@underpostnet/cyberia 3.3.0 → 3.3.76

package/test/unit/test-tiers.test.js

@@ -0,0 +1,220 @@
+'use strict';
+
+import { expect } from 'chai';
+import fs from 'node:fs';
+import {
+  TEST_TIERS,
+  UNDERPOST_TESTING,
+  coverageIncludeFactory,
+  coverageReportKey,
+  coverageThresholdFactory,
+  resolveTestSelection,
+  testProjectsFactory,
+  testSuiteNames,
+  vitestProjectSelector,
+} from '../../src/server/build/testing.js';
+
+// The table declares every tier the platform ships. A product build slices the
+// tree, so whether a tier's directory is present here is a catalog question,
+// asserted in catalog.test.js — these are about the table itself.
+describe('test tiers', () => {
+  it('names every tier uniquely', () => {
+    const names = TEST_TIERS.map(({ name }) => name);
+    expect(new Set(names).size).to.equal(names.length);
+  });
+
+  it('never leaves a tier on group order 0', () => {
+    // Vitest routes a single-worker project on the default 0 into a bucket it
+    // appends after every ordered group, which would run that tier last.
+    for (const { name, groupOrder } of TEST_TIERS) expect(groupOrder, name).to.be.greaterThan(0);
+  });
+
+  it('declares tiers in the order they run', () => {
+    const orders = TEST_TIERS.map(({ groupOrder }) => groupOrder);
+    expect(orders).to.deep.equal([...orders].sort((a, b) => a - b));
+  });
+
+  it('keeps delegated tiers in the last group', () => {
+    // They run after the Vitest pass, so an earlier group order would describe
+    // an execution order that does not happen.
+    const lastGroup = Math.max(...TEST_TIERS.map(({ groupOrder }) => groupOrder));
+    for (const { name, groupOrder, delegate } of TEST_TIERS) if (delegate) expect(groupOrder, name).to.equal(lastGroup);
+  });
+
+  it('exposes only non-delegated tiers as Vitest projects', () => {
+    const projects = testProjectsFactory().map(({ test }) => test.name);
+    expect(projects).to.deep.equal(TEST_TIERS.filter(({ delegate }) => !delegate).map(({ name }) => name));
+  });
+});
+
+describe('test tier selection', () => {
+  it('runs every tier when nothing is selected', () => {
+    for (const selector of ['', 'all']) {
+      const { projects, runVitest, delegated } = resolveTestSelection(selector);
+      // No explicit project list: Vitest runs them all, and a product build
+      // that strips one must not fail on a name it no longer ships.
+      expect(projects, selector).to.be.empty;
+      expect(runVitest, selector).to.equal(true);
+      expect(
+        delegated.map(({ name }) => name),
+        selector,
+      ).to.deep.equal(TEST_TIERS.filter(({ delegate }) => delegate).map(({ name }) => name));
+    }
+  });
+
+  it('expands a suite into its tiers', () => {
+    expect(resolveTestSelection('infra').projects).to.deep.equal(
+      TEST_TIERS.filter(({ name }) => name.startsWith('infra:')).map(({ name }) => name),
+    );
+  });
+
+  it('skips the Vitest pass when only delegated tiers are selected', () => {
+    const { runVitest, delegated } = resolveTestSelection('contracts');
+    expect(runVitest).to.equal(false);
+    expect(delegated.map(({ name }) => name)).to.deep.equal(['contracts']);
+  });
+
+  it('rejects an unknown selector instead of reporting an empty green run', () => {
+    expect(() => resolveTestSelection('not-a-suite')).to.throw(/unknown suite/);
+  });
+
+  it('offers every suite prefix as a selector', () => {
+    for (const suite of testSuiteNames()) expect(() => resolveTestSelection(suite), suite).to.not.throw();
+  });
+});
+
+describe('delegated tier commands', () => {
+  const delegated = TEST_TIERS.filter(({ delegate }) => delegate);
+
+  it('ships at least one delegated tier to assert against', () => {
+    expect(delegated).to.not.be.empty;
+  });
+
+  it('writes results only when a destination is given', () => {
+    for (const { name, delegate } of delegated) {
+      expect(delegate({}), name).to.not.include('--test-reporter-destination=/');
+      expect(delegate({ resultsPath: '/results/TEST-x.xml' }), name).to.include('/results/TEST-x.xml');
+    }
+  });
+
+  it('passes a name filter through to its runner', () => {
+    for (const { name, delegate } of delegated) expect(delegate({ grep: 'Burning' }), name).to.include('Burning');
+  });
+
+  // Under an outer `npm`, npx resolves the root project as the local prefix and
+  // pulls its own copy of a nested tool from the registry, which Hardhat then
+  // refuses to run as a non-local installation.
+  it('runs nested tooling from the nested install rather than through npx', () => {
+    for (const { name, delegate } of delegated) {
+      expect(delegate({}), name).to.not.match(/\bnpx\b/);
+      expect(delegate({}), name).to.include('./node_modules/.bin/');
+    }
+  });
+
+  // A directory left behind by an interrupted install passes a `-d` probe while
+  // holding none of the binaries the tier runs.
