trae-coding-engine 0.1.0

package/templates/scripts/check-go-names.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+fail=0
+
+is_generated_or_frontend_path() {
+	local path="$1"
+	case "$path" in
+		web/*|*/web/*|\
+		.agents/*|*/.agents/*|\
+		.codex/*|*/.codex/*|\
+		*/thrift_gen/*|thrift_gen/*|\
+		*/third_party/*|third_party/*|\
+		*/vendor/*|vendor/*|\
+		*/node_modules/*|node_modules/*)
+			return 0
+			;;
+	esac
+	return 1
+}
+
+while IFS= read -r file; do
+	if is_generated_or_frontend_path "$file"; then
+		continue
+	fi
+
+	dir=$(dirname "$file")
+	base=$(basename "$dir")
+	if [[ "$base" == *"_"* || "$base" =~ [A-Z] ]]; then
+		printf 'Go directory name must not use snake_case or uppercase: %s\n' "$dir" >&2
+		fail=1
+	fi
+
+	pkg=$(awk '/^package[[:space:]]+/ { print $2; exit }' "$file")
+	if [[ -z "$pkg" ]]; then
+		continue
+	fi
+	if [[ ! "$pkg" =~ ^[a-z][a-z0-9]*(_test)?$ ]]; then
+		printf 'Go package name must be lowercase alnum, with optional _test suffix: %s: package %s\n' "$file" "$pkg" >&2
+		fail=1
+	fi
+	if [[ "$pkg" != "main" ]]; then
+		want="$base"
+		if [[ "$pkg" == *_test ]]; then
+			want="${base}_test"
+		fi
+		if [[ "$pkg" != "$want" ]]; then
+			printf 'Go package name must match directory name: %s: package %s, want %s\n' "$file" "$pkg" "$want" >&2
+			fail=1
+		fi
+	fi
+done < <(find . \
+	-path './.git' -prune -o \
+	-path './.agents' -prune -o \
+	-path './.codex' -prune -o \
+	-path './web' -prune -o \
+	-type f -name '*.go' -print | sed 's#^\./##' | sort)
+
+exit "$fail"

package/templates/scripts/check-iam-actions.py

@@ -0,0 +1,126 @@
+#!/usr/bin/env python3
+"""Check TOP Action synchronization between server.thrift and IAM registration."""
+
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from pathlib import Path
+
+
+IDL_METHOD_RE = re.compile(r"^\s*[\w.]+\s+([A-Z]\w*)\s*\(", re.MULTILINE)
+IAM_ACTION_RE = re.compile(r"^\s*-\s+Action:\s*([A-Za-z0-9_]+)\s*$")
+IAM_FIELD_RE = re.compile(r"^\s{6}([A-Za-z_][A-Za-z0-9_]*):\s*(.*?)\s*$")
+
+
+def read_text(path: Path) -> str:
+    try:
+        return path.read_text(encoding="utf-8")
+    except OSError as exc:
+        raise SystemExit(f"check-iam-actions: cannot read {path}: {exc}") from exc
+
+
+def thrift_methods(path: Path) -> set[str]:
+    return set(IDL_METHOD_RE.findall(read_text(path)))
+
+
+def iam_actions(path: Path, ignored_path_prefixes: tuple[str, ...]) -> dict[str, str]:
+    actions: dict[str, str] = {}
+    current_action: str | None = None
+    current_path = ""
+
+    def flush() -> None:
+        nonlocal current_action, current_path
+        if current_action is None:
+            return
+        if not ignored_iam_path(current_path, ignored_path_prefixes):
+            actions[current_action] = current_path
+        current_action = None
+        current_path = ""
+
+    for line in read_text(path).splitlines():
+        action_match = IAM_ACTION_RE.match(line)
+        if action_match:
+            flush()
+            current_action = action_match.group(1)
+            continue
+
+        if current_action is None:
+            continue
+
+        field_match = IAM_FIELD_RE.match(line)
+        if not field_match:
+            continue
+        key, value = field_match.groups()
+        if key == "Path":
+            current_path = unquote(value)
+
+    flush()
+    return actions
+
+
+def unquote(value: str) -> str:
+    value = value.strip()
+    if len(value) >= 2 and value[0] == value[-1] and value[0] in {'"', "'"}:
+        return value[1:-1]
+    return value
+
+
+def ignored_iam_path(path: str, prefixes: tuple[str, ...]) -> bool:
+    return any(path == prefix or path.startswith(prefix + "/") for prefix in prefixes)
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(
+        description="Check that IDL TOP methods and IAM Actions are synchronized."
