npm - mandrel-platform - Versions diffs - 0.20.0 → 0.21.0 - Mend

mandrel-platform 0.20.0 → 0.21.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (14) hide show

package/package.json +1 -1
package/scripts/check-ci-required-aggregator.test.mjs +227 -0
package/scripts/check-coverage-threshold.test.mjs +56 -51
package/scripts/check-destructive-migration.mjs +68 -6
package/scripts/check-destructive-migration.test.mjs +146 -0
package/scripts/deploy-boot-smoke.mjs +364 -0
package/scripts/deploy-boot-smoke.test.mjs +381 -0
package/scripts/deploy-worker-secrets.mjs +190 -0
package/scripts/deploy-worker-secrets.test.mjs +136 -0
package/templates/runbooks/README.md +13 -0
package/templates/runbooks/runner-provisioning.md +187 -0
package/templates/runner/.env.example +45 -0
package/templates/runner/job-cleanup.sh +97 -0
package/templates/workflows/deploy-staging.yml +11 -8

package/scripts/deploy-boot-smoke.test.mjs ADDED Viewed

@@ -0,0 +1,381 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import {
+  parseCsv,
+  parseSmokePaths,
+  extractSubdomain,
+  parseVersionField,
+  buildProbePlan,
+  uniqueSorted,
+  probeUrl,
+  runSmoke,
+  resolveFailedFile,
+} from "./deploy-boot-smoke.mjs";
+// ---------------------------------------------------------------------------
+// parseCsv / parseSmokePaths
+// ---------------------------------------------------------------------------
+test("parseCsv trims entries and drops empties", () => {
+  assert.deepEqual(parseCsv(" api , worker-cron ,, "), ["api", "worker-cron"]);
+  assert.deepEqual(parseCsv(""), []);
+  assert.deepEqual(parseCsv(undefined), []);
+});
+test("parseSmokePaths enforces a leading slash", () => {
+  assert.deepEqual(parseSmokePaths("/,/portal,api/health"), ["/", "/portal", "/api/health"]);
+  assert.deepEqual(parseSmokePaths("/health"), ["/health"]);
+});
+// ---------------------------------------------------------------------------
+// extractSubdomain
+// ---------------------------------------------------------------------------
+test("extractSubdomain finds the first workers.dev slug in whoami output", () => {
+  const whoami = [
+    "Getting User settings...",
+    "👋 You are logged in!",
+    "┌──────────────┬──────────────────────────┐",
+    "│ Account Name │ dsj1984's Account        │",
+    "│ Subdomain    │ dsj1984.workers.dev      │",
+    "└──────────────┴──────────────────────────┘",
+  ].join("\n");
+  assert.equal(extractSubdomain(whoami), "dsj1984");
+});
+test("extractSubdomain returns null when no slug is present", () => {
+  assert.equal(extractSubdomain("no subdomain here"), null);
+  assert.equal(extractSubdomain(""), null);
+});
+// ---------------------------------------------------------------------------
+// parseVersionField — the jq/JSON.parse replacement for grep-for-"version"
+// ---------------------------------------------------------------------------
+test("parseVersionField reads the top-level version string", () => {
+  assert.equal(parseVersionField('{"status":"ok","version":"abc123"}'), "abc123");
+});
+test("parseVersionField rejects non-JSON, non-object, and missing/empty fields", () => {
+  assert.equal(parseVersionField("<html>hi</html>"), null);
+  assert.equal(parseVersionField('"version"'), null);
+  assert.equal(parseVersionField('["version"]'), null);
+  assert.equal(parseVersionField("null"), null);
+  assert.equal(parseVersionField('{"status":"ok"}'), null);
+  assert.equal(parseVersionField('{"version":""}'), null);
+  assert.equal(parseVersionField('{"version":42}'), null);
+});
+test("parseVersionField never matches a nested version key (grep-era false positive)", () => {
+  // The old grep/sed extraction would have matched deps.version here.