+  it('probes the installed binary before skipping the install', () => {
+    for (const { name, delegate } of delegated)
+      expect(delegate({}), name).to.match(/\[ -x node_modules\/\.bin\/[\w.-]+ \] \|\| npm ci/);
+  });
+});
+
+describe('coverage threshold', () => {
+  it('reports without gating until a run opts in', () => {
+    // A tier selection measures a slice of the tree, so the whole-suite number is
+    // not the bar it should be held to.
+    expect(coverageThresholdFactory({})).to.equal(null);
+    expect(coverageThresholdFactory({ COVERAGE_ENFORCE: '0' })).to.equal(null);
+  });
+
+  it('gates an opted-in run on the shipped threshold', () => {
+    for (const COVERAGE_ENFORCE of ['1', 'true'])
+      expect(coverageThresholdFactory({ COVERAGE_ENFORCE }), COVERAGE_ENFORCE).to.equal(
+        UNDERPOST_TESTING.coverageThreshold,
+      );
+  });
+
+  it('lets a repository ratchet its own bar', () => {
+    expect(coverageThresholdFactory({ COVERAGE_MIN: '25' })).to.equal(25);
+    // An unset repository variable arrives as an empty string, not as absent.
+    expect(coverageThresholdFactory({ COVERAGE_ENFORCE: '1', COVERAGE_MIN: '' })).to.equal(
+      UNDERPOST_TESTING.coverageThreshold,
+    );
+  });
+
+  it('refuses a bar that is not a percentage', () => {
+    for (const COVERAGE_MIN of ['eighty', '-1', '101'])
+      expect(() => coverageThresholdFactory({ COVERAGE_MIN }), COVERAGE_MIN).to.throw('COVERAGE_MIN');
+  });
+});
+
+describe('coverage scope', () => {
+  const vitestTiers = TEST_TIERS.filter(({ delegate }) => !delegate);
+
+  it('makes every Vitest tier accountable for the sources it drives', () => {
+    for (const { name, sources } of vitestTiers) expect(sources, name).to.not.be.empty;
+  });
+
+  it('leaves a delegated tier out of the Vitest report', () => {
+    // Its runner measures its own coverage, and this table only feeds Vitest.
+    for (const { name, sources, delegate } of TEST_TIERS) if (delegate) expect(sources, name).to.equal(undefined);
+  });
+
+  it('points every glob at something this tree ships', () => {
+    // A source that moved leaves the tier silently measuring nothing, which
+    // reads as coverage rather than as the missing measurement it is. A product
+    // build slices the tree, so only tiers it kept are asserted.
+    for (const { name, directory, sources } of vitestTiers) {
+      if (!fs.existsSync(directory)) continue;
+      for (const glob of sources) expect(fs.globSync(glob), `${name}: ${glob}`).to.not.be.empty;
+    }
+  });
+
+  it('measures every tier when the run selects none', () => {
+    const everySource = new Set(vitestTiers.flatMap(({ sources }) => sources));
+    expect(coverageIncludeFactory([])).to.have.members([...everySource]);
+  });
+
+  it('measures only the selected tiers', () => {
+    const unit = TEST_TIERS.find(({ name }) => name === 'unit').sources;
+    for (const argv of [['--project', 'unit'], ['--project=unit']])
+      expect(coverageIncludeFactory(['npx', 'vitest', 'run', ...argv, '--coverage']), argv.join(' ')).to.deep.equal(
+        unit,
+      );
+  });
+
+  it('counts a source two tiers drive once', () => {
+    const include = coverageIncludeFactory(['--project', 'infra:3-cluster', '--project', 'infra:4-ingress']);
+    expect(new Set(include).size).to.equal(include.length);
+    expect(include).to.include('src/server/runtime/conf.js');
+  });
+
+  it('rejects a selection that matches no tier', () => {
+    expect(() => coverageIncludeFactory(['--project', 'not-a-tier'])).to.throw(/unknown suite/);
+  });
+});
+
+describe('coverage report directory', () => {
+  it('names the report after the suites the selection spans', () => {
+    expect(coverageReportKey('unit,infra,app')).to.equal('unit-infra-app');
+    expect(coverageReportKey('cyberia')).to.equal('cyberia');
+    expect(coverageReportKey('infra:1-security,infra:2-network')).to.equal('infra');
+  });
+
+  it('names every Vitest suite for a full run and none for a delegated one', () => {
+    expect(coverageReportKey('')).to.equal(coverageReportKey('all'));
+    expect(coverageReportKey('all').split('-')).to.have.members([
+      ...new Set(TEST_TIERS.filter(({ delegate }) => !delegate).map(({ name }) => name.split(':')[0])),
+    ]);
+    expect(coverageReportKey('contracts')).to.equal('');
+  });
+
+  // A deploy names its report by suite and the runner is handed the same tiers as
+  // `--project` flags; both must land on one directory.
+  it('agrees between a suite selector and the projects the runner was handed', () => {
+    const { projects } = resolveTestSelection('unit,infra,app');
+    const argv = ['npx', 'vitest', 'run', ...projects.flatMap((project) => ['--project', project]), '--coverage'];
+    expect(coverageReportKey(vitestProjectSelector(argv))).to.equal(coverageReportKey('unit,infra,app'));
+    expect(vitestProjectSelector(['--project=cyberia'])).to.equal('cyberia');
+  });
+});

