@wdyy/skills 0.1.5 → 0.1.7

package/.well-known/skills/wdyy-deployment-standard/scripts/validate-deployment-package.mjs

@@ -1,9 +1,11 @@
 #!/usr/bin/env node
-import { readFile } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { lstat, readFile, readdir, stat } from 'node:fs/promises';
+import { basename, join, relative, resolve, sep } from 'node:path';
 
-const [deployPath, nginxPath, composePath] = process.argv.slice(2);
-if (!deployPath || !nginxPath || !composePath) {
-  throw new Error('Pass deploy.sh, nginx config and compose file paths');
+const [deployPath, nginxPath, composePath, packageRoot] = process.argv.slice(2);
+if (!deployPath || !nginxPath || !composePath || !packageRoot) {
+  throw new Error('Pass deploy.sh, Nginx template, Compose file and generated deploy directory paths');
 }
 
 const [deploy, nginx, compose] = await Promise.all([
@@ -12,37 +14,204 @@ const [deploy, nginx, compose] = await Promise.all([
   readFile(composePath, 'utf8'),
 ]);
 
-const deployRequirements = [
-  'start)',
-  'stop)',
-  'restart)',
-  'status)',
-  'rollback)',
-  'version="$2"',
-  'HEALTH_URL',
-  'VERSION_URL',
-  'database/migrations',
-];
-const nginxRequirements = ['location /releases/', '/current'];
-const composeRequirements = [
-  'backend-blue:',
-  'backend-green:',
-  'INSTANCE_ID',
-  'blue',
-  'green',
-  'LOG_DIR',
+function requirePattern(text, pattern, message) {
+  if (!pattern.test(text)) throw new Error(message);
+}
+
+function parseDotenv(text) {
+  const values = new Map();
+  for (const [index, raw] of text.replaceAll('\r\n', '\n').split('\n').entries()) {
+    if (!raw || /^\s*#/.test(raw)) continue;
+    const match = raw.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);
+    if (!match) throw new Error(`Invalid root .env line ${index + 1}`);
+    if (values.has(match[1])) throw new Error(`Duplicate root .env key: ${match[1]}`);
+    let value = match[2];
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
+      value = value.slice(1, -1);
+    } else if (value.startsWith('"') || value.startsWith("'")) {
+      throw new Error(`Unclosed root .env quote: ${match[1]}`);
+    }
+    values.set(match[1], value);
+  }
+  return values;
+}
+
+const commands = ['build', 'start', 'replace', 'restart', 'stop', 'remove', 'status', 'rollback'];
+for (const command of commands) {
+  requirePattern(deploy, new RegExp(`^  ${command}\\)`, 'm'), `Missing deployment command: ${command}`);
+}
+for (const command of commands.filter((item) => item !== 'rollback')) {
+  requirePattern(
+    deploy,
+    new RegExp(`^  ${command}\\) \\[\\[ "\\$#" -eq 1 \\]\\] \\|\\| usage;`, 'm'),
+    `${command} must reject extra arguments`,
+  );
+}
+requirePattern(deploy, /^  rollback\) \[\[ "\$#" -eq 2 \]\] \|\| usage;/m, 'rollback must require exactly one version');
+
+const requiredDeploySemantics = [
+  /release_ledger next/,
+  /pnpm test/,
+  /pnpm lint/,
+  /pnpm typecheck/,
+  /pnpm build/,
+  /frontend_image="\$\{PROJECT_NAME\}_frontend:\$version"/,
+  /backend_image="\$\{PROJECT_NAME\}_backend:\$version"/,
+  /docker save -o "\$version_root\/frontend-image\.tar"/,
+  /docker save -o "\$version_root\/backend-image\.tar"/,
+  /load_dotenv "\$DEPLOY_ROOT\/\.env"/,
+  /endpoint_url "\$DOCKER_BIND_IP"/,
+  /server deploy root must be exactly/,
+  /assert_project_ports_isolated/,
+  /flock -x 9/,
+  /Nginx reload failed; old project configuration restored/,
+  /database migration was not executed/,
+  /docker ps -aq --filter "label=com\.docker\.compose\.project=\$PROJECT_NAME"/,
+  /\$1 == frontend \|\| \$1 == backend/,
 ];
+for (const pattern of requiredDeploySemantics) requirePattern(deploy, pattern, `Missing deployment behavior: ${pattern}`);
+if (/\bsource\s+["']?[^\n]*(?:\.env|ACTIVE_STATE|PREVIOUS_STATE)/.test(deploy)) {
+  throw new Error('Environment and state files must be parsed as data, not sourced');
+}
+if (/\beval\b/.test(deploy)) throw new Error('deploy.sh must not use eval');
+if (/\bpsql\b/.test(deploy)) throw new Error('deploy.sh must not execute database clients');
+if (/\b(?:scp|rsync)\b|\bgit\s+(?:pull|clone)\b/.test(deploy)) throw new Error('deploy.sh must not upload or pull artifacts');
+if (/(?:^|[\s"'])\/srv\//m.test(`${deploy}\n${nginx}\n${compose}`)) throw new Error('Fixed /srv deployment roots are forbidden');
 