+    )
+    parser.add_argument("--idl", type=Path, default=Path("api/idl/server.thrift"))
+    parser.add_argument(
+        "--iam",
+        type=Path,
+        default=Path("deployments/coding-engine/templates/server/iam-register-codingserver.yaml"),
+    )
+    parser.add_argument(
+        "--ignore-iam-path-prefix",
+        action="append",
+        default=["/v1/agents"],
+        help="Ignore IAM Actions whose Path equals or starts with this prefix.",
+    )
+    args = parser.parse_args()
+
+    idl_action_names = thrift_methods(args.idl)
+    iam_action_paths = iam_actions(args.iam, tuple(args.ignore_iam_path_prefix))
+    iam_action_names = set(iam_action_paths)
+
+    missing_iam = sorted(idl_action_names - iam_action_names)
+    stale_iam = sorted(iam_action_names - idl_action_names)
+
+    if not missing_iam and not stale_iam:
+        print(
+            f"[OK] IAM Actions match IDL methods "
+            f"({len(idl_action_names)} IDL, {len(iam_action_names)} IAM after filters)"
+        )
+        return 0
+
+    if missing_iam:
+        print("IDL methods missing from IAM registration:", file=sys.stderr)
+        for action in missing_iam:
+            print(f"  - {action}", file=sys.stderr)
+
+    if stale_iam:
+        print("IAM Actions not present in IDL methods:", file=sys.stderr)
+        for action in stale_iam:
+            print(f"  - {action} (Path: {iam_action_paths[action] or '<empty>'})", file=sys.stderr)
+
+    print(
+        "Hint: update api/idl/server.thrift and "
+        "deployments/coding-engine/templates/server/iam-register-codingserver.yaml together. "
+        "IAM Actions with Path under /v1/agents are treated as REST exceptions.",
+        file=sys.stderr,
+    )
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/templates/scripts/check-migration-sql-immutability.sh

@@ -0,0 +1,232 @@
+#!/usr/bin/env bash
+# Guard source migration SQL history: committed migration files are append-only.
+
+set -euo pipefail
+
+BASE="${SQL_IMMUTABILITY_BASE:-origin/release}"
+MIGRATION_DIALECT_RE='(mysql|postgres|dm)'
+VERSIONED_MIGRATION_SQL_RE="^migration/${MIGRATION_DIALECT_RE}/(up|down)/v[0-9]+[.][0-9]+[.][0-9]+/[0-9]{3}[.]sql$"
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --base)
+      [ "$#" -ge 2 ] || { echo "usage: $0 [--base <git-ref>]" >&2; exit 2; }
+      BASE="$2"
+      shift 2
+      ;;
+    --base=*)
+      BASE="${1#--base=}"
+      shift
+      ;;
+    -h|--help)
+      echo "usage: $0 [--base <git-ref>]"
+      echo
+      echo "Base must be a git ref resolvable in this worktree, for example origin/release."
+      echo "SQL_IMMUTABILITY_BASE provides the same value when --base is omitted."
+      echo "Set SQL_IMMUTABILITY_REQUIRE_CLEAN=1 to fail when migration/*.sql has local changes."
+      echo "Default base is origin/release; use --base or SQL_IMMUTABILITY_BASE for other MR targets."
+      echo "The repository must have enough source and target branch history to compute merge-base."
