pz-cli 5.0.0__py3-none-any.whl

pz_core/authoring/publish_git.py

@@ -0,0 +1,423 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+import os
+from pathlib import Path
+import subprocess
+
+from pz_core.runtime.errors import PzError
+
+from .publish_source import PublishSourceResolution, resolve_publish_source
+from .workspace import iter_workspace_packages_in_roots
+
+
+_OWNER = "pz_core.authoring.publish_git"
+
+
+@dataclass(frozen=True, slots=True)
+class PublishCommitResult:
+    source: PublishSourceResolution
+    version: str
+    commit: str
+    reused: bool
+
+
+@dataclass(frozen=True, slots=True)
+class PublishTagResult:
+    commit_result: PublishCommitResult
+    tag: str
+    reused: bool
+
+
+def _error(code: str, message: str, *, action: str, detail: str | None = None) -> PzError:
+    return PzError(
+        code=code,
+        message=message,
+        stage="cli",
+        owner=_OWNER,
+        action=action,
+        detail=detail,
+    )
+
+
+def _run_git(
+    source: PublishSourceResolution,
+    *args: str,
+    action: str,
+    check: bool = True,
+) -> subprocess.CompletedProcess[str]:
+    completed = subprocess.run(
+        ("git", "-C", str(source.git_root), *args),
+        check=False,
+        capture_output=True,
+        text=True,
+        stdin=subprocess.DEVNULL,
+        env={**os.environ, "GIT_TERMINAL_PROMPT": "0"},
+    )
+    if check and completed.returncode != 0:
+        detail = (completed.stderr or completed.stdout or "git command failed").strip()
+        raise _error(
+            "PZ_PUB_GIT_FAILED",
+            "Git 发布操作失败。",
+            action=action,
+            detail=detail[:500],
+        )
+    return completed
+
+
+def _output(source: PublishSourceResolution, *args: str, action: str) -> str:
+    return _run_git(source, *args, action=action).stdout.strip()
+
+
+def _relative_package_path(source: PublishSourceResolution) -> str:
+    relative = source.package_root.relative_to(source.git_root).as_posix()
+    return relative or "."
+
+
+def _name_set(source: PublishSourceResolution, *args: str, action: str) -> set[str]:
+    output = _run_git(source, *args, action=action).stdout
+    return {item for item in output.split("\0") if item}
+
+
+def _commit_paths(
+    source: PublishSourceResolution, commit: str, *, action: str
+) -> set[str]:
+    return _name_set(
+        source,
+        "diff-tree",
+        "--no-commit-id",
+        "--name-only",
+        "-r",
+        "-z",
+        commit,
+        action=action,
+    )
+
+
+def _changed_paths(source: PublishSourceResolution, *, action: str) -> set[str]:
+    return (
+        _name_set(source, "diff", "--name-only", "-z", action=action)
+        | _name_set(source, "ls-files", "--others", "--exclude-standard", "-z", action=action)
+    )
+
+
+def _package_relative_roots(source: PublishSourceResolution) -> tuple[Path, ...]:
+    roots: list[Path] = []
+    for package in iter_workspace_packages_in_roots((source.git_root,)):
+        package_root = package.repo.resolve()
+        if package_root == source.git_root and source.package_root != source.git_root:
+            continue
+        if package_root.is_relative_to(source.git_root):
+            roots.append(package_root.relative_to(source.git_root))
+    return tuple(roots)
+
+
+def _belongs_to(path: str, root: Path) -> bool:
+    candidate = Path(path)
+    return candidate == root or root in candidate.parents
+
+
+def _validate_repository(source: PublishSourceResolution, *, action: str) -> None:
+    branch = _run_git(
+        source, "symbolic-ref", "--quiet", "--short", "HEAD", action=action, check=False
+    )
+    if branch.returncode != 0 or not branch.stdout.strip():
+        raise _error(
+            "PZ_PUB_GIT_DETACHED_HEAD",
+            "目标 Git 仓库当前处于 detached HEAD，无法发布。",
+            action=action,
+        )
+    for key in ("user.name", "user.email"):
+        identity = _run_git(source, "config", "--get", key, action=action, check=False)
