."""
+
+REMOTE_SCRIPT = r'''#!/usr/bin/env bash
+set -Eeuo pipefail
+
+APP_ROOT="/srv/lean-poc-apps"
+OWNER="$1"
+APP="$2"
+ENVIRONMENT="$3"
+
+valid_slug() { [[ "$1" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]]; }
+valid_repo() { [[ "$1" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; }
+meta_value() {
+    local path="$1" key="$2"
+    [[ -f "$path" && ! -L "$path" ]] || return 1
+    sed -n "s/^${key}=//p" "$path" | head -n1
+}
+assert_owned_marker() {
+    local path="$1"
+    [[ -f "$path" && ! -L "$path" ]] || return 1
+    [[ "$(meta_value "$path" OWNER_REPO || true)" == "$OWNER" && \
+       "$(meta_value "$path" APP_SLUG || true)" == "$APP" && \
+       "$(meta_value "$path" ENVIRONMENT || true)" == "$ENVIRONMENT" ]]
+}
+
+valid_repo "$OWNER" || { echo "Invalid owner repository." >&2; exit 20; }
+valid_slug "$APP" || { echo "Invalid application slug." >&2; exit 20; }
+valid_slug "$ENVIRONMENT" || { echo "Invalid environment slug." >&2; exit 20; }
+
+ROOT="$APP_ROOT/$APP/$ENVIRONMENT"
+STATE="$ROOT/deployment.env"
+PERSISTENCE="$ROOT/persistence.env"
+
+if [[ ! -e "$ROOT" ]]; then
+    printf 'TEAR_DOWN\tabsent\t%s\t%s\n' "$APP" "$ENVIRONMENT"
+    exit 0
+fi
+
+[[ -d "$ROOT" && ! -L "$ROOT" ]] || {
+    echo "POC environment root is not a safe managed directory: $ROOT" >&2
+    exit 21
+}
+
+HAS_STATE=false
+HAS_PERSISTENCE=false
+[[ -f "$STATE" && ! -L "$STATE" ]] && HAS_STATE=true
+[[ -f "$PERSISTENCE" && ! -L "$PERSISTENCE" ]] && HAS_PERSISTENCE=true
+[[ "$HAS_STATE" == true || "$HAS_PERSISTENCE" == true ]] || {
+    echo "POC environment root has no managed ownership marker: $ROOT" >&2
+    exit 21
+}
+
+if [[ "$HAS_STATE" == true ]] && ! assert_owned_marker "$STATE"; then
+    echo "POC deployment ownership mismatch for $ROOT" >&2
+    exit 22
+fi
+if [[ "$HAS_PERSISTENCE" == true ]] && ! assert_owned_marker "$PERSISTENCE"; then
+    echo "POC persistence ownership mismatch for $ROOT" >&2
+    exit 22
+fi
+
+CONTAINER=""
+if [[ "$HAS_STATE" == true ]]; then
+    CURRENT_RELEASE="$(meta_value "$STATE" CURRENT_RELEASE || true)"
+    [[ -n "$CURRENT_RELEASE" && "$CURRENT_RELEASE" != */* && "$CURRENT_RELEASE" != *..* ]] || {
+        echo "Managed deployment state has an invalid current release." >&2
+        exit 23
+    }
+
+    RELEASE_FILE="$ROOT/releases/$CURRENT_RELEASE/release.env"
+    [[ -f "$RELEASE_FILE" && ! -L "$RELEASE_FILE" ]] || {
+        echo "Managed current release metadata is missing: $RELEASE_FILE" >&2
+        exit 23
+    }
+    assert_owned_marker "$RELEASE_FILE" || {
+        echo "Managed release ownership does not match deployment state." >&2
+        exit 23
+    }
+    CONTAINER="$(meta_value "$RELEASE_FILE" CONTAINER_NAME || true)"
+    [[ "$CONTAINER" =~ ^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$ ]] || {
+        echo "Managed release contains an invalid container name." >&2
+        exit 23
+    }
+
+    if docker inspect "$CONTAINER" >/dev/null 2>&1; then
+        docker rm -f "$CONTAINER" >/dev/null
+    fi
+fi
+
+# The verified environment root is owned by this POC/environment. Tear-down
+# removes releases, evidence, persistent data, and backups together.
+rm -rf --one-file-system -- "$ROOT"
+
+APP_DIR="$APP_ROOT/$APP"
+if [[ -d "$APP_DIR" ]] && ! find "$APP_DIR" -mindepth 1 -print -quit | grep -q .; then
+    rmdir "$APP_DIR"
+fi
+
+printf 'TEAR_DOWN\tremoved\t%s\t%s\t%s\n' "$APP" "$ENVIRONMENT" "$CONTAINER"
+'''