+  assert.equal(parseVersionField('{"status":"ok","deps":{"version":"9.9.9"}}'), null);
+});
+// ---------------------------------------------------------------------------
+// buildProbePlan — the smoke_base_url duplication fix
+// ---------------------------------------------------------------------------
+test("buildProbePlan with a shared base URL probes each path exactly once, attributing all workers", () => {
+  const plan = buildProbePlan({
+    workers: ["api", "worker-cron"],
+    paths: ["/", "/health"],
+    smokeBaseUrl: "https://godomio.com/",
+    subdomain: "",
+  });
+  assert.equal(plan.length, 2); // one per PATH, not workers × paths
+  assert.deepEqual(
+    plan.map((e) => e.url),
+    ["https://godomio.com/", "https://godomio.com/health"]
+  );
+  for (const entry of plan) {
+    assert.deepEqual(entry.attributedWorkers, ["api", "worker-cron"]);
+  }
+});
+test("buildProbePlan without a base URL probes workers × paths on workers.dev, attributing per worker", () => {
+  const plan = buildProbePlan({
+    workers: ["api", "worker-cron"],
+    paths: ["/health"],
+    smokeBaseUrl: "",
+    subdomain: "dsj1984",
+  });
+  assert.deepEqual(
+    plan.map((e) => e.url),
+    [
+      "https://api.dsj1984.workers.dev/health",
+      "https://worker-cron.dsj1984.workers.dev/health",
+    ]
+  );
+  assert.deepEqual(plan[0].attributedWorkers, ["api"]);
+  assert.deepEqual(plan[1].attributedWorkers, ["worker-cron"]);
+});
+test("uniqueSorted de-duplicates and sorts (mirrors sort -u)", () => {
+  assert.deepEqual(uniqueSorted(["b", "a", "b"]), ["a", "b"]);
+});
+// ---------------------------------------------------------------------------
+// probeUrl — retry semantics
+// ---------------------------------------------------------------------------
+test("probeUrl returns the first non-transient response without retrying", async () => {
+  let calls = 0;
+  const fetchImpl = async () => {
+    calls++;
+    return { status: 200, text: async () => "ok" };
+  };
+  const res = await probeUrl("https://x.example/health", { fetchImpl, sleep: async () => {} });
+  assert.equal(res.status, 200);
+  assert.equal(res.body, "ok");
+  assert.equal(calls, 1);
+});
+test("probeUrl never follows redirects (curl-without--L parity: a 302 is a failure)", async () => {
+  let seenOptions;
+  const fetchImpl = async (url, options) => {
+    seenOptions = options;
+    return { status: 302, text: async () => "" };
+  };
+  const res = await probeUrl("https://x.example/health", { fetchImpl, sleep: async () => {} });
+  assert.equal(seenOptions.redirect, "manual");
+  assert.equal(res.status, 302); // surfaces as non-200 → smoke failure
+});
+test("probeUrl does not retry a non-200 non-transient status (e.g. 404)", async () => {
+  let calls = 0;
+  const fetchImpl = async () => {
+    calls++;
+    return { status: 404, text: async () => "nope" };
+  };
+  const res = await probeUrl("https://x.example/health", { fetchImpl, sleep: async () => {} });
+  assert.equal(res.status, 404);
+  assert.equal(calls, 1);
+});
+test("probeUrl retries transient statuses and network errors up to the retry budget", async () => {
+  let calls = 0;
+  const fetchImpl = async () => {
+    calls++;
+    if (calls === 1) throw new Error("ECONNRESET");
+    if (calls === 2) return { status: 503, text: async () => "" };
+    return { status: 200, text: async () => "ok" };
+  };
+  const res = await probeUrl("https://x.example/health", { fetchImpl, sleep: async () => {} });
+  assert.equal(res.status, 200);
+  assert.equal(calls, 3);
+});
+test("probeUrl reports status 0 when every attempt fails at the network layer", async () => {
+  let calls = 0;
+  const fetchImpl = async () => {
+    calls++;