-const missing = [
-  ...deployRequirements.filter((value) => !deploy.includes(value)),
-  ...nginxRequirements.filter((value) => !nginx.includes(value)),
-  ...composeRequirements.filter((value) => !compose.includes(value)),
+const serviceNames = [...compose.matchAll(/^  ([a-z-]+):$/gm)].map((match) => match[1]);
+assertDeepEqual(serviceNames, ['frontend-blue', 'backend-blue', 'frontend-green', 'backend-green'], 'Compose must define exactly four ordered blue-green services');
+if (compose.includes(':-') || compose.includes('not-configured')) throw new Error('Compose image fallback is forbidden');
+if ((compose.match(/image: \$\{FRONTEND_IMAGE:\?FRONTEND_IMAGE is required\}/g) ?? []).length !== 2) throw new Error('Both frontend services must require FRONTEND_IMAGE');
+if ((compose.match(/image: \$\{BACKEND_IMAGE:\?BACKEND_IMAGE is required\}/g) ?? []).length !== 2) throw new Error('Both backend services must require BACKEND_IMAGE');
+if ((compose.match(/env_file: \.\.\/\.\.\/\.env/g) ?? []).length !== 4) throw new Error('All four services must use root .env');
+const logMounts = compose.match(/^\s*- \.\.\/\.\.\/logs:\/app\/logs\s*$/gm) ?? [];
+if (logMounts.length !== 4) throw new Error('All four services must mount flat project-root logs');
+if (/LOG_DIR|HOST_LOG_DIR|logs\/(?:frontend|backend|blue|green)/.test(compose)) throw new Error('Configurable or nested log directories are forbidden');
+if (/container_name:/.test(compose)) throw new Error('container_name would weaken Compose project isolation');
+if (/FRONTEND_CONTAINER_PORT|BACKEND_CONTAINER_PORT|BACKEND_LISTEN_HOST|_HEALTH_URL|_VERSION_URL/.test(compose)) {
+  throw new Error('Compose contains legacy duplicate URL or port configuration');
+}
+for (const key of ['FRONTEND_PORT', 'BACKEND_PORT', 'FRONTEND_URL', 'BACKEND_URL']) {
+  if (!compose.includes(`\${${key}}`)) throw new Error(`Compose must use ${key}`);
+}
+
+for (const placeholder of ['__PROJECT_NAME__', '__PROJECT_HTTP_PORT__', '__DOCKER_HOST_PORTS__', '__DEPLOY_ROOT__', '__FRONTEND_UPSTREAM_NAME__', '__BACKEND_UPSTREAM_NAME__']) {
+  if (!nginx.includes(placeholder)) throw new Error(`Nginx template is missing ${placeholder}`);
+}
+if (!/^# wdyy-project: __PROJECT_NAME__$/m.test(nginx) || !/^# wdyy-port: __PROJECT_HTTP_PORT__$/m.test(nginx) || !/^# wdyy-docker-ports: __DOCKER_HOST_PORTS__$/m.test(nginx)) {
+  throw new Error('Nginx template must expose deterministic project and all port markers');
+}
+if (/listen\s+\d+/.test(nginx) || /proxy_pass\s+https?:\/\/(?!__)/.test(nginx)) throw new Error('Nginx URL or port is hardcoded');
+
+const rootEnvPath = join(packageRoot, '.env');
+const rootEnvStat = await stat(rootEnvPath);
+if (!rootEnvStat.isFile() || (rootEnvStat.mode & 0o077) !== 0 || (rootEnvStat.mode & 0o400) === 0) {
+  throw new Error('Root .env must be a private owner-readable file');
+}
+const rootEnvText = await readFile(rootEnvPath, 'utf8');
+const env = parseDotenv(rootEnvText);
+const sectionNames = [...rootEnvText.matchAll(/^# (前端|后端|数据库|API|部署)$/gm)].map((match) => match[1]);
+if (sectionNames.join('|') !== '前端|后端|数据库|API|部署') throw new Error('Root .env must use the five standard sections in order');
+const requiredEnv = [
