mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-10 12:47:04 +00:00
kevinveenbirkenbachandClaude Opus 4.7
a8a117c86e
New lint guard
==============
tests/lint/repository/test_no_direct_yaml_calls.py AST-walks the
production tree (utils/, cli/, plugins/, filter_plugins/,
lookup_plugins/, roles/, scripts/, tasks/) and flags any direct
`yaml.safe_load` / `yaml.safe_dump` / `yaml.load` / `yaml.dump` /
`yaml.safe_load_all` / `yaml.dump_all` call. Aliased imports are
tracked: `import yaml as Y` ⇒ `Y.safe_load(...)` is flagged;
`from yaml import safe_load` ⇒ bare `safe_load(...)` is flagged.
Per-line opt-out: `# noqa: direct-yaml` on the call's physical line
(or any line spanned by a multi-line call). No central exemption
list — every legitimate exception lives next to its call with a
human-readable rationale in the surrounding comment.
Cache module additions
======================
* `dump_yaml_str(data)` — symmetric to `safe_dump(data)` with no file
path. Used for stdout output and filter return values where the
cache cannot help but the API needs to stay consistent.
* `load_yaml_str(text)` — symmetric to `safe_load(text)`. Used when
YAML comes from an HTTP body, a mutated buffer, or a mock-patched
source whose content does not correspond to a stable on-disk file.
Migrated production call sites (33 → 0 direct-yaml violations)
==============================================================
* utils/{entity_name_utils, valid_deploy_id, invokable, service_registry,
domains/list, applications/{config, in_group_deps},
docker/image/discovery, meta/{port_bands, scan},
roles/{dependency_resolver, meta_lookup, resource_validation}}
* cli/{build/{graph, inventory/full/command}, create/inventory/{host_vars,
mirror_overrides}, fix/vars_main_files, meta/{applications/in_group_deps,
callorder}, mirror/resolver, validate/inventory}
* plugins/{filter/{compose_volumes, get_all_application_ids, get_role,
invokable_paths, role_path_by_app_id}, lookup/applications_current_play}
* roles/{svc-db-postgres/filter_plugins/split_postgres_connections,
web-app-bigbluebutton/filter_plugins/compose_mods,
web-app-dashboard/lookup_plugins/docker_cards}
Behaviour adjustments
=====================
* utils/roles/dependency_resolver — `safe_load_all` (multi-doc) →
single-doc `load_yaml_any` wrapped in a list. Ansible task files are
single-doc by convention; the downstream multi-doc loop stays intact
for forward compatibility.
* roles/sys-svc-compose-ca/files/compose_ca.py — KEEPS direct
yaml.safe_load / yaml.safe_dump (annotated with noqa). The script is
copied to the target host via `ansible.builtin.copy` and the target
has no `utils/` package on PYTHONPATH.
noqa-annotated direct-yaml call sites (with rationale)
======================================================
* utils/cache/yaml.py — IS the cache; would recurse.
* utils/handler/yaml.py — vault-aware Loader subclass that wraps
\!vault scalars in VaultScalar; cache-by-path collapses the wrapping.
* cli/encrypt/inventory/__main__.py — vault-aware Dumper subclass that
emits \!vault literal blocks; the cached dump_yaml writes plain YAML
which is the wrong output here.
* roles/sys-svc-compose-ca/files/compose_ca.py — runtime-deployed.
* tasks/utils/migrate_meta_layout.py — once-off migration script.
Validation
==========
* Unit tests: 1573 passed.
* Lint: 56 passed (incl. new test_no_direct_yaml_calls).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
110 lines
2.9 KiB
Python
110 lines
2.9 KiB
Python
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
import sys
|
|
|
|
from utils.cache.yaml import dump_yaml_str
|
|
|
|
from plugins.filter.get_all_invokable_apps import get_all_invokable_apps
|
|
|
|
|
|
def build_group_inventory(apps: list[str], host: str) -> dict:
|
|
"""
|
|
Build an Ansible inventory in which each application is a group containing the given host.
|
|
"""
|
|
groups = {app: {"hosts": [host]} for app in apps}
|
|
inventory = {
|
|
"all": {
|
|
"hosts": [host],
|
|
"children": {app: {} for app in apps},
|
|
},
|
|
**groups,
|
|
}
|
|
return inventory
|
|
|
|
|
|
def build_hostvar_inventory(apps: list[str], host: str) -> dict:
|
|
"""
|
|
Alternative: Build an inventory where all invokable apps are set as a host variable (as a list).
|
|
"""
|
|
return {
|
|
"all": {"hosts": [host]},
|
|
"_meta": {
|
|
"hostvars": {
|
|
host: {
|
|
"invokable_applications": apps,
|
|
}
|
|
}
|
|
},
|
|
}
|
|
|
|
|
|
def main(argv: list[str] | None = None) -> int:
|
|
parser = argparse.ArgumentParser(
|
|
description="Build a dynamic Ansible inventory for a given host with all invokable applications."
|
|
)
|
|
parser.add_argument(
|
|
"--host",
|
|
required=True,
|
|
help="Hostname to assign to all invokable application groups",
|
|
)
|
|
parser.add_argument(
|
|
"-f",
|
|
"--format",
|
|
choices=["json", "yaml"],
|
|
default="yaml",
|
|
help="Output format (yaml [default], json)",
|
|
)
|
|
parser.add_argument(
|
|
"--inventory-style",
|
|
choices=["group", "hostvars"],
|
|
default="group",
|
|
help="Inventory style: group (default, one group per app) or hostvars (list as hostvar)",
|
|
)
|
|
parser.add_argument(
|
|
"-o",
|
|
"--output",
|
|
help="Write output to file instead of stdout",
|
|
)
|
|
parser.add_argument(
|
|
"-i",
|
|
"--ignore",
|
|
action="append",
|
|
default=[],
|
|
help="Application ID(s) to ignore (can be specified multiple times or comma-separated)",
|
|
)
|
|
|
|
args = parser.parse_args(argv)
|
|
|
|
try:
|
|
apps = get_all_invokable_apps()
|
|
except Exception as exc:
|
|
sys.stderr.write(f"Error: {exc}\n")
|
|
return 1
|
|
|
|
ignore_ids: set[str] = set()
|
|
for entry in args.ignore:
|
|
ignore_ids.update(i.strip() for i in entry.split(",") if i.strip())
|
|
|
|
if ignore_ids:
|
|
apps = [app for app in apps if app not in ignore_ids]
|
|
|
|
if args.inventory_style == "group":
|
|
inventory = build_group_inventory(apps, args.host)
|
|
else:
|
|
inventory = build_hostvar_inventory(apps, args.host)
|
|
|
|
if args.format == "json":
|
|
output = json.dumps(inventory, indent=2)
|
|
else:
|
|
output = dump_yaml_str(inventory)
|
|
|
|
if args.output:
|
|
with open(args.output, "w", encoding="utf-8") as fh:
|
|
fh.write(output)
|
|
else:
|
|
print(output)
|
|
|
|
return 0
|