+    throw new Error("timeout");
+  };
+  const res = await probeUrl("https://x.example/health", { fetchImpl, retries: 2, sleep: async () => {} });
+  assert.equal(res.status, 0);
+  assert.equal(calls, 3); // initial + 2 retries
+});
+// ---------------------------------------------------------------------------
+// runSmoke — end-to-end orchestration with injected deps
+// ---------------------------------------------------------------------------
+function collectLogs() {
+  const lines = [];
+  return { lines, log: (line) => lines.push(line) };
+}
+test("runSmoke passes when every probe returns 200", async () => {
+  const { log } = collectLogs();
+  const result = await runSmoke(
+    { DEPLOYED_WORKERS: "api,worker-cron", SMOKE_PATHS: "/health", WORKERS_DEV_SUBDOMAIN: "dsj1984" },
+    { log, probe: async () => ({ status: 200, body: "{}" }) }
+  );
+  assert.equal(result.exitCode, 0);
+  assert.deepEqual(result.failedWorkers, []);
+});
+test("runSmoke attributes a workers.dev probe failure to that worker only", async () => {
+  const { log } = collectLogs();
+  const result = await runSmoke(
+    { DEPLOYED_WORKERS: "api,worker-cron", SMOKE_PATHS: "/health", WORKERS_DEV_SUBDOMAIN: "dsj1984" },
+    {
+      log,
+      probe: async (url) =>
+        url.startsWith("https://api.") ? { status: 500, body: "" } : { status: 200, body: "{}" },
+    }
+  );
+  assert.equal(result.exitCode, 1);
+  assert.deepEqual(result.failedWorkers, ["api"]);
+});
+test("runSmoke with a shared base URL probes each path once and rolls back ALL deployed workers on failure", async () => {
+  const { log } = collectLogs();
+  const probed = [];
+  const result = await runSmoke(
+    {
+      DEPLOYED_WORKERS: "api,worker-cron",
+      SMOKE_PATHS: "/,/health",
+      SMOKE_BASE_URL: "https://godomio.com",
+    },
+    {
+      log,
+      probe: async (url) => {
+        probed.push(url);
+        return url.endsWith("/health") ? { status: 502, body: "" } : { status: 200, body: "{}" };
+      },
+    }
+  );
+  // Each path requested exactly once — not once per worker.
+  assert.deepEqual(probed, ["https://godomio.com/", "https://godomio.com/health"]);
+  assert.equal(result.exitCode, 1);
+  // Shared-host failure → explicit rollback of everything deployed.
+  assert.deepEqual(result.failedWorkers, ["api", "worker-cron"]);
+});
+test("runSmoke verify-commit-sha passes on a matching top-level version", async () => {
+  const { log } = collectLogs();
+  const result = await runSmoke(
+    {
+      DEPLOYED_WORKERS: "api",
+      SMOKE_PATHS: "/health",
+      WORKERS_DEV_SUBDOMAIN: "dsj1984",
+      VERIFY_COMMIT_SHA: "true",
+      EXPECTED_SHA: "deadbeef",
+    },
+    { log, probe: async () => ({ status: 200, body: '{"status":"ok","version":"deadbeef"}' }) }
+  );
+  assert.equal(result.exitCode, 0);
+});
+test("runSmoke verify-commit-sha fails on mismatch and on unparsable version", async () => {
+  const { log } = collectLogs();
+  const mismatch = await runSmoke(
+    {
+      DEPLOYED_WORKERS: "api",
+      SMOKE_PATHS: "/health",
+      WORKERS_DEV_SUBDOMAIN: "dsj1984",
+      VERIFY_COMMIT_SHA: "true",
+      EXPECTED_SHA: "deadbeef",
+    },
+    { log, probe: async () => ({ status: 200, body: '{"version":"cafef00d"}' }) }
+  );
+  assert.equal(mismatch.exitCode, 1);
+  assert.deepEqual(mismatch.failedWorkers, ["api"]);
+  const unparsable = await runSmoke(
+    {
+      DEPLOYED_WORKERS: "api",
+      SMOKE_PATHS: "/health",
+      WORKERS_DEV_SUBDOMAIN: "dsj1984",
+      VERIFY_COMMIT_SHA: "true",
+      EXPECTED_SHA: "deadbeef",
+    },
+    { log, probe: async () => ({ status: 200, body: "<html>ok</html>" }) }
+  );
+  assert.equal(unparsable.exitCode, 1);