+  'FRONTEND_URL', 'FRONTEND_PORT', 'BACKEND_URL', 'BACKEND_PORT', 'DB_PORT',
+  'PROJECT_NAME', 'SERVER_PROJECTS_ROOT', 'PROJECT_HTTP_PORT', 'DOCKER_BIND_IP',
+  'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT',
+  'FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE', 'DATABASE_MIGRATION_MODE',
 ];
-if (missing.length) {
-  throw new Error(`Missing deployment requirements: ${missing.join(', ')}`);
+for (const key of requiredEnv) if (!env.get(key)) throw new Error(`Root .env is missing ${key}`);
+for (const key of env.keys()) {
+  if (['FRONTEND_CONTAINER_PORT', 'BACKEND_CONTAINER_PORT', 'BACKEND_LISTEN_HOST'].includes(key) || /_(?:HEALTH|VERSION)_URL$/.test(key)) {
+    throw new Error(`Root .env contains legacy duplicate configuration: ${key}`);
+  }
+}
+if (!/^[a-z][a-z0-9_]*$/.test(env.get('PROJECT_NAME'))) throw new Error('Invalid PROJECT_NAME');
+if (!/^\/.+[^/]$/.test(env.get('SERVER_PROJECTS_ROOT'))) throw new Error('Invalid SERVER_PROJECTS_ROOT');
+for (const key of ['FRONTEND_URL', 'BACKEND_URL', 'DOCKER_BIND_IP']) {
+  if (!/^[A-Za-z0-9:.%-]+$/.test(env.get(key))) throw new Error(`${key} contains unsafe characters`);
 }
-if (/\bscp\b/.test(deploy)) {
-  throw new Error('deploy.sh must not upload artifacts; SCP is a manual engineer action');
+for (const key of ['FRONTEND_BASE_IMAGE', 'BACKEND_BASE_IMAGE']) {
+  if (!/@sha256:[0-9a-f]{64}$/.test(env.get(key))) throw new Error(`${key} must be pinned by digest`);
+}
+const migrationMode = env.get('DATABASE_MIGRATION_MODE');
+if (!['manual', 'none'].includes(migrationMode)) throw new Error('DATABASE_MIGRATION_MODE must be manual or none');
+if (env.has('LOG_DIR') || env.has('HOST_LOG_DIR')) throw new Error('Root .env must not configure log directories');
+const allPortKeys = ['FRONTEND_PORT', 'BACKEND_PORT', 'DB_PORT', 'PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT'];
+for (const key of allPortKeys) {
+  const port = Number(env.get(key));
+  if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error(`${key} must be a valid port`);
+}
+const hostPortKeys = ['PROJECT_HTTP_PORT', 'FRONTEND_BLUE_PORT', 'FRONTEND_GREEN_PORT', 'BACKEND_BLUE_PORT', 'BACKEND_GREEN_PORT'];
+const hostPorts = hostPortKeys.map((key) => Number(env.get(key)));
+if (hostPorts.some((port) => !Number.isInteger(port) || port < 1 || port > 65535) || new Set(hostPorts).size !== hostPorts.length) {
+  throw new Error('Project and host blue-green ports must be valid and unique');
+}
+
+const releaseEnv = await readFile(join(packageRoot, 'release.env'), 'utf8');
+const releaseMatch = releaseEnv.match(/^RELEASE_VERSION=(\d{8}-\d{3})\n$/);
+if (!releaseMatch) throw new Error('release.env must contain exactly one release version');
+const version = releaseMatch[1];
+const expectedRootEntries = ['.env', version, 'deploy.sh', 'release.env'].sort();
+assertDeepEqual((await readdir(packageRoot)).sort(), expectedRootEntries, 'Generated deploy root has unexpected entries');
+if (resolve(deployPath) !== resolve(packageRoot, 'deploy.sh')) throw new Error('deploy.sh must be the package root script');
+if (resolve(nginxPath) !== resolve(packageRoot, version, 'nginx/site.conf')) throw new Error('Nginx path must be inside the selected version');