package/test/unit/zip-archive.test.js

@@ -0,0 +1,142 @@
+'use strict';
+
+/**
+ * @module zip-archive.test
+ * @description Covers the JSZip-backed archive helpers shared by the file-storage CLI and the
+ * client builder: local-file archiving, full and single-entry extraction, entry lookup by
+ * basename, and the guard that keeps an archive path from escaping the extraction root.
+ *
+ * Uses 'chai' for assertions.
+ */
+
+import { expect } from 'chai';
+import fs from 'fs-extra';
+import JSZip from 'jszip';
+import * as dir from 'path';
+import {
+  extractZipEntryTo,
+  extractZipTo,
+  findZipEntry,
+  isZipBuffer,
+  loadZip,
+  readZipEntry,
+  zipFromLocalFiles,
+} from '../../src/server/storage/zip.js';
+
+describe('zip archive helpers', () => {
+  let fixturePath;
+
+  beforeEach(() => {
+    fixturePath = fs.mkdtempSync('/tmp/engine-zip-archive-');
+    fs.mkdirSync(`${fixturePath}/src/nested`, { recursive: true });
+    fs.writeFileSync(`${fixturePath}/src/index.html`, '<h1>index</h1>'.repeat(200), 'utf8');
+    fs.writeFileSync(`${fixturePath}/src/nested/app.js`, 'console.log(1);'.repeat(200), 'utf8');
+    fs.writeFileSync(`${fixturePath}/src/run.sh`, '#!/bin/sh\necho run\n', 'utf8');
+    fs.chmodSync(`${fixturePath}/src/run.sh`, 0o755);
+  });
+
+  afterEach(() => {
+    fs.removeSync(fixturePath);
+  });
+
+  const buildFixtureArchive = () =>
+    zipFromLocalFiles([
+      { localPath: `${fixturePath}/src/index.html`, entryName: 'index.html' },
+      { localPath: `${fixturePath}/src/nested/app.js`, entryName: 'nested/app.js' },
+      { localPath: `${fixturePath}/src/run.sh`, entryName: 'run.sh' },
+    ]);
+
+  it('writes a deflated archive that keeps the requested entry names', async () => {
+    const archive = await buildFixtureArchive();
+    const rawBytes = ['src/index.html', 'src/nested/app.js', 'src/run.sh'].reduce(
+      (total, relativePath) => total + fs.statSync(`${fixturePath}/${relativePath}`).size,
+      0,
+    );
+
+    expect(isZipBuffer(archive)).to.equal(true);
+    expect(archive.length).to.be.below(rawBytes);
+    const entries = Object.values((await loadZip(archive)).files);
+    expect(entries.filter((entry) => entry.dir).map((entry) => entry.name)).to.deep.equal(['nested/']);
+    expect(
+      entries
+        .filter((entry) => !entry.dir)
+        .map((entry) => entry.name)
+        .sort(),
+    ).to.deep.equal(['index.html', 'nested/app.js', 'run.sh']);
+  });
+
+  it('round-trips an archive through extraction, preserving content and executable bits', async () => {
+    const outputPath = `${fixturePath}/out`;
+    await extractZipTo(await buildFixtureArchive(), outputPath);
+
+    expect(fs.readFileSync(`${outputPath}/nested/app.js`, 'utf8')).to.equal(
+      fs.readFileSync(`${fixturePath}/src/nested/app.js`, 'utf8'),
+    );
+    expect(fs.statSync(`${outputPath}/run.sh`).mode & 0o777).to.equal(0o755);
+  });
+
+  it('extracts from an archive path as well as from a buffer', async () => {
