grada-run 0.0.2 → 0.32.0

package/tests/drift.test.js

@@ -0,0 +1,243 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { load as loadYaml } from 'js-yaml';
+import {
+    runDrift,
+    parseDriftArgs,
+    extractRoleArn,
+    extractPlanSummary,
+    scaffoldDriftWorkflow,
+} from '../src/commands/drift.js';
+import { trackEvent, flushTelemetry } from '../src/core/telemetry.js';
+
+vi.mock('@clack/prompts', () => ({
+    intro: vi.fn(),
+    outro: vi.fn(),
+    spinner: () => ({ start: vi.fn(), stop: vi.fn(), message: vi.fn() }),
+}));
+
+vi.mock('../src/core/telemetry.js', () => {
+    const trackEvent = vi.fn();
+    const flushTelemetry = vi.fn().mockResolvedValue();
+    const trackSuccess = vi.fn(async (event, properties) => {
+        trackEvent(event, { ...properties, success: true });
+        await flushTelemetry();
+    });
+    const trackFailure = vi.fn(async (event, properties) => {
+        trackEvent(event, { ...properties, success: false });
+        await flushTelemetry();
+    });
+    return { trackEvent, flushTelemetry, trackSuccess, trackFailure };
+});
+
+let tmpDirs = [];
+let exitSpy;
+let logSpy;
+
+function makeTmp() {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'drift-test-'));
+    tmpDirs.push(dir);
+    return dir;
+}
+
+function writeDeployYml(dir, roleArn = 'arn:aws:iam::123456789012:role/myapp-github-actions-role') {
+    const workflows = path.join(dir, '.github', 'workflows');
+    fs.mkdirSync(workflows, { recursive: true });
+    fs.writeFileSync(
+        path.join(workflows, 'deploy.yml'),
+        `name: Deploy\njobs:\n  deploy:\n    steps:\n      - uses: anton-codes-iac/deploy-stack-action@v1\n        with:\n          role-to-assume: ${roleArn}\n`
+    );
+}
+
+function writeMainTf(dir, region = 'us-east-2') {
+    fs.mkdirSync(path.join(dir, 'terraform'), { recursive: true });
+    fs.writeFileSync(
+        path.join(dir, 'terraform', 'main.tf'),
+        `provider "aws" {\n  region = "${region}"\n}\nlocals {\n  app_name = "myapp\${local.env_suffix}"\n}\n`
+    );
+}
+
+beforeEach(() => {
+    tmpDirs = [];
+    vi.clearAllMocks();
+    exitSpy = vi.spyOn(process, 'exit').mockImplementation(() => {});
+    logSpy = vi.spyOn(console, 'log').mockImplementation(() => {});
+});
+
+afterEach(() => {
+    exitSpy.mockRestore();
+    logSpy.mockRestore();
+    for (const dir of tmpDirs) {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+});
+
+describe('parseDriftArgs', () => {
+    it('parses flags and treats drift init as --setup', () => {
+        expect(parseDriftArgs(['drift', '--setup', '--region', 'eu-west-1'])).toMatchObject({ setup: true, region: 'eu-west-1' });
+        expect(parseDriftArgs(['drift', 'init']).setup).toBe(true);
+        expect(parseDriftArgs(['drift']).setup).toBeUndefined();
+    });
+
+    it('collects unexpected positionals', () => {
+        expect(parseDriftArgs(['drift', 'bogus']).unexpectedPositionals).toEqual(['bogus']);
+    });
+});
+
+describe('extractRoleArn / extractPlanSummary', () => {
+    it('finds the OIDC role ARN in deploy.yml', () => {
+        expect(extractRoleArn('  role-to-assume: arn:aws:iam::1:role/x # comment')).toBe('arn:aws:iam::1:role/x');
+        expect(extractRoleArn('no anchor here')).toBeNull();
+    });
+
+    it('condenses plan output to changes plus the summary', () => {
+        const output = [
+            'random log line',
+            '# aws_lb.main will be updated',
+            '  ~ dns_name = "a" -> "b"',
+            '  + new = true',
+            '  - old = true',
+            'Plan: 0 to add, 1 to change, 0 to destroy.',
+        ].join('\n');
+        const summary = extractPlanSummary(output);
+        expect(summary).not.toContain('random log line');
+        expect(summary).toContain('# aws_lb.main will be updated');
+        expect(summary).toContain('Plan: 0 to add, 1 to change, 0 to destroy.');
+    });
+
+    it('caps long summaries', () => {