+        if identity.returncode != 0 or not identity.stdout.strip():
+            raise _error(
+                "PZ_PUB_GIT_IDENTITY_MISSING",
+                "Git author 或 tagger identity 未完整配置。",
+                action=action,
+                detail=key,
+            )
+    staged = _name_set(source, "diff", "--cached", "--name-only", "-z", action=action)
+    if staged:
+        raise _error(
+            "PZ_PUB_GIT_INDEX_DIRTY",
+            "Git index 已存在 staged 内容，无法开始子包发布。",
+            action=action,
+            detail=", ".join(sorted(staged)),
+        )
+    roots = _package_relative_roots(source)
+    ambiguous = sorted(
+        path for path in _changed_paths(source, action=action)
+        if not any(_belongs_to(path, root) for root in roots)
+    )
+    if ambiguous:
+        raise _error(
+            "PZ_PUB_GIT_SCOPE_AMBIGUOUS",
+            "存在无法归属到正式最小子包的未提交修改，无法执行单包发布。",
+            action=action,
+            detail=", ".join(ambiguous),
+        )
+
+
+def _head(source: PublishSourceResolution, *, action: str) -> str:
+    return _output(source, "rev-parse", "HEAD", action=action)
+
+
+def preflight_publish_app(
+    app_id: str,
+    *,
+    project_dir: Path,
+    action: str,
+    source: PublishSourceResolution | None = None,
+) -> PublishSourceResolution:
+    resolved = source or resolve_publish_source(project_dir, app_id, action=action)
+    _validate_repository(resolved, action=action)
+    return resolved
+
+
+def commit_publish_app(
+    app_id: str,
+    *,
+    project_dir: Path,
+    version: str,
+    action: str,
+) -> PublishCommitResult:
+    source = resolve_publish_source(project_dir, app_id, action=action)
+    _validate_repository(source, action=action)
+    relative = _relative_package_path(source)
+    subject = f"release({source.app_id}): {version}"
+    target_changes = sorted(
+        path for path in _changed_paths(source, action=action)
+        if relative == "." or _belongs_to(path, Path(relative))
+    )
+    expected_tag = f"{source.distribution_name}@{version}"
+    existing_tag = _run_git(
+        source,
+        "rev-parse",
+        "--verify",
+        f"refs/tags/{expected_tag}^{{commit}}",
+        action=action,
+        check=False,
+    )
+    if target_changes and existing_tag.returncode == 0:
+        raise _error(
+            "PZ_PUB_TAG_CONFLICT",
+            "目标 package tag 已存在，不能创建新的 release commit。",
+            action=action,
+            detail=expected_tag,
+        )
+    if not target_changes:
+        head = _head(source, action=action)
+        existing_subject = _output(source, "show", "-s", "--format=%s", head, action=action)
+        if existing_subject == subject:
+            return PublishCommitResult(source=source, version=version, commit=head, reused=True)
+        raise _error(
+            "PZ_PUB_RELEASE_COMMIT_CONFLICT",
+            "目标子包没有可提交修改，当前 HEAD 也不是匹配的 release commit。",
+            action=action,
+            detail=subject,
+        )
+    _run_git(source, "add", "-A", "--", relative, action=action)
+    try:
+        _run_git(
+            source,
+            "-c",
+            "core.hooksPath=/dev/null",
+            "commit",
+            "-m",
+            subject,
+            "--",
+            relative,
+            action=action,
+        )
+    except Exception:
+        _run_git(source, "reset", "--mixed", "HEAD", action=action, check=False)
+        raise
+    commit = _head(source, action=action)
+    unexpected = sorted(
+        path
+        for path in _commit_paths(source, commit, action=action)
+        if relative != "." and not _belongs_to(path, Path(relative))
+    )
+    if unexpected:
+        raise _error(
+            "PZ_PUB_RELEASE_STATE_INVALID",
+            "release commit 包含目标子包之外的文件。",
+            action=action,
+            detail=", ".join(unexpected),
+        )
+    residual = [
+        path for path in _changed_paths(source, action=action)
+        if relative == "." or _belongs_to(path, Path(relative))
+    ]