+      exit 0
+      ;;
+    *)
+      echo "unknown argument: $1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  echo "check migration SQL immutability: not inside a git worktree" >&2
+  exit 2
+fi
+
+if ! BASE_COMMIT="$(git rev-parse --verify -q "${BASE}^{commit}")"; then
+  cat >&2 <<EOF
+check migration SQL immutability: base ref ${BASE} is not available.
+Fetch the target branch first, for example:
+  git fetch --filter=blob:none origin release:refs/remotes/origin/release
+Or pass an available target ref explicitly:
+  $0 --base <git-ref>
+EOF
+  exit 2
+fi
+
+if ! MERGE_BASE="$(git merge-base "$BASE_COMMIT" HEAD)"; then
+  cat >&2 <<EOF
+check migration SQL immutability: cannot compute merge-base with ${BASE}.
+Fetch source and target branch history first, for example:
+  git fetch --filter=blob:none origin release:refs/remotes/origin/release
+For shallow clones, fetch enough history for both source and target branches.
+EOF
+  exit 2
+fi
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT INT TERM
+
+violations="$WORK/violations"
+invalid="$WORK/invalid"
+additions="$WORK/additions"
+dirty="$WORK/dirty"
+: >"$violations"
+: >"$invalid"
+: >"$additions"
+: >"$dirty"
+
+is_versioned_migration_sql() {
+  printf '%s\n' "$1" | grep -Eq "$VERSIONED_MIGRATION_SQL_RE" || return 1
+}
+
+status_porcelain="$WORK/status-porcelain"
+if ! git status --porcelain --untracked-files=all -- migration >"$status_porcelain"; then
+  echo "check migration SQL immutability: git status failed for migration/" >&2
+  exit 2
+fi
+awk -v re="${VERSIONED_MIGRATION_SQL_RE#^}" '$0 ~ re || $0 ~ re " -> " { print }' "$status_porcelain" >"$dirty"
+
+if [ -s "$dirty" ]; then
+  if [ "${SQL_IMMUTABILITY_REQUIRE_CLEAN:-}" = "1" ]; then
+    cat >&2 <<'EOF'
+Migration SQL working tree must be clean before running this guard in strict mode.
+Commit or discard local migration/*.sql changes first; this check validates the
+committed branch diff against the target branch and does not require unrelated
+working tree files to be clean.
+
+Dirty migration SQL changes:
+EOF
+    sed 's/^/  /' "$dirty" >&2
+    exit 2
+  fi
+
+  cat >&2 <<'EOF'
+warning: local migration SQL changes are not included in the committed branch
+immutability check. CI runs this guard in strict mode.
+
+Dirty migration SQL changes:
+EOF
+  sed 's/^/  /' "$dirty" >&2
+fi
+
+diff_status_z="$WORK/diff-status-z"
+if ! git diff -M --name-status -z --diff-filter=DMRT "$MERGE_BASE"...HEAD >"$diff_status_z"; then
+  cat >&2 <<EOF
+check migration SQL immutability: git diff failed against base ${BASE}.
+This may happen with bad revisions or partial/shallow clones missing objects.
+Fetch enough history/objects for both source and target branches and retry.
+EOF
+  exit 2
+fi
+
+while IFS= read -r -d '' status; do
+  kind="${status:0:1}"
+  case "$kind" in
+    M|D|T)
+      IFS= read -r -d '' path
+      if is_versioned_migration_sql "$path"; then
+        printf '%s\t%s\n' "$kind" "$path" >>"$violations"
+      fi
+      ;;
+    R)
+      IFS= read -r -d '' old_path
+      IFS= read -r -d '' new_path
+      if is_versioned_migration_sql "$old_path"; then
+        printf '%s\t%s -> %s\n' "$kind" "$old_path" "$new_path" >>"$violations"
+      fi
+      if ! is_versioned_migration_sql "$new_path" \
+          && [ "${new_path#migration/}" != "$new_path" ] \
+          && [ "${old_path#migration/}" = "$old_path" ] \
+          && printf '%s' "$new_path" | grep -Eq '[.]sql$'; then
+        printf '%s\t%s -> %s (renaming an external .sql into migration/ is not allowed; add new migrations only as versioned up/down/vX.Y.Z/NNN.sql paths)\n' "$kind" "$old_path" "$new_path" >>"$violations"
+      fi
+      if is_versioned_migration_sql "$new_path" && ! is_versioned_migration_sql "$old_path"; then
+        printf '%s\t%s -> %s (rename into migration is not allowed; versioned migrations must be added as new files)\n' "$kind" "$old_path" "$new_path" >>"$violations"
+      fi
+      ;;
+    *)
+      IFS= read -r -d '' _unused || true
+      ;;
+  esac
+done <"$diff_status_z"
+
+if [ -s "$violations" ]; then
+  cat >&2 <<'EOF'
+Existing source migration SQL files are immutable, including comment-only changes.