+  assert.deepEqual(unparsable.failedWorkers, ["api"]);
+});
+test("runSmoke runs a consumer smoke-command with WORKERS + SMOKE_BASE_URL exported", async () => {
+  const { log } = collectLogs();
+  let seen;
+  const result = await runSmoke(
+    {
+      DEPLOYED_WORKERS: "api,worker-cron",
+      SMOKE_COMMAND: "./my-smoke.sh",
+      SMOKE_BASE_URL: "https://godomio.com",
+    },
+    {
+      log,
+      runShell: (cmd, env) => {
+        seen = { cmd, env };
+        return 0;
+      },
+    }
+  );
+  assert.equal(result.exitCode, 0);
+  assert.equal(seen.cmd, "./my-smoke.sh");
+  assert.equal(seen.env.WORKERS, "api,worker-cron");
+  assert.equal(seen.env.SMOKE_BASE_URL, "https://godomio.com");
+});
+test("runSmoke marks every deployed worker for rollback when the consumer smoke-command fails", async () => {
+  const { log } = collectLogs();
+  const result = await runSmoke(
+    { DEPLOYED_WORKERS: "b-worker,a-worker", SMOKE_COMMAND: "exit 1" },
+    { log, runShell: () => 1 }
+  );
+  assert.equal(result.exitCode, 1);
+  assert.deepEqual(result.failedWorkers, ["a-worker", "b-worker"]);
+});
+test("runSmoke fails without a rollback list when no subdomain is derivable", async () => {
+  const { log, lines } = collectLogs();
+  const result = await runSmoke(
+    { DEPLOYED_WORKERS: "api", SMOKE_PATHS: "/health" },
+    { log, whoami: () => "not logged in", probe: async () => ({ status: 200, body: "{}" }) }
+  );
+  assert.equal(result.exitCode, 1);
+  assert.deepEqual(result.failedWorkers, []);
+  assert.ok(lines.some((l) => l.includes("Could not derive workers.dev subdomain")));
+});
+test("runSmoke derives the subdomain from whoami output when not provided", async () => {
+  const { log } = collectLogs();
+  const probed = [];
+  const result = await runSmoke(
+    { DEPLOYED_WORKERS: "api", SMOKE_PATHS: "/health" },
+    {
+      log,
+      whoami: () => "│ Subdomain │ dsj1984.workers.dev │",
+      probe: async (url) => {
+        probed.push(url);
+        return { status: 200, body: "{}" };
+      },
+    }
+  );
+  assert.equal(result.exitCode, 0);
+  assert.deepEqual(probed, ["https://api.dsj1984.workers.dev/health"]);
+});
+// ---------------------------------------------------------------------------
+// resolveFailedFile — rollback-list path resolution (CWE-377 hardening)
+// ---------------------------------------------------------------------------
+test("resolveFailedFile honours an explicit SMOKE_FAILED_FILE verbatim (no mkdtemp)", () => {
+  let mkdtempCalls = 0;
+  const path = resolveFailedFile({ SMOKE_FAILED_FILE: "/tmp/smoke-failed-workers.txt" }, () => {
+    mkdtempCalls++;
+    return "/should/not/be/used";
+  });
+  assert.equal(path, "/tmp/smoke-failed-workers.txt");
+  assert.equal(mkdtempCalls, 0);
+});
+test("resolveFailedFile trims a whitespace-only SMOKE_FAILED_FILE and falls back to mkdtemp", () => {
+  const seen = [];
+  const path = resolveFailedFile({ SMOKE_FAILED_FILE: "   " }, (prefix) => {
+    seen.push(prefix);
+    return "/var/folders/xyz/deploy-boot-smoke-Abc123";
+  });
+  // Fell through to the private-temp-dir branch, not the predictable path.
+  assert.equal(seen.length, 1);
+  assert.equal(path, "/var/folders/xyz/deploy-boot-smoke-Abc123/smoke-failed-workers.txt");
+});
+test("resolveFailedFile creates a private temp dir when SMOKE_FAILED_FILE is unset", () => {
+  const seen = [];
+  const path = resolveFailedFile({}, (prefix) => {
+    seen.push(prefix);
+    return "/var/folders/xyz/deploy-boot-smoke-Zzz999";
+  });
+  // The mkdtemp prefix is scoped under the OS temp dir and carries our label,
+  // and the returned path lives INSIDE the freshly-created dir — never the
+  // fixed, world-writable /tmp/smoke-failed-workers.txt.