+    const archivePath = `${fixturePath}/build.zip`;
+    fs.writeFileSync(archivePath, await buildFixtureArchive());
+    await extractZipTo(archivePath, `${fixturePath}/from-path`);
+
+    expect(fs.existsSync(`${fixturePath}/from-path/nested/app.js`)).to.equal(true);
+  });
+
+  it('resolves an entry by exact name, by basename, and by single-entry fallback', async () => {
+    const nested = await loadZip(await buildFixtureArchive());
+    expect(findZipEntry(nested, 'nested/app.js').name).to.equal('nested/app.js');
+    expect(findZipEntry(nested, 'app.js').name).to.equal('nested/app.js');
+    expect(findZipEntry(nested, 'absent.js')).to.equal(null);
+
+    const single = await loadZip(
+      await zipFromLocalFiles([{ localPath: `${fixturePath}/src/index.html`, entryName: 'deep/path/index.html' }]),
+    );
+    expect(findZipEntry(single, 'absent.js').name).to.equal('deep/path/index.html');
+  });
+
+  it('reads a wrapped entry out of a single-file archive', async () => {
+    const inner = await buildFixtureArchive();
+    fs.writeFileSync(`${fixturePath}/inner.zip`, inner);
+    const wrapper = await zipFromLocalFiles([
+      { localPath: `${fixturePath}/inner.zip`, entryName: 'wrapped/inner.zip' },
+    ]);
+
+    expect(await readZipEntry(wrapper, 'inner.zip')).to.deep.equal(inner);
+  });
+
+  it('flattens a single extracted entry into the target directory', async () => {
+    const archive = await zipFromLocalFiles([
+      { localPath: `${fixturePath}/src/index.html`, entryName: 'deep/path/index.html' },
+    ]);
+    const targetDir = `${fixturePath}/pull`;
+    const written = await extractZipEntryTo(archive, 'index.html', targetDir);
+
+    expect(written).to.equal(dir.resolve(targetDir, 'index.html'));
+    expect(fs.readFileSync(written, 'utf8')).to.equal(fs.readFileSync(`${fixturePath}/src/index.html`, 'utf8'));
+  });
+
+  it('rejects a missing entry rather than writing an empty file', async () => {
+    const archive = await buildFixtureArchive();
+    let thrown;
+    await extractZipEntryTo(archive, 'index.html', `${fixturePath}/missing`).catch((error) => (thrown = error));
+    expect(thrown).to.equal(undefined);
+
+    await extractZipEntryTo(await buildFixtureArchive(), 'absent.js', `${fixturePath}/missing`).catch(
+      (error) => (thrown = error),
+    );
+    expect(thrown?.message).to.match(/Zip entry not found/);
+  });
+
+  it('blocks an archive entry that resolves outside the extraction root', async () => {
+    const escaping = new JSZip();
+    escaping.file('../escaped.txt', 'escaped');
+    const archive = await escaping.generateAsync({ type: 'nodebuffer' });
+
+    let thrown;
+    await extractZipTo(archive, `${fixturePath}/guarded`).catch((error) => (thrown = error));
+
+    expect(thrown?.message).to.match(/Blocked zip entry outside extraction directory/);
+    expect(fs.existsSync(`${fixturePath}/escaped.txt`)).to.equal(false);
+  });
+});