+Do not modify, delete, or rename SQL files that already exist on the target branch.
+For the same release version, append the next NNN.sql file. For a new version,
+create a new vX.Y.Z directory and start at 001.sql.
+
+Rejected changes:
+EOF
+  sed 's/^/  /' "$violations" >&2
+  exit 1
+fi
+
+git diff -M --name-only --diff-filter=A "$MERGE_BASE"...HEAD -- migration \
+  | awk '/[.]sql$/ { print }' >"$additions"
+
+if [ ! -s "$additions" ]; then
+  exit 0
+fi
+
+while IFS= read -r path; do
+  case "$path" in
+    migration/mysql/up/v*/*.sql|migration/mysql/down/v*/*.sql|migration/postgres/up/v*/*.sql|migration/postgres/down/v*/*.sql|migration/dm/up/v*/*.sql|migration/dm/down/v*/*.sql)
+      file="${path##*/}"
+      version="${path%/*}"
+      version="${version##*/}"
+      if ! printf '%s\n' "$version" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
+        printf '%s: version directory must be vX.Y.Z\n' "$path" >>"$invalid"
+      fi
+      if ! printf '%s\n' "$file" | grep -Eq '^[0-9]{3}[.]sql$'; then
+        printf '%s: migration filename must be a three-digit NNN.sql sequence\n' "$path" >>"$invalid"
+      fi
+      ;;
+    *)
+      printf '%s: migration SQL must live under migration/{mysql,postgres,dm}/{up,down}/vX.Y.Z/NNN.sql; dialect directory names are lowercase\n' "$path" >>"$invalid"
+      ;;
+  esac
+done <"$additions"
+
+if [ -s "$invalid" ]; then
+  cat >&2 <<'EOF'
+New source migration SQL files must use versioned NNN.sql paths:
+EOF
+  sed 's/^/  /' "$invalid" >&2
+  exit 1
+fi
+
+awk -F/ '{ print $1 "/" $2 "/" $3 "/" $4 }' "$additions" | sort -u >"$WORK/dirs"
+
+while IFS= read -r dir; do
+  base_max="$(
+    git ls-tree -r --name-only "$BASE_COMMIT" -- "$dir" \
+      | awk -F/ '
+          /[0-9][0-9][0-9][.]sql$/ {
+            n = $NF
+            sub(/[.]sql$/, "", n)
+            if ((n + 0) > max) max = n + 0
+          }
+          END { print max + 0 }
+        '
+  )"
+  expected=$((base_max + 1))
+  while IFS= read -r num; do
+    actual=$((10#$num))
+    if [ "$actual" -ne "$expected" ]; then
+      printf '%s/%03d.sql: expected next migration file, found %03d.sql\n' "$dir" "$expected" "$actual" >>"$invalid"
+      expected=$((actual + 1))
+      continue
+    fi
+    expected=$((expected + 1))
+  done < <(awk -F/ -v dir="$dir" '$0 ~ "^" dir "/" { print $NF }' "$additions" | sed 's/[.]sql$//' | sort -n)
+done <"$WORK/dirs"
+
+if [ -s "$invalid" ]; then
+  cat >&2 <<'EOF'
+New migration SQL files must be appended in sequence.