+if (resolve(composePath) !== resolve(packageRoot, version, 'docker/docker-compose.blue-green.yml')) throw new Error('Compose path must be inside the selected version');
+
+const versionRoot = join(packageRoot, version);
+const requiredPaths = ['frontend-image.tar', 'backend-image.tar', 'manifest.sha256', 'docker/docker-compose.blue-green.yml', 'nginx/site.conf'];
+for (const path of requiredPaths) {
+  const info = await stat(join(versionRoot, path));
+  if (!info.isFile()) throw new Error(`Required release path is not a file: ${path}`);
+}
+if (migrationMode === 'manual') {
+  const runner = await stat(join(versionRoot, 'database/apply-migrations.sh'));
+  if (!runner.isFile() || (runner.mode & 0o111) === 0) throw new Error('Manual migration runner must be executable');
+  const migrations = await readdir(join(versionRoot, 'database/migrations'));
+  if (!migrations.some((item) => /^V\d{3}__[a-z0-9]+(?:_[a-z0-9]+)*\.sql$/.test(item))) throw new Error('Manual migration files are missing');
+} else {
+  await assertMissing(join(versionRoot, 'database'), 'none mode must not package database files');
+}
+
+const versionFiles = (await listFiles(versionRoot)).sort();
+for (const path of versionFiles) {
+  const name = basename(path);
+  if (name === '.env' || name.startsWith('.env.') || /\.(?:pem|key)$/.test(name) || /^(?:id_rsa|id_ed25519|credentials(?:\..*)?)$/.test(name)) {
+    throw new Error(`Secret file must not enter version directory: ${path}`);
+  }
+}
+const manifest = await readFile(join(versionRoot, 'manifest.sha256'), 'utf8');
+const entries = new Map();
+for (const line of manifest.trimEnd().split('\n')) {
+  const match = line.match(/^([0-9a-f]{64})  ([^/].*)$/);
+  if (!match || match[2].split('/').includes('..')) throw new Error(`Invalid manifest entry: ${line}`);
+  if (entries.has(match[2])) throw new Error(`Duplicate manifest entry: ${match[2]}`);
+  entries.set(match[2], match[1]);
+}
+assertDeepEqual([...entries.keys()].sort(), versionFiles.filter((path) => path !== 'manifest.sha256'), 'Manifest coverage is incomplete');
+for (const [path, expected] of entries) {
+  const actual = createHash('sha256').update(await readFile(join(versionRoot, path))).digest('hex');
+  if (actual !== expected) throw new Error(`Checksum mismatch: ${path}`);
+}
+
+process.stdout.write(`valid dual-image deployment package ${version}\n`);
+
+function assertDeepEqual(actual, expected, message) {
+  if (JSON.stringify(actual) !== JSON.stringify(expected)) {
+    throw new Error(`${message}: expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`);
+  }
+}
+
+async function assertMissing(path, message) {
+  try { await lstat(path); } catch (error) { if (error.code === 'ENOENT') return; throw error; }
+  throw new Error(message);
 }
 
-process.stdout.write('valid deployment package\n');
+async function listFiles(root, directory = root) {
+  const result = [];
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const path = join(directory, entry.name);
+    if (entry.isSymbolicLink()) throw new Error(`Release package must not contain symbolic links: ${relative(root, path)}`);
+    if (entry.isDirectory()) result.push(...await listFiles(root, path));
+    else if (entry.isFile()) result.push(relative(root, path).split(sep).join('/'));
+  }
+  return result;
+}