package/vitest.config.js

@@ -0,0 +1,66 @@
+import { defineConfig } from 'vitest/config';
+import {
+  UNDERPOST_TESTING,
+  coverageIncludeFactory,
+  coverageReportKey,
+  coverageThresholdFactory,
+  testProjectsFactory,
+  vitestProjectSelector,
+} from './src/server/build/testing.js';
+
+const allureResultsDirectory = process.env[UNDERPOST_TESTING.allureResultsEnvKey];
+const coverageThreshold = coverageThresholdFactory(process.env);
+const coverageInclude = coverageIncludeFactory(process.argv);
+const coverageReportDirectory = coverageReportKey(vitestProjectSelector(process.argv));
+
+// Spread into every tier: a Vitest project inherits nothing from the root
+// `test` block, and only `coverage` and `reporters` are read from it.
+const projectDefaults = {
+  // Mocha's `describe`/`it` and the hooks stay global, so the suites read the
+  // same either side of the migration and carry no runner import.
+  globals: true,
+  environment: 'node',
+  // A tier is only meaningful if its failures are attributable to it, and a
+  // suite that reads `dd.routes` or binds a fixed port cannot share a worker
+  // with another doing the same.
+  fileParallelism: false,
+  ...(allureResultsDirectory ? { setupFiles: ['allure-vitest/setup'] } : {}),
+};
+
+export default defineConfig({
+  test: {
+    reporters: [
+      'default',
+      ...(allureResultsDirectory ? [['allure-vitest/reporter', { resultsDir: allureResultsDirectory }]] : []),
+    ],
+    coverage: {
+      provider: 'v8',
+      reportsDirectory: UNDERPOST_TESTING.coverageDirectory,
+      // `lcovonly` is what Coveralls ingests, `json` is what a merged multi-job
+      // report is assembled from, `text` is what a local run reads, and `html` is
+      // what a deploy publishes — under the selection's own directory, so the
+      // report a deploy declares is the run it names and never the last run made.
+      reporter: ['text', 'lcovonly', 'json', ['html', { subdir: coverageReportDirectory }]],
+      // The directory holds one report per selection, so a run must not empty it; the
+      // runner (`src/cli/test.js`) clears its own selection's report before it starts.
+      clean: false,
+      // Written even when the run fails: the coverage workflows upload the report
+      // from a job the threshold step is meant to fail, and without it the badge
+      // freezes at the last passing build instead of moving with the tree.
+      reportOnFailure: true,
+      // The tiers in the selection decide what is measured, so a partial run
+      // reports the slice it drives and the whole run reports the whole of it —
+      // rather than every module the CLI barrel drags into a worker on import.
+      include: coverageInclude,
+      // Only the suites themselves: an `include` whitelist already keeps
+      // dependencies, bundles and generated assets out, and a directory pattern
+      // here is not anchored to the root — `test/**` also excluded the API
+      // surfaces named `test`, so the tier covering them reported nothing.
+      exclude: ['**/*.{test,spec}.js'],
+      // Absent unless the run opted in, so a single-tier run reports its slice
+      // instead of failing against a number it never measured.
+      ...(coverageThreshold === null ? {} : { thresholds: { lines: coverageThreshold } }),
+    },
+    projects: testProjectsFactory(projectDefaults),
+  },
+});