+    if residual:
+        raise _error(
+            "PZ_PUB_RELEASE_STATE_INVALID",
+            "release commit 后目标子包仍有未提交修改。",
+            action=action,
+            detail=", ".join(sorted(residual)),
+        )
+    return PublishCommitResult(source=source, version=version, commit=commit, reused=False)
+
+
+def tag_publish_app(
+    app_id: str,
+    *,
+    project_dir: Path,
+    version: str,
+    commit: str | None = None,
+    action: str,
+) -> PublishTagResult:
+    source = resolve_publish_source(project_dir, app_id, action=action)
+    _validate_repository(source, action=action)
+    subject = f"release({source.app_id}): {version}"
+    target_commit = _output(
+        source, "rev-parse", f"{commit or 'HEAD'}^{{commit}}", action=action
+    )
+    if _output(source, "show", "-s", "--format=%s", target_commit, action=action) != subject:
+        raise _error(
+            "PZ_PUB_RELEASE_COMMIT_CONFLICT",
+            "目标 commit 不是匹配的子包 release commit。",
+            action=action,
+            detail=target_commit,
+        )
+    reachable = _run_git(
+        source,
+        "merge-base",
+        "--is-ancestor",
+        target_commit,
+        "HEAD",
+        action=action,
+        check=False,
+    )
+    if reachable.returncode != 0:
+        raise _error(
+            "PZ_PUB_RELEASE_STATE_INVALID",
+            "release commit 无法从当前分支到达。",
+            action=action,
+            detail=target_commit,
+        )
+    tag = f"{source.distribution_name}@{version}"
+    annotation = f"release({source.app_id}): {source.distribution_name} {version}"
+    existing = _run_git(source, "rev-parse", "--verify", f"refs/tags/{tag}^{{commit}}", action=action, check=False)
+    if existing.returncode == 0:
+        existing_commit = existing.stdout.strip()
+        existing_annotation = _output(source, "for-each-ref", f"refs/tags/{tag}", "--format=%(contents)", action=action).strip()
+        if existing_commit != target_commit or existing_annotation != annotation:
+            raise _error(
+                "PZ_PUB_TAG_CONFLICT",
+                "目标 package tag 已存在，但 commit 或 annotation 不匹配。",
+                action=action,
+                detail=tag,
+            )
+        return PublishTagResult(
+            commit_result=PublishCommitResult(source, version, target_commit, True),
+            tag=tag,
+            reused=True,
+        )
+    _run_git(source, "tag", "-a", tag, target_commit, "-m", annotation, action=action)
+    return PublishTagResult(
+        commit_result=PublishCommitResult(source, version, target_commit, True),
+        tag=tag,
+        reused=False,
+    )
+
+
+def require_publish_tag(
+    app_id: str,
+    *,
+    project_dir: Path,
+    version: str,
+    action: str,
+) -> PublishTagResult:
+    source = resolve_publish_source(project_dir, app_id, action=action)
+    tag = f"{source.distribution_name}@{version}"
+    annotation = f"release({source.app_id}): {source.distribution_name} {version}"
+    existing = _run_git(
+        source,
+        "rev-parse",
+        "--verify",
+        f"refs/tags/{tag}^{{commit}}",
+        action=action,
+        check=False,
+    )
+    if existing.returncode != 0:
+        raise _error(
+            "PZ_PUB_RELEASE_STATE_INVALID",
+            "目标 package tag 不存在，请先执行 pz pub tag。",
+            action=action,
+            detail=tag,
+        )
+    commit = existing.stdout.strip()
+    reachable = _run_git(
+        source,
+        "merge-base",
+        "--is-ancestor",
+        commit,
+        "HEAD",
+        action=action,
+        check=False,
+    )
+    if reachable.returncode != 0:
+        raise _error(
+            "PZ_PUB_RELEASE_STATE_INVALID",
+            "package tag commit 无法从当前分支到达。",
+            action=action,
+            detail=tag,
+        )
+    subject = _output(source, "show", "-s", "--format=%s", commit, action=action)
+    existing_annotation = _output(
+        source,
+        "for-each-ref",
+        f"refs/tags/{tag}",