+        const output = Array.from({ length: 100 }, (_, i) => `  + line${i} = true`).join('\n');
+        const summary = extractPlanSummary(output);
+        expect(summary.split('\n')).toHaveLength(61);
+        expect(summary).toContain('more lines');
+    });
+});
+
+describe('scaffoldDriftWorkflow', () => {
+    it('renders region and role ARN into valid workflow YAML', () => {
+        const dir = makeTmp();
+        const result = scaffoldDriftWorkflow(dir, { region: 'eu-west-1', roleArn: 'arn:aws:iam::1:role/x' });
+        expect(result.ok).toBe(true);
+        const content = fs.readFileSync(path.join(dir, '.github', 'workflows', 'drift.yml'), 'utf8');
+        expect(content).toContain('AWS_REGION: eu-west-1');
+        expect(content).toContain('role-to-assume: arn:aws:iam::1:role/x');
+        expect(content).not.toContain('{{REGION}}');
+        expect(content).not.toContain('{{ROLE_ARN}}');
+        const parsed = loadYaml(content);
+        expect(parsed.on.schedule).toEqual([{ cron: '0 6 * * *' }]);
+        expect(parsed.on).toHaveProperty('workflow_dispatch');
+        expect(parsed.permissions).toMatchObject({ 'id-token': 'write', contents: 'read', issues: 'write' });
+        const steps = parsed.jobs.drift.steps;
+        expect(steps.some((step) => step.uses === 'actions/github-script@v7')).toBe(true);
+        expect(steps.some((step) => step.with?.terraform_wrapper === false)).toBe(true);
+    });
+
+    it('refuses to overwrite without --force', () => {
+        const dir = makeTmp();
+        scaffoldDriftWorkflow(dir, { region: 'us-east-2', roleArn: 'arn:aws:iam::1:role/x' });
+        expect(scaffoldDriftWorkflow(dir, { region: 'us-east-2', roleArn: 'arn:aws:iam::1:role/y' }).reason).toBe('exists');
+        const forced = scaffoldDriftWorkflow(dir, { region: 'us-east-2', roleArn: 'arn:aws:iam::1:role/y', force: true });
+        expect(forced.ok).toBe(true);
+        expect(fs.readFileSync(path.join(dir, '.github', 'workflows', 'drift.yml'), 'utf8')).toContain('role/y');
+    });
+});
+
+describe('runDrift --setup', () => {
+    it('scaffolds from the deploy workflow role ARN', async () => {
+        const dir = makeTmp();
+        writeDeployYml(dir);
+        writeMainTf(dir);
+        const result = await runDrift({ cwd: dir, setup: true });
+        expect(result.ok).toBe(true);
+        expect(result.file).toBe(path.join('.github', 'workflows', 'drift.yml'));
+        expect(fs.existsSync(path.join(dir, '.github', 'workflows', 'drift.yml'))).toBe(true);
+        expect(trackEvent).toHaveBeenCalledWith('drift_run', expect.objectContaining({ action: 'setup', success: true }));
+        expect(exitSpy).not.toHaveBeenCalled();
+    });
+
+    it('soft-fails when the workflow exists without --force', async () => {
+        const dir = makeTmp();
+        writeDeployYml(dir);
+        writeMainTf(dir);
+        await runDrift({ cwd: dir, setup: true });
+        const second = await runDrift({ cwd: dir, setup: true });
+        expect(second).toMatchObject({ ok: false, reason: 'drift-workflow-exists' });
+        expect(exitSpy).not.toHaveBeenCalled();
+        const forced = await runDrift({ cwd: dir, setup: true, force: true });
+        expect(forced.ok).toBe(true);
+    });
+
+    it('fails without a deploy workflow or role ARN', async () => {
+        const missing = makeTmp();
+        writeMainTf(missing);
+        const noWorkflow = await runDrift({ cwd: missing, setup: true });
+        expect(noWorkflow.reason).toBe('workflow-not-found');
+
+        const noArn = makeTmp();
+        writeMainTf(noArn);
+        const workflows = path.join(noArn, '.github', 'workflows');
+        fs.mkdirSync(workflows, { recursive: true });
+        fs.writeFileSync(path.join(workflows, 'deploy.yml'), 'name: Deploy\n');
+        const result = await runDrift({ cwd: noArn, setup: true });
+        expect(result.reason).toBe('role-arn-not-found');
+    });
+});