package/.nycrc

@@ -1,9 +0,0 @@
-{
-  "exclude": [],
-  "include": ["test"],
-  "output": "reports",
-  "reporter": ["html", "text", "lcov", "text-lcov", "cobertura"],
-  "sourceMap": true,
-  "instrument": true,
-  "all": true
-}

package/deploy/lib/logging.sh

@@ -1,96 +0,0 @@
-# Shared logging helpers for deploy/<deploy-id>/*.sh. Sourced, never executed directly.
-#
-# Deploy script contract:
-# - one run_quiet call per remote command, with its own label
-# - the body lives in main(), invoked on the last line: the first remote command
-#   pulls this repository, rewriting the running script while bash reads it
-#
-# run_quiet hides normal output, prints only `patterns` matches plus the next
-# `lines_after` lines, and returns the command's exit status so `set -e` stops
-# the deployment. On failure it keeps two temp files and prints their paths in
-# red instead of their contents: the command's own stderr (native error message
-# and stack trace) and the full unfiltered log up to the error.
-
-RUN_QUIET_RED=$'\033[0;31m'
-RUN_QUIET_RESET=$'\033[0m'
-
-RUN_QUIET_NODE_NAME=$(hostname 2>/dev/null | tr '[:upper:]' '[:lower:]')
-RUN_QUIET_NODE_TAG=${RUN_QUIET_NODE_NAME:+ [$RUN_QUIET_NODE_NAME]}
-
-run_quiet() {
-    local label="$1"
-    local patterns="$2"
-    local lines_after="$3"
-    shift 3
-    
-    local debug_log
-    local error_log
-    local fifo_dir
-    local filter_pid
-    local stderr_pid
-    local status=0
-    
-    echo "$(date -Is) $RUN_QUIET_NODE_TAG ▶ $label"
-    
-    debug_log=$(mktemp --suffix=.debug.log)
-    error_log=$(mktemp --suffix=.error.log)
-    fifo_dir=$(mktemp -d)
-    mkfifo "$fifo_dir/merged" "$fifo_dir/stderr"
-    
-    # The filter reads the live stream rather than the finished log: a deployment
-    # monitor prints its matches for minutes before exiting, so a pass over the
-    # completed file would show nothing until then. fflush defeats awk's block
-    # buffering, which otherwise withholds matches whenever stdout is a pipe.
-    # awk writes the debug log itself rather than piping through tee, so the
-    # reader stays a single process that a kill can always release.
-    awk \
-    -v pattern="$patterns" \
-    -v lines_after="$lines_after" \
-    -v debug_log="$debug_log" '
-        {
-            print > debug_log
-        }
-        $0 ~ pattern {
-            remaining = lines_after + 1
-        }
-        remaining > 0 {
-            print
-            fflush()
-            remaining--
-        }
-    ' <"$fifo_dir/merged" &
-    filter_pid=$!
-    
-    # stderr is duplicated: on its own for the native error and stack trace, and
-    # into the merged stream so both the debug log and the filter see it in
-    # chronological order with stdout.
-    tee -a "$error_log" <"$fifo_dir/stderr" >"$fifo_dir/merged" &
-    stderr_pid=$!
-    
-    "$@" >"$fifo_dir/merged" 2>"$fifo_dir/stderr" || status=$?
-    
-    # Drain both readers before the paths are printed, or the trace can still be
-    # in flight. Bounded: a command that leaks a child holding a stream open must
-    # not hang the deployment, and by then everything read has been written.
-    run_quiet_drain "$stderr_pid"
-    run_quiet_drain "$filter_pid"
-    rm -rf "$fifo_dir"
-    
-    if [ "$status" -ne 0 ]; then
-        printf '%s✖ %s failed (exit %s)\n  error trace: %s\n  debug log:   %s%s\n' \
-        "$RUN_QUIET_RED" "$label" "$status" "$error_log" "$debug_log" "$RUN_QUIET_RESET" >&2
-        return "$status"
-    fi
-    
-    rm -f "$debug_log" "$error_log"
-    
-    return "$status"
-}
-
-run_quiet_drain() {
-    local pid="$1"
-    
-    timeout 10 tail --pid="$pid" -f /dev/null 2>/dev/null || true
-    kill "$pid" 2>/dev/null || true
-    wait "$pid" 2>/dev/null || true
-}