+  assert.equal(seen.length, 1);
+  assert.ok(seen[0].includes("deploy-boot-smoke-"), "mkdtemp prefix carries the script label");
+  assert.equal(path, "/var/folders/xyz/deploy-boot-smoke-Zzz999/smoke-failed-workers.txt");
+  assert.notEqual(path, "/tmp/smoke-failed-workers.txt");
+});

package/scripts/deploy-worker-secrets.mjs ADDED Viewed

@@ -0,0 +1,190 @@
+#!/usr/bin/env node
+/**
+ * deploy-worker-secrets.mjs
+ *
+ * In-pipeline worker-secrets provisioning for the shared
+ * `deploy-cloudflare.yml` workflow (Story #170; extracted from inline bash in
+ * Story #231). The workflow sparse-checks this script out of
+ * dsj1984/mandrel-platform at `github.job_workflow_sha` — the exact commit
+ * the caller's `deploy-cloudflare.yml@<ref>` pin resolved to — so the script
+ * version always travels in lockstep with the workflow pin (same model as
+ * `uptime-apply.yml` → `apply-uptime-monitors.mjs`).
+ *
+ * What it does (behaviour-identical to the inline predecessor): for each
+ * secret NAME the consumer enumerates in the `worker-secrets` input, resolve
+ * the value from the INHERITED secrets context (SECRETS_CONTEXT, the
+ * `toJSON(secrets)` payload) and write it onto every deployed worker via the
+ * VERSIONS secret API — `pnpm exec wrangler versions secret put`, which is
+ * immune to Cloudflare error 10215 even when a prior rollback left the
+ * Worker at active ≠ latest-uploaded — then promote the resulting version to
+ * 100% traffic (`wrangler versions deploy … -y`) so the just-written secrets
+ * are the ACTIVE version boot-smoke probes and any active/latest split
+ * self-heals.
+ *
+ * Secret hygiene: values are passed to wrangler over STDIN and are never
+ * echoed, interpolated into argv, or logged — only secret NAMES appear in
+ * output (GitHub additionally redacts inherited secret values in logs).
+ *
+ * Environment contract (all read from process.env):
+ *   DEPLOY_ENV        Cloudflare --env label (required)
+ *   DEPLOYED_WORKERS  csv of deployed worker names (required)
+ *   WORKER_SECRETS    newline-separated secret NAMES; blank lines and '#'
+ *                     comment lines ignored (required — the workflow step is
+ *                     skipped entirely when the input is empty)
+ *   SECRETS_CONTEXT   JSON object of the inherited secrets context (required)
+ *
+ * Exit codes:
+ *   0 — every named secret provisioned onto every deployed worker (or the
+ *       name list resolved to zero entries — notice printed, nothing to do).
+ *   1 — a named secret is absent/empty in the inherited context, a wrangler
+ *       invocation failed, or the environment contract is violated.
+ */
+import { execFileSync } from "node:child_process";
+// ---------------------------------------------------------------------------
+// Pure helpers (unit-tested)
+// ---------------------------------------------------------------------------
+/** Split a csv into trimmed, non-empty entries. */
+export function parseCsv(csv) {
+  return String(csv ?? "")
+    .split(",")
+    .map((s) => s.trim())
+    .filter(Boolean);
+}
+/**
+ * Parse the newline-separated worker-secrets NAME list: trim each line, skip
+ * blanks and leading-'#' comment lines (so a consumer can annotate the list).
+ */
+export function parseSecretNames(raw) {
+  return String(raw ?? "")
+    .split("\n")
+    .map((line) => line.trim())
+    .filter((line) => line !== "" && !line.startsWith("#"));
+}
+/**
+ * Resolve one secret value from the inherited secrets context JSON. Returns
+ * the non-empty string value, or null when the name is absent or empty.
+ */
+export function resolveSecretValue(secretsContext, name) {
+  const value = secretsContext?.[name];
+  return typeof value === "string" && value.length > 0 ? value : null;
+}
+// ---------------------------------------------------------------------------
+// Provisioning loop (deps injectable for the test suite)
+// ---------------------------------------------------------------------------
+/**
+ * Run the full provisioning pass. Returns an exit code and performs no
+ * process.exit of its own so the test suite can drive it directly.