+
+describe('runDrift check mode', () => {
+    function checkOptions(dir, planResult, initResult = { status: 0, stdout: '', stderr: '' }) {
+        return {
+            cwd: dir,
+            spawnSyncImpl: vi.fn((bin, args) => {
+                if (args[0] === 'init') return initResult;
+                return planResult;
+            }),
+        };
+    }
+
+    it('reports clean on exit code 0', async () => {
+        const dir = makeTmp();
+        writeMainTf(dir);
+        const result = await runDrift(checkOptions(dir, { status: 0, stdout: 'No changes.', stderr: '' }));
+        expect(result).toMatchObject({ ok: true, drift: false });
+        expect(trackEvent).toHaveBeenCalledWith('drift_run', expect.objectContaining({ action: 'check', drift: false, success: true }));
+        expect(exitSpy).not.toHaveBeenCalled();
+    });
+
+    it('reports DRIFT_DETECTED with exit code 2', async () => {
+        const dir = makeTmp();
+        writeMainTf(dir);
+        const result = await runDrift(checkOptions(dir, {
+            status: 2,
+            stdout: '# aws_lb.main will be updated\n  ~ x = 1\nPlan: 0 to add, 1 to change, 0 to destroy.',
+            stderr: '',
+        }));
+        expect(result).toMatchObject({ ok: false, reason: 'drift-detected' });
+        expect(exitSpy).toHaveBeenCalledWith(2);
+        const output = logSpy.mock.calls.map((call) => String(call[0])).join('\n');
+        expect(output).toContain('Infrastructure drift detected');
+        expect(output).toContain('Plan: 0 to add, 1 to change, 0 to destroy.');
+    });
+
+    it('fails on exit code 1 and on init failures', async () => {
+        const dir = makeTmp();
+        writeMainTf(dir);
+        const failed = await runDrift(checkOptions(dir, { status: 1, stdout: '', stderr: 'Error: boom' }));
+        expect(failed.reason).toBe('terraform-plan-failed');
+
+        const initFailed = await runDrift(checkOptions(dir, { status: 0, stdout: '', stderr: '' }, { status: 1, stdout: '', stderr: 'init no' }));
+        expect(initFailed.reason).toBe('terraform-init-failed');
+    });
+
+    it('guides when terraform is missing or the project is uninitialized', async () => {
+        const dir = makeTmp();
+        writeMainTf(dir);
+        const enoent = await runDrift({ cwd: dir, spawnSyncImpl: () => ({ error: { code: 'ENOENT' } }) });
+        expect(enoent.reason).toBe('terraform-not-installed');
+
+        const bare = makeTmp();
+        const uninit = await runDrift({ cwd: bare });
+        expect(uninit.reason).toBe('terraform-not-initialized');
+    });
+});

package/tests/ecs.test.js

@@ -0,0 +1,130 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import {
+    SESSION_MANAGER_PLUGIN_URL,
+    resolveContainer,
+    hasSessionManagerPlugin,
+    fetchActiveService,
+    pickRuntimeContainer,
+    printAwsCliGuidance,
+    printSessionManagerGuidance,
+    printNoTasksGuidance,
+} from '../src/utils/ecs.js';
+
+afterEach(() => {
+    vi.restoreAllMocks();
+    delete process.env.ECS_CONTAINER;
+});
+
+function capturedOutput(fn) {
+    const lines = [];
+    vi.spyOn(console, 'log').mockImplementation((...args) => {
+        lines.push(args.join(' '));
+    });
+    fn();
+    return lines.join('\n');
+}
+
+describe('ecs shared module', () => {
+    it('exposes the Session Manager plugin install URL', () => {
+        expect(SESSION_MANAGER_PLUGIN_URL).toContain('session-manager-working-with-install-plugin.html');
+    });
+
+    it('resolveContainer prefers explicit flags, then ECS_CONTAINER, then project default', () => {
+        expect(resolveContainer({ projectName: 'myapp' }, '/tmp')).toBe('myapp-container');
+        expect(resolveContainer({ projectName: 'myapp', container: '  web  ' }, '/tmp')).toBe('web');
+        expect(resolveContainer({ projectName: 'myapp', containerName: 'api' }, '/tmp')).toBe('api');
+        process.env.ECS_CONTAINER = 'from-env';