+        "--format=%(contents)",
+        action=action,
+    ).strip()
+    if subject != f"release({source.app_id}): {version}" or existing_annotation != annotation:
+        raise _error(
+            "PZ_PUB_RELEASE_STATE_INVALID",
+            "package tag、release commit 或 annotation 不一致。",
+            action=action,
+            detail=tag,
+        )
+    return PublishTagResult(
+        commit_result=PublishCommitResult(source, version, commit, True),
+        tag=tag,
+        reused=True,
+    )
+
+
+def require_publish_checkout_at_tag(
+    tag_result: PublishTagResult,
+    *,
+    action: str,
+) -> Path:
+    source = tag_result.commit_result.source
+    _validate_repository(source, action=action)
+    changes = sorted(_changed_paths(source, action=action))
+    if changes:
+        raise _error(
+            "PZ_PUB_RELEASE_STATE_INVALID",
+            "发布 upload 要求当前 Git checkout 完全干净。",
+            action=action,
+            detail=", ".join(changes),
+        )
+    head = _head(source, action=action)
+    if head != tag_result.commit_result.commit:
+        raise _error(
+            "PZ_PUB_RELEASE_STATE_INVALID",
+            "发布 upload 要求当前 HEAD 精确等于 package tag commit。",
+            action=action,
+            detail=tag_result.tag,
+        )
+    return source.package_root
+
+
+__all__ = [
+    "PublishCommitResult",
+    "PublishTagResult",
+    "commit_publish_app",
+    "preflight_publish_app",
+    "require_publish_checkout_at_tag",
+    "require_publish_tag",
+    "tag_publish_app",
+]

pz_core/authoring/publish_lock.py

@@ -0,0 +1,188 @@
+from __future__ import annotations
+
+from collections.abc import Mapping, Sequence
+from pathlib import Path
+from typing import Any, TYPE_CHECKING
+
+from pz_core.runtime.errors import PzError
+from pz_core.utils.project_jsonc import load_jsonc_file
+
+from .project_defaults import load_project_default_jsonc_payload
+from .project_state import resolve_project_config_path
+
+if TYPE_CHECKING:
+    from .release import PublishTarget
+
+
+_OWNER = "pz_core.authoring"
+
+
+def _read_project_payload(project_dir: Path, *, action: str) -> dict[str, Any]:
+    config_path = resolve_project_config_path(project_dir)
+    if not config_path.is_file():
+        return {}
+    payload = load_jsonc_file(
+        config_path,
+        code="PZ_PROJECT_CONFIG_INVALID",
+        owner=_OWNER,
+        action=action,
+    )
+    if not isinstance(payload, dict):
+        return {}
+    return dict(payload)
+
+
+def _deep_merge_mappings(base: Mapping[str, Any], incoming: Mapping[str, Any]) -> dict[str, Any]:
+    merged = dict(base)
+    for key, value in incoming.items():
+        existing = merged.get(key)
+        if isinstance(existing, Mapping) and isinstance(value, Mapping):
+            merged[str(key)] = _deep_merge_mappings(existing, value)
+            continue
+        merged[str(key)] = value
+    return merged
+
+
+def _merge_extension_payload(defaults: object, project_payload: object) -> dict[str, Any]:
+    merged: dict[str, Any] = {}
+    for candidate in (defaults, project_payload):
+        if not isinstance(candidate, Mapping):
+            continue
+        merged = _deep_merge_mappings(merged, candidate)
+    return merged
+
+
+def _coerce_allowlist_mapping(payload: object, *, action: str) -> dict[str, tuple[str, ...]]:
+    if payload is None:
+        return {}
+    if not isinstance(payload, Mapping):
+        raise PzError(
+            code="PZ_PUBLISH_LOCK_CONFIG_INVALID",
+            message="`extensions.publish_lock.targets` must be an object.",
+            stage="cli",
+            owner=_OWNER,
+            action=action,
+        )
+    normalized: dict[str, tuple[str, ...]] = {}
+    for raw_key, raw_value in payload.items():
+        key = str(raw_key).strip().lower()
+        if not key:
+            raise PzError(
+                code="PZ_PUBLISH_LOCK_CONFIG_INVALID",
+                message="publish lock target keys must be non-empty strings.",
+                stage="cli",