+ */
+export function provisionWorkerSecrets(env, deps = {}) {
+  const {
+    log = (line) => process.stdout.write(`${line}\n`),
+    runWrangler = defaultRunWrangler,
+  } = deps;
+  const deployEnv = env.DEPLOY_ENV ?? "";
+  const workers = parseCsv(env.DEPLOYED_WORKERS);
+  const names = parseSecretNames(env.WORKER_SECRETS);
+  if (names.length === 0) {
+    log("::notice::worker-secrets was set but resolved to zero names — nothing to provision.");
+    return 0;
+  }
+  let secretsContext;
+  try {
+    secretsContext = JSON.parse(env.SECRETS_CONTEXT ?? "");
+  } catch {
+    log("::error::worker-secrets: SECRETS_CONTEXT is not valid JSON — cannot resolve secret values.");
+    return 1;
+  }
+  for (const worker of workers) {
+    for (const name of names) {
+      // A missing / empty inherited secret is a hard error — a
+      // deploy-critical secret the consumer explicitly listed must exist.
+      const value = resolveSecretValue(secretsContext, name);
+      if (value === null) {
+        log(
+          `::error::worker-secrets: '${name}' is not present (or empty) in the inherited secrets — forward it via 'secrets: inherit' before listing it in worker-secrets.`
+        );
+        return 1;
+      }
+      log(`::group::Provisioning ${name} onto ${worker} (versions secret API)`);
+      // `wrangler versions secret put` reads the value from stdin (same
+      // non-interactive path as `wrangler secret put`) and creates a NEW
+      // version WITHOUT deploying it. This write is immune to error 10215
+      // even when active ≠ latest-uploaded.
+      const putCode = runWrangler(
+        ["versions", "secret", "put", name, "--name", worker, "--env", deployEnv],
+        value
+      );
+      if (putCode !== 0) {
+        log(`::error::worker-secrets: 'wrangler versions secret put ${name}' failed for worker '${worker}'.`);
+        log("::endgroup::");
+        return 1;
+      }
+      log("::endgroup::");
+    }
+    log(`::group::Promoting latest version of ${worker} to 100% (self-heal active=latest)`);
+    // Deploy the latest-uploaded version (the one carrying the secrets just
+    // written) at 100% traffic, non-interactively. This both makes the
+    // current secret values the ACTIVE version boot-smoke probes and
+    // realigns active = latest so no residual 10215-inducing split remains.
+    // `-y` selects the non-interactive default (latest @ 100%).
+    const deployCode = runWrangler([
+      "versions",
+      "deploy",
+      "--name",
+      worker,
+      "--env",
+      deployEnv,
+      "--message",
+      "In-pipeline worker-secrets provisioning (Story #170)",
+      "-y",
+    ]);
+    if (deployCode !== 0) {
+      log(`::error::worker-secrets: 'wrangler versions deploy' failed for worker '${worker}'.`);
+      log("::endgroup::");
+      return 1;
+    }
+    log("::endgroup::");
+  }
+  return 0;
+}
+/**
+ * Spawn the consumer's lockfile-pinned wrangler (`pnpm exec wrangler …`,
+ * installed and preflighted by setup-toolchain's require-wrangler). When
+ * `stdinValue` is provided it is piped over stdin and never appears in argv.
+ */
+function defaultRunWrangler(args, stdinValue) {
+  try {
+    execFileSync("pnpm", ["exec", "wrangler", ...args], {
+      stdio: [stdinValue === undefined ? "ignore" : "pipe", "inherit", "inherit"],
+      input: stdinValue,
+    });
+    return 0;
+  } catch {
+    return 1;
+  }
+}
+// ---------------------------------------------------------------------------
+// CLI entry
+// ---------------------------------------------------------------------------
+const invokedDirectly =
+  process.argv[1] && process.argv[1].endsWith("deploy-worker-secrets.mjs");
+if (invokedDirectly) {
+  process.exit(provisionWorkerSecrets(process.env));
+}