+        expect(resolveContainer({ projectName: 'myapp' }, '/tmp')).toBe('from-env');
+    });
+
+    it('hasSessionManagerPlugin reports ENOENT and spawn failures as missing', () => {
+        const enoent = new Error('not found');
+        enoent.code = 'ENOENT';
+        expect(hasSessionManagerPlugin({ spawnSyncImpl: () => { throw new Error('boom'); } })).toBe(false);
+        expect(hasSessionManagerPlugin({ spawnSyncImpl: () => ({ error: enoent }) })).toBe(false);
+        expect(hasSessionManagerPlugin({ spawnSyncImpl: () => ({}) })).toBe(true);
+    });
+
+    it('printAwsCliGuidance defaults to exec wording', () => {
+        const out = capturedOutput(() => printAwsCliGuidance());
+        expect(out).toContain('exec');
+        expect(out).toContain('to open a shell in your container.');
+        expect(out).toContain(SESSION_MANAGER_PLUGIN_URL);
+    });
+
+    it('printAwsCliGuidance accepts per-command wording', () => {
+        const out = capturedOutput(() => printAwsCliGuidance({
+            commandName: 'db connect',
+            purpose: 'to open a secure tunnel to your database',
+        }));
+        expect(out).toContain('db connect');
+        expect(out).toContain('to open a secure tunnel to your database.');
+    });
+
+    it('printSessionManagerGuidance defaults to exec wording', () => {
+        const out = capturedOutput(() => printSessionManagerGuidance());
+        expect(out).toContain('exec');
+        expect(out).toContain('to securely tunnel into your container.');
+    });
+
+    it('printSessionManagerGuidance accepts per-command wording', () => {
+        const out = capturedOutput(() => printSessionManagerGuidance({
+            commandName: 'db connect',
+            purpose: 'to securely tunnel to your database',
+        }));
+        expect(out).toContain('db connect');
+        expect(out).toContain('to securely tunnel to your database.');
+    });
+
+    it('printNoTasksGuidance names the service, cluster, and reason', () => {
+        const out = capturedOutput(() => printNoTasksGuidance('svc', 'clu'));
+        expect(out).toContain('svc');
+        expect(out).toContain('clu');
+        expect(out).toContain('to open an interactive shell.');
+        const dbOut = capturedOutput(() => printNoTasksGuidance('svc', 'clu', 'to act as a jump host for the tunnel'));
+        expect(dbOut).toContain('to act as a jump host for the tunnel.');
+    });
+
+    it('fetchActiveService returns the service only when ACTIVE', async () => {
+        const active = { serviceName: 's', status: 'ACTIVE' };
+        const seen = [];
+        const client = {
+            send: vi.fn((cmd) => {
+                seen.push(cmd.input);
+                return Promise.resolve({ services: [active] });
+            }),
+        };
+        await expect(fetchActiveService(client, 'c', 's')).resolves.toBe(active);
+        expect(seen[0]).toEqual({ cluster: 'c', services: ['s'] });
+
+        const inactive = { send: vi.fn(() => Promise.resolve({ services: [{ status: 'INACTIVE' }] })) };
+        await expect(fetchActiveService(inactive, 'c', 's')).resolves.toBeNull();
+        const missing = { send: vi.fn(() => Promise.resolve({ services: [] })) };
+        await expect(fetchActiveService(missing, 'c', 's')).resolves.toBeNull();
+    });
+
+    it('pickRuntimeContainer prefers the expected name, then RUNNING, then first', () => {
+        const task = {
+            containers: [
+                { name: 'redis', lastStatus: 'RUNNING', runtimeId: 'rt-redis' },
+                { name: 'myapp-container', lastStatus: 'RUNNING', runtimeId: 'rt-app' },
+            ],
+        };
+        expect(pickRuntimeContainer(task, 'myapp-container').runtimeId).toBe('rt-app');
+        expect(pickRuntimeContainer(task, 'missing').runtimeId).toBe('rt-redis');
+        expect(pickRuntimeContainer({ containers: [{ name: 'only' }] }, 'missing').name).toBe('only');