+                owner=_OWNER,
+                action=action,
+            )
+        if not isinstance(raw_value, Sequence) or isinstance(raw_value, (str, bytes)):
+            raise PzError(
+                code="PZ_PUBLISH_LOCK_CONFIG_INVALID",
+                message=f"publish lock target `{key}` must be a string array.",
+                stage="cli",
+                owner=_OWNER,
+                action=action,
+            )
+        values = tuple(str(item).strip() for item in raw_value if str(item).strip())
+        normalized[key] = values
+    return normalized
+
+
+def load_publish_lock_allowlists(project_dir: Path, *, action: str) -> dict[str, tuple[str, ...]]:
+    defaults = load_project_default_jsonc_payload()
+    project_payload = _read_project_payload(project_dir, action=action)
+    merged_extensions = _merge_extension_payload(
+        defaults.get("extensions"),
+        project_payload.get("extensions"),
+    )
+    publish_lock = merged_extensions.get("publish_lock")
+    if publish_lock is None:
+        return {}
+    if not isinstance(publish_lock, Mapping):
+        raise PzError(
+            code="PZ_PUBLISH_LOCK_CONFIG_INVALID",
+            message="`extensions.publish_lock` must be an object.",
+            stage="cli",
+            owner=_OWNER,
+            action=action,
+        )
+    raw_targets = publish_lock.get("targets", publish_lock)
+    return _coerce_allowlist_mapping(raw_targets, action=action)
+
+
+def _classify_target_channel(target: "PublishTarget") -> str | None:
+    name = str(target.name or "").strip().lower()
+    if name in {"devpi_pub", "pub"}:
+        return "pub"
+    if name in {"devpi_prod", "prod"}:
+        return "prod"
+    if name in {"devpi_dev", "dev", "test"}:
+        return "dev"
+    urls = [str(value or "").strip().lower() for value in (target.publish_url, target.check_url, target.index)]
+    if any("/packages/pub/" in url for url in urls):
+        return "pub"
+    if any("/packages/prod/" in url for url in urls):
+        return "prod"
+    if any("/packages/dev/" in url for url in urls):
+        return "dev"
+    return None
+
+
+def _candidate_package_names(app_id: str, distribution_name: str) -> set[str]:
+    values = {
+        str(app_id).strip(),
+        str(distribution_name).strip(),
+    }
+    normalized: set[str] = set()
+    for value in values:
+        if not value:
+            continue
+        normalized.add(value.lower())
+        normalized.add(value.replace("-", "_").lower())
+        normalized.add(value.replace("_", "-").lower())
+    return normalized
+
+
+def enforce_publish_lock(
+    *,
+    project_dir: Path,
+    app_id: str,
+    distribution_name: str,
+    target: "PublishTarget",
+    action: str,
+) -> None:
+    allowlists = load_publish_lock_allowlists(project_dir, action=action)
+    if not allowlists:
+        return
+    target_name = str(target.name or "").strip().lower()
+    matched_key: str | None = None
+    allowed: tuple[str, ...] | None = None
+    if target_name and target_name in allowlists:
+        matched_key = target_name
+        allowed = allowlists[target_name]
+    else:
+        channel = _classify_target_channel(target)
+        if channel and channel in allowlists:
+            matched_key = channel
+            allowed = allowlists[channel]
+    if allowed is None:
+        return
+    allowed_names = {str(item).strip().lower() for item in allowed if str(item).strip()}
+    if _candidate_package_names(app_id, distribution_name) & allowed_names:
+        return
+    raise PzError(
+        code="PZ_PUBLISH_LOCK_DENIED",
+        message=(
+            f"package `{distribution_name}` is not allowed to publish to target "
+            f"`{target.name}` by `extensions.publish_lock.targets.{matched_key}`."
+        ),
+        stage="cli",
+        owner=_OWNER,
+        action=action,
+        detail=", ".join(allowed),
+    )
+
+
+__all__ = [
+    "enforce_publish_lock",
+    "load_publish_lock_allowlists",
+]