@underpostnet/cyberia 3.3.76 → 3.4.0

package/src/cli/release.js

@@ -503,6 +503,8 @@ class UnderpostRelease {
       shellExec(`sudo rm -rf ./engine-private/conf/dd-default`);
       shellExec(`node bin cron --kubeadm --setup-start --git`); // --apply
       shellExec(`node bin cmt --changelog-build`);
+      shellExec(`npm run security`);
+      shellExec(`sudo rm -rf ./conf.dd*.js`);
       return { from: version, to: newVersion, files: report.map((r) => r.file), dryRun: false };
     },
 
@@ -547,7 +549,9 @@ class UnderpostRelease {
       logger.info(`CI push commit message: ${commitMsg}`);
       shellExec(`node engine/bin clone --bare ${githubOrg}/${repoName}`);
       shellCd('/home/dd/engine');
-      shellExec(`node bin/build ${buildTarget}`);
+      // `--coverage` runs the suites the deploy's `docs.coverage` names so the published
+      // source carries the reports; without it the pod serves the unavailable page.
+      shellExec(`node bin/build ${buildTarget} --coverage`);
       shellCd('/home/dd/pwa-microservices-template');
       shellExec(`rm -rf ./.git`);
       shellExec(`mv ../${repoName}.git ./.git`);

package/src/cli/repository.js

@@ -950,7 +950,12 @@ Prevent build private config repo.`,
       confRawPaths[1] = `${JSON.stringify(DefaultConf)};`;
       const targetConfPath = `./conf${defaultConf ? '' : `.${deployId}`}.js`;
       fs.writeFileSync(targetConfPath, confRawPaths.join(sepRender), 'utf8');
-      shellExec(`prettier --write ${targetConfPath}`);
+      // A host tool, not a dependency: without it the manifest stays valid, only unformatted.
+      if (
+        `${shellExec('command -v prettier', { silent: true, silentOnError: true, stdout: true, disableLog: true }) ?? ''}`.trim()
+      )
+        shellExec(`prettier --write ${shellArgumentFactory(targetConfPath)}`);
+      else logger.warn('prettier is not on PATH; conf manifest left unformatted', { targetConfPath });
     },
 
     /**
@@ -1985,7 +1990,7 @@ Prevent build private config repo.`,
             `export GITHUB_TOKEN='${githubToken.replace(/'/g, "'\\''")}'`,
             `export GITHUB_USERNAME='${githubUsername.replace(/'/g, "'\\''")}'`,
             `git config --global --add safe.directory '${siteRoot}' 2>/dev/null || true`,
-            `cd '${siteRoot}' && git add -A && git commit -m 'backup $(date -u +%Y-%m-%dT%H:%M:%SZ)' || true`,
+            `cd '${siteRoot}' && git add -A && git commit -m "backup $(date -u +%Y-%m-%dT%H:%M:%SZ)" || true`,
             `cd '${siteRoot}' && underpost push . ${githubUsername}/${repoName}`,
             `cd /home/dd/engine && node bin host clean --force`,
           ].join(' && ');
@@ -2160,13 +2165,13 @@ Prevent build private config repo.`,
 
     /**
      * Ensures a deploy's public source repo (e.g. `engine-prototype`) is present
-     * next to the engine and reset to a pristine HEAD, so catalog `sourceMoves`
-     * can (re)pull custom sources even after a previous build moved them out of
-     * the source tree.
+     * next to the engine, so catalog `sourceMoves` the engine tree lacks can be
+     * copied in.
      *
-     * Clones `../<repoName>` when missing; otherwise restores a clean checkout
-     * (`git checkout .` brings back any moved-out tracked files) and pulls latest.
-     * Mirrors the sibling-repo handling used by `syncPrivateConf`.
+     * Clones `../<repoName>` when missing; otherwise fast-forwards it. The working
+     * tree is never reset: it is the git view of edits made in the engine tree,
+     * which ignores those paths, so a pending change there is review material, not
+     * something to discard.
      *
      * @param {string} repoName - Public source repo name (e.g. `engine-prototype`).
      * @returns {boolean} `true` when the repo is available on disk.
@@ -2182,9 +2187,7 @@ Prevent build private config repo.`,
       } else {
         const repoAbsPath = path.resolve(repoPath);
         shellExec(`git config --global --add safe.directory '${repoAbsPath}'`);
-        shellExec(`cd ${repoPath} && git checkout . && git clean -f -d && underpost pull . ${gitUri}`, {
-          silent: true,
-        });
+        shellExec(`cd ${repoPath} && underpost pull . ${gitUri}`, { silent: true });
       }
       return fs.existsSync(repoPath);
     },

package/src/cli/run.js

@@ -3079,7 +3079,7 @@ EOF`);
         const hostListenResult = etcHostFactory(hosts);
         logger.info(hostListenResult.renderHosts);
       }
-      const version = 'v3.3.76';
+      const version = 'v3.4.0';
       const instanceOptionsFactory = (deployId, instanceId) => ({
         ...options,
         ...clusterContextFactory(clusterType),
@@ -3518,10 +3518,17 @@ EOF`);
           logger.info('[gateway-status] Backend probe (same Host and path, bypassing Envoy)', { backendProbes });
           // Only the rule the browser actually hit is comparable, so judge on
           // the root rule rather than on every rule of the route.
+          // The gateway answer carries the `server` header (`502 (nginx)`), the
+          // direct one is the bare code: compared as strings, every relayed status
+          // read as a routing fault, and the data plane log was dumped on a healthy
+          // edge whose only problem was an absent workload.
+          const statusCode = (answer) => /^([0-9]{3})/.exec(`${answer ?? ''}`)?.[1];
           const rootProbes = backendProbes.filter((entry) => entry.request.endsWith('/'));
-          const appFault = rootProbes.filter((entry) => `${entry.direct}` === `${entry.gateway}`);
+          const appFault = rootProbes.filter(
+            (entry) => statusCode(entry.direct) && statusCode(entry.direct) === statusCode(entry.gateway),
+          );
           const gatewayFault = rootProbes.filter(
-            (entry) => /^[0-9]{3}$/.test(entry.direct) && `${entry.direct}` !== `${entry.gateway}`,
+            (entry) => statusCode(entry.direct) && statusCode(entry.direct) !== statusCode(entry.gateway),
           );
           if (gatewayFault.length > 0) {
             logger.warn(