package/manifests/cronjobs/dd-cron/dd-cron-dns.yaml

@@ -1,48 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: dd-cron-dns
-  namespace: default
-  labels:
-    app: dd-cron-dns
-    managed-by: underpost
-spec:
-  schedule: "* * * * *"
-  concurrencyPolicy: Forbid
-  startingDeadlineSeconds: 200
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 1
-  suspend: false
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          labels:
-            app: dd-cron-dns
-            managed-by: underpost
-        spec:
-          containers:
-            - name: dd-cron-dns
-              image: underpost/underpost-engine:v3.3.0
-              command:
-                - /bin/sh
-                - -c
-                - >
-                  cd /home/dd/engine &&
-                  node bin env dd-cron production &&
-                  node bin cron dd-cron dns --git --kubeadm 
-              volumeMounts:
-                - mountPath: /home/dd/engine
-                  name: underpost-cron-container-volume
-                - mountPath: /usr/lib/node_modules/underpost
-                  name: underpost-share-env
-          volumes:
-            - hostPath:
-                path: /home/dd/engine
-                type: Directory
-              name: underpost-cron-container-volume
-            - hostPath:
-                path: /root/.nvm/versions/node/v24.15.0/lib/node_modules/underpost
-                type: DirectoryOrCreate
-              name: underpost-share-env
-          restartPolicy: OnFailure

package/manifests/mongodb/pv-pvc.yaml

@@ -1,59 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: mongodb-pv-0
-  labels:
-    app: mongodb
-spec:
-  capacity:
-    storage: 5Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: mongodb-storage-class
-  claimRef:
-    namespace: default
-    name: mongodb-storage-mongodb-0
-  hostPath:
-    path: /data/mongodb/v0
-    type: DirectoryOrCreate
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: mongodb-pv-1
-  labels:
-    app: mongodb
-spec:
-  capacity:
-    storage: 5Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: mongodb-storage-class
-  claimRef:
-    namespace: default
-    name: mongodb-storage-mongodb-1
-  hostPath:
-    path: /data/mongodb/v1
-    type: DirectoryOrCreate
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: mongodb-pv-2
-  labels:
-    app: mongodb
-spec:
-  capacity:
-    storage: 5Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: mongodb-storage-class
-  claimRef:
-    namespace: default
-    name: mongodb-storage-mongodb-2
-  hostPath:
-    path: /data/mongodb/v2
-    type: DirectoryOrCreate

package/scripts/coverall-test-cyberia.sh

@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-set -u -o pipefail
-
-EXCLUDES=(
-    --exclude="test/cluster-instances.test.js"
-    --exclude="test/deploy-monitor.test.js"
-    --exclude="test/deploy-node-placement.test.js"
-    --exclude="test/instance-traffic-plan.test.js"
-    --exclude="test/sops-secret-store.test.js"
-    --exclude="test/underpost-gateway.test.js"
-    --exclude="test/underpost-ingress.test.js"
-    --exclude="test/wireguard-edge.test.js"
-)
-
-TESTS=(
-    test/cyberia-instance-conf-defaults.test.js
-    test/cyberia-load.test.js
-    test/object-layer-item-id.test.js
-    test/api.test.js
-    test/crypto.test.js
-    test/shape-generator.test.js
-)
-
-c8 "${EXCLUDES[@]}" mocha "${TESTS[@]}"