mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 20:26:33 +00:00
kevinveenbirkenbachandClaude Opus 4.7
a8a117c86e
New lint guard
==============
tests/lint/repository/test_no_direct_yaml_calls.py AST-walks the
production tree (utils/, cli/, plugins/, filter_plugins/,
lookup_plugins/, roles/, scripts/, tasks/) and flags any direct
`yaml.safe_load` / `yaml.safe_dump` / `yaml.load` / `yaml.dump` /
`yaml.safe_load_all` / `yaml.dump_all` call. Aliased imports are
tracked: `import yaml as Y` ⇒ `Y.safe_load(...)` is flagged;
`from yaml import safe_load` ⇒ bare `safe_load(...)` is flagged.
Per-line opt-out: `# noqa: direct-yaml` on the call's physical line
(or any line spanned by a multi-line call). No central exemption
list — every legitimate exception lives next to its call with a
human-readable rationale in the surrounding comment.
Cache module additions
======================
* `dump_yaml_str(data)` — symmetric to `safe_dump(data)` with no file
path. Used for stdout output and filter return values where the
cache cannot help but the API needs to stay consistent.
* `load_yaml_str(text)` — symmetric to `safe_load(text)`. Used when
YAML comes from an HTTP body, a mutated buffer, or a mock-patched
source whose content does not correspond to a stable on-disk file.
Migrated production call sites (33 → 0 direct-yaml violations)
==============================================================
* utils/{entity_name_utils, valid_deploy_id, invokable, service_registry,
domains/list, applications/{config, in_group_deps},
docker/image/discovery, meta/{port_bands, scan},
roles/{dependency_resolver, meta_lookup, resource_validation}}
* cli/{build/{graph, inventory/full/command}, create/inventory/{host_vars,
mirror_overrides}, fix/vars_main_files, meta/{applications/in_group_deps,
callorder}, mirror/resolver, validate/inventory}
* plugins/{filter/{compose_volumes, get_all_application_ids, get_role,
invokable_paths, role_path_by_app_id}, lookup/applications_current_play}
* roles/{svc-db-postgres/filter_plugins/split_postgres_connections,
web-app-bigbluebutton/filter_plugins/compose_mods,
web-app-dashboard/lookup_plugins/docker_cards}
Behaviour adjustments
=====================
* utils/roles/dependency_resolver — `safe_load_all` (multi-doc) →
single-doc `load_yaml_any` wrapped in a list. Ansible task files are
single-doc by convention; the downstream multi-doc loop stays intact
for forward compatibility.
* roles/sys-svc-compose-ca/files/compose_ca.py — KEEPS direct
yaml.safe_load / yaml.safe_dump (annotated with noqa). The script is
copied to the target host via `ansible.builtin.copy` and the target
has no `utils/` package on PYTHONPATH.
noqa-annotated direct-yaml call sites (with rationale)
======================================================
* utils/cache/yaml.py — IS the cache; would recurse.
* utils/handler/yaml.py — vault-aware Loader subclass that wraps
\!vault scalars in VaultScalar; cache-by-path collapses the wrapping.
* cli/encrypt/inventory/__main__.py — vault-aware Dumper subclass that
emits \!vault literal blocks; the cached dump_yaml writes plain YAML
which is the wrong output here.
* roles/sys-svc-compose-ca/files/compose_ca.py — runtime-deployed.
* tasks/utils/migrate_meta_layout.py — once-off migration script.
Validation
==========
* Unit tests: 1573 passed.
* Lint: 56 passed (incl. new test_no_direct_yaml_calls).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
52 lines
1.6 KiB
Python
52 lines
1.6 KiB
Python
import os
|
|
|
|
from utils.cache.yaml import load_yaml
|
|
|
|
|
|
def load_categories_tree(categories_file):
|
|
return load_yaml(categories_file)["roles"]
|
|
|
|
|
|
def flatten_categories(tree, prefix=""):
|
|
"""Flattens nested category tree to all possible category paths."""
|
|
result = []
|
|
for k, v in tree.items():
|
|
current = f"{prefix}-{k}" if prefix else k
|
|
result.append(current)
|
|
if isinstance(v, dict):
|
|
for sk, sv in v.items():
|
|
if isinstance(sv, dict):
|
|
result.extend(flatten_categories({sk: sv}, current))
|
|
return result
|
|
|
|
|
|
def get_entity_name(role_name):
|
|
"""
|
|
Get the entity name from a role name by removing the
|
|
longest matching category path from categories.yml.
|
|
"""
|
|
possible_locations = [
|
|
os.path.join(os.getcwd(), "roles", "categories.yml"),
|
|
os.path.join(os.path.dirname(__file__), "..", "roles", "categories.yml"),
|
|
"roles/categories.yml",
|
|
]
|
|
categories_file = None
|
|
for loc in possible_locations:
|
|
if os.path.exists(loc):
|
|
categories_file = loc
|
|
break
|
|
if not categories_file:
|
|
return role_name
|
|
|
|
categories_tree = load_categories_tree(categories_file)
|
|
all_category_paths = flatten_categories(categories_tree)
|
|
|
|
role_name_lc = role_name.lower()
|
|
all_category_paths = [cat.lower() for cat in all_category_paths]
|
|
for cat in sorted(all_category_paths, key=len, reverse=True):
|
|
if role_name_lc.startswith(cat + "-"):
|
|
return role_name[len(cat) + 1 :]
|
|
if role_name_lc == cat:
|
|
return ""
|
|
return role_name
|