+For an existing version directory, use the next NNN.sql after the target branch.
+For a new version directory, start at 001.sql and keep new files contiguous.
+EOF
+  sed 's/^/  /' "$invalid" >&2
+  exit 1
+fi

package/templates/scripts/check-mr-desc.sh

@@ -0,0 +1,165 @@
+#!/usr/bin/env bash
+# Hard guardrail: block MRs whose description is missing, left as the raw
+# template, or whose 变更说明 section contains only placeholder comments.
+#
+# Pairs with scripts/open-mr.sh (producer-side apply helper); this is
+# the receiver-side gate, invoked from .gitlab-ci.yml on every MR pipeline.
+#
+# Description source, checked in order:
+#   1. --description-file <path>           ('-' reads STDIN)
+#   2. GitLab API fetch (MR_LINT_TOKEN + CI_MERGE_REQUEST_IID set; CI-only)
+#   3. CI_MERGE_REQUEST_DESCRIPTION env var (GitLab built-in; ~2700-char trunc)
+#
+# Exit codes:
+#   0  description is acceptable
+#   1  description fails one or more checks -- MR should be blocked
+#   2  bad usage / missing dependency / not running on an MR
+#
+# Local usage:
+#   scripts/check-mr-desc.sh --description-file /tmp/desc.md
+#   echo "..." | scripts/check-mr-desc.sh --description-file -
+
+set -euo pipefail
+cd "$(dirname "$0")/.."
+
+# shellcheck source=scripts/lib/cli-args.sh
+. scripts/lib/cli-args.sh
+
+TEMPLATE_DIR=".gitlab/merge_request_templates"
+MIN_BODY_CHARS=20
+
+DESC_FILE=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --description-file)
+      DESC_FILE=$(require_value --description-file "${2:-}"); shift 2 ;;
+    --description-file=*)
+      DESC_FILE="${1#--description-file=}"; shift ;;
+    -h|--help)
+      sed -n '2,21p' "$0"; exit 0 ;;
+    *) echo "unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+description=""
+source_label=""
+
+if [ -n "$DESC_FILE" ]; then
+  if [ "$DESC_FILE" = "-" ]; then
+    description=$(cat)
+    source_label="stdin"
+  else
+    [ -f "$DESC_FILE" ] || { echo "error: file not found: $DESC_FILE" >&2; exit 2; }
+    description=$(cat "$DESC_FILE")
+    source_label="file:$DESC_FILE"
+  fi
+elif [ -n "${MR_LINT_TOKEN:-}" ] && [ -n "${CI_MERGE_REQUEST_IID:-}" ]; then
+  # CI-only path: bytedcli isn't on the alpine runner. curl+jq are installed
+  # by .gitlab-ci.yml's before_script only when MR_LINT_TOKEN is set.
+  api_base="${CI_API_V4_URL:-https://code.byted.org/api/v4}"
+  project_id="${CI_MERGE_REQUEST_PROJECT_ID:-${CI_PROJECT_ID:-}}"
+  if [ -z "$project_id" ]; then
+    echo "error: MR_LINT_TOKEN set but no CI_MERGE_REQUEST_PROJECT_ID/CI_PROJECT_ID" >&2
+    exit 2
+  fi
+  command -v curl >/dev/null || { echo "missing curl" >&2; exit 2; }
+  command -v jq >/dev/null || { echo "missing jq" >&2; exit 2; }
+  api_url="${api_base}/projects/${project_id}/merge_requests/${CI_MERGE_REQUEST_IID}"
+  resp=$(curl -fsS --max-time 20 \
+    --header "PRIVATE-TOKEN: ${MR_LINT_TOKEN}" \
+    "$api_url") || {
+      echo "error: failed to fetch MR via API: $api_url" >&2
+      exit 2
+    }
+  # `jq -e` exits 1 on null/empty -- catches API shape drift before it
+  # manifests downstream as a misleading "description is empty" verdict.
