@platforma-sdk/package-builder-lib 1.2.1 → 1.4.0

package/src/core/push-guard.ts

@@ -0,0 +1,42 @@
+// Guard against the silent "image built, never pushed" outcome.
+//
+// Docker auto-push defaults to `isCI() && !isPrivate`, but the entrypoint
+// descriptor is written with the image tag either way. A stray
+// `"private": true` on a software package therefore yields a green CI run and
+// a published block that 404s pulling its image at runtime — the failure only
+// surfaces when a user runs the block (MILAB-6714).
+//
+// So: in CI, building docker images without pushing them is an error unless
+// the caller says it meant to, via `--docker-no-autopush` /
+// `PL_DOCKER_NO_AUTOPUSH=1`.
+
+import * as envs from "./envs";
+import * as util from "./util";
+
+export type PushIntent = {
+  /** Docker images were built in this run. */
+  buildDocker: boolean;
+  /** Resolved auto-push decision. */
+  pushDocker: boolean;
+  /** Caller passed `--docker-no-autopush` / `PL_DOCKER_NO_AUTOPUSH=1`. */
+  pushDisabledExplicitly: boolean;
+  /** How many entrypoints produce a docker image. */
+  dockerPackageCount: number;
+};
+
+/** Throws when a CI run is about to reference docker images it never pushed. */
+export function assertDockerPushIntent(intent: PushIntent): void {
+  if (!envs.isCI()) return;
+  if (!intent.buildDocker || intent.pushDocker) return;
+  if (intent.dockerPackageCount === 0) return;
+  if (intent.pushDisabledExplicitly) return;
+
+  throw util.CLIError(
+    `This CI run would build docker images without pushing them, while still writing ` +
+      `entrypoint descriptors that reference them. Consumers would fail to pull the images.\n` +
+      `  The usual cause is "private": true in package.json: auto-push is gated on ` +
+      `!isPrivate, and software packages must never be private.\n` +
+      `  If this package really must build images without publishing them, say so with ` +
+      `--docker-no-autopush (or ${envs.PL_DOCKER_NO_AUTOPUSH}=1).`,
+  );
+}

package/src/core/sw-json-render.ts

@@ -7,6 +7,7 @@ import type * as swJson from "./schemas/sw-json";
 import type * as entrypoint from "./schemas/entrypoints";
 import * as util from "./util";
 import * as docker from "./docker";
+import * as dockerCoverage from "./docker-coverage";
 import * as defaults from "../defaults";
 import { descriptorFilePath } from "./resolver";
 import { resolveRunEnvironment } from "./resolver";
@@ -179,6 +180,30 @@ export class SwJsonRenderer {
     const dstSwInfoPath = descriptorFilePath(this.pkgInfo.packageRoot, epType, epName);
     util.ensureDirsExist(path.dirname(dstSwInfoPath));
     fs.copyFileSync(srcFile, dstSwInfoPath);
+
+    if (epType === "software") this.warnIfNoDockerVariant(epName, srcFile);
+  }
+
+  /**
+   * A reference re-exports another package's descriptor verbatim, so the docker-coverage
+   * check cannot judge it from this package's declaration — and must not fail on it: the
+   * owning package may have declared itself binary-only on purpose, and that waiver does
+   * not travel inside the descriptor. Warn, naming what to fix and where.
+   */
+  private warnIfNoDockerVariant(epName: string, srcFile: string) {
+    let descriptor: unknown;
+    try {
+      descriptor = JSON.parse(fs.readFileSync(srcFile, "utf-8"));
+    } catch {
+      return; // an unreadable descriptor is the copy's problem to report, not this warning's
+    }
+
+    if (!dockerCoverage.descriptorHasNoDockerVariant(descriptor)) return;
+
+    this.logger.warn(
+      `referenced entrypoint '${epName}' carries no docker image, so no kubernetes ` +
+        `installation can run it. Fix it in the package that owns ${srcFile}.`,
+    );
   }
 
   private renderLocalPackage(

package/src/index.ts

@@ -4,6 +4,13 @@ import { Core } from "./core/core";
 export * as util from "./core/util";
 export * as envs from "./core/envs";
 export * as defaults from "./defaults";
+export { assertDockerPushIntent, type PushIntent } from "./core/push-guard";
+export {
+  assertDockerCoverage,
+  softwareEntrypointsWithoutDocker,
+  descriptorHasNoDockerVariant,
+  type DockerCoverage,
+} from "./core/docker-coverage";
 
 /** The logger the engine and its callers pass around. */
 export type Logger = winston.Logger;
@@ -22,6 +29,8 @@ export type Builder = Pick<
   | "fullDirHash"
   | "version"
   | "isPrivate"
+  | "selectedDockerPackages"
+  | "assertDockerCoverage"
   | "buildDockerImages"
   | "buildSoftwareArchives"
   | "buildSwJsonFiles"