+        expect(pickRuntimeContainer({ containers: [] }, 'missing')).toBeNull();
+    });
+
+    it('pickRuntimeContainer also reads task-definition containerDefinitions', () => {
+        const taskDef = { containerDefinitions: [{ name: 'a' }, { name: 'b' }] };
+        expect(pickRuntimeContainer(taskDef, 'b').name).toBe('b');
+        expect(pickRuntimeContainer(taskDef, 'missing').name).toBe('a');
+        expect(pickRuntimeContainer({}, 'missing')).toBeNull();
+    });
+
+    it.each([null, undefined, 'string', 42, true, { port: 'string' }])('resolveContainer(%s) behaves like {}', (bad) => {
+        expect(resolveContainer(bad)).toBe(resolveContainer({}));
+        expect(resolveContainer(bad, 42)).toBe(resolveContainer({}));
+    });
+});

package/tests/eject.test.js

@@ -0,0 +1,65 @@
+import { describe, it, expect } from 'vitest';
+import { stripTerraformMetadata, stripGitignoreMetadata } from '../src/commands/eject.js';
+
+describe('eject metadata stripping', () => {
+    it('strips grada headers and tag blocks', () => {
+        const content = '# grada generated infrastructure\n'
+            + 'provider "aws" {\n'
+            + '  region = "us-east-2"\n\n'
+            + '  default_tags {\n'
+            + '    tags = {\n'
+            + '      ManagedBy = "grada"\n'
+            + '    }\n'
+            + '  }\n'
+            + '}\n';
+        const cleaned = stripTerraformMetadata(content);
+        expect(cleaned).not.toContain('grada generated infrastructure');
+        expect(cleaned).not.toContain('ManagedBy');
+        expect(cleaned).toContain('provider "aws"');
+        expect(cleaned).toContain('region = "us-east-2"');
+    });
+
+    it('strips legacy deploy-stack headers, tag blocks, and lambda suffixes', () => {
+        const content = '# deploy-stack generated infrastructure (Lambda target)\n'
+            + 'provider "aws" {\n'
+            + '  default_tags {\n'
+            + '    tags = {\n'
+            + '      ManagedBy = "deploy-stack"\n'
+            + '    }\n'
+            + '  }\n'
+            + '}\n';
+        const cleaned = stripTerraformMetadata(content);
+        expect(cleaned).not.toContain('deploy-stack');
+        expect(cleaned).not.toContain('Lambda target');
+        expect(cleaned).toContain('provider "aws"');
+    });
+
+    it.each([
+        ['grada', '# grada addon: storage:s3\n# Generated by `grada add storage:s3`. Do not edit by hand unless\n'],
+        ['legacy', '# deploy-stack addon: storage:s3\n# Generated by `deploy-stack add storage:s3`. Do not edit by hand unless\n'],
+    ])('strips %s addon headers but keeps billing docs', (_label, header) => {
+        const content = `${header}# you know what you are doing — re-running with --force overwrites this file.\n`
+            + '#\n# Billing: usage-billed.\n\nresource "aws_s3_bucket" "x" {}\n';
+        const cleaned = stripTerraformMetadata(content);
+        expect(cleaned).not.toContain('addon: storage:s3');
+        expect(cleaned).not.toContain('Generated by');
+        expect(cleaned).not.toContain('overwrites this file');
+        expect(cleaned).toContain('# Billing: usage-billed.');
+        expect(cleaned).toContain('resource "aws_s3_bucket" "x" {}');
+    });
+
+    it('strips both gitignore backup stanzas', () => {
+        const content = 'node_modules/\n\n# grada backups\n*.bak.*\n\n# deploy-stack backups\n*.bak.*\n';
+        const cleaned = stripGitignoreMetadata(content);
+        expect(cleaned).not.toContain('backups');
+        expect(cleaned).not.toContain('*.bak.*');
+        expect(cleaned).toContain('node_modules/');
+    });
+
+    it('leaves domain markers and user content untouched', () => {
+        const content = '# grada:domain-mode=route53\n# grada:zone-id=Z123\n'
+            + '# A user comment about grada add workflows.\n';
+        expect(stripTerraformMetadata(content)).toBe(content);
+        expect(stripGitignoreMetadata('dist/\n')).toBe('dist/\n');
+    });
+});