+  description=$(jq -er '.description // empty' <<<"$resp") || {
+    echo "error: MR API response had no .description field" >&2
+    exit 2
+  }
+  source_label="api:!${CI_MERGE_REQUEST_IID}"
+elif [ -n "${CI_MERGE_REQUEST_DESCRIPTION:-}" ]; then
+  description="$CI_MERGE_REQUEST_DESCRIPTION"
+  source_label="env:CI_MERGE_REQUEST_DESCRIPTION (may be truncated)"
+elif [ -n "${CI_MERGE_REQUEST_IID:-}" ]; then
+  echo "error: running on an MR pipeline but no description source available." >&2
+  echo "       set CI_MERGE_REQUEST_DESCRIPTION, or provide MR_LINT_TOKEN for API fetch." >&2
+  exit 2
+else
+  echo "error: not running on an MR pipeline and no --description-file given." >&2
+  echo "       see --help for local usage." >&2
+  exit 2
+fi
+
+# Used for template-equality comparison only.
+normalize() {
+  tr -d '\r' \
+    | sed -E 's/[[:space:]]+/ /g' \
+    | sed -E 's/^ +//; s/ +$//'
+}
+
+desc_norm=$(printf '%s' "$description" | normalize)
+
+failures=()
+
+if [ -z "$desc_norm" ]; then
+  failures+=("description is empty")
+fi
+
+if [ -d "$TEMPLATE_DIR" ]; then
+  for tpl in "$TEMPLATE_DIR"/*.md; do
+    [ -f "$tpl" ] || continue
+    tpl_norm=$(normalize <"$tpl")
+    if [ -n "$tpl_norm" ] && [ "$desc_norm" = "$tpl_norm" ]; then
+      failures+=("description is unchanged from template: ${tpl}")
+      break
+    fi
+  done
+fi
+
+# When 变更说明 header is present, only its section counts as prose; otherwise
+# fall back to checking the whole document. Either way the strip+count pipeline
+# below runs exactly once.
+if grep -q '^## 变更说明' <<<"$description"; then
+  section_body=$(awk '
+    /^## 变更说明[[:space:]]*$/  { capture=1; next }
+    capture && /^---[[:space:]]*$/ { exit }
+    capture && /^## /             { exit }
+    capture                       { print }
+  ' <<<"$description")
+else
+  section_body="$description"
+fi
+
+# One pass: strip multi-line HTML comments, drop the `**类型:**` metadata line.
+body_clean=$(perl -0777 -pe 's/<!--.*?-->//gs; s/^\*\*类型:\*\*.*\n?//mg' <<<"$section_body")
+body_chars=$(printf '%s' "$body_clean" | tr -d '[:space:]' | wc -c | tr -d ' ')
+
+if [ "${body_chars:-0}" -lt "$MIN_BODY_CHARS" ]; then
+  failures+=("变更说明 section has <${MIN_BODY_CHARS} chars of real content (got ${body_chars:-0}); only placeholder comments?")
+fi
+
+printf "  source:      %s\n" "$source_label"
+printf "  chars:       %d (raw)\n" "$(printf '%s' "$description" | wc -c | tr -d ' ')"
+printf "  body chars:  %d (变更说明, after stripping comments)\n" "${body_chars:-0}"
+
+if [ "${#failures[@]}" -eq 0 ]; then
+  echo "  [OK]  MR description passes lint"
+  exit 0
+fi
+
+{
+  echo
+  echo "  [BLOCK] MR description failed ${#failures[@]} check(s):"
+  for f in "${failures[@]}"; do
+    echo "    - $f"
+  done
+  echo
+  echo "  How to fix:"
+  echo "    1. Open the MR and edit Description in the GitLab UI, or"
+  echo "    2. Draft desc.md from the actual branch diff and apply it with \`make open-mr ARGS=\"--body-file desc.md\"\`."
+  echo "    3. Iterate locally: \`make check-mr-desc FILE=desc.md\` (or pipe via --description-file -)."
+  echo
+  echo "  Template lives at: ${TEMPLATE_DIR}/Default.md"
+} >&2
+exit 1