Files
computer-playbook/utils/github/variant/label.py
T
kevinveenbirkenbachandClaude Opus 5 677a63931c Merge branch 'feature/network/multi-network-serving' into feature/store-i18n
Resolves 68 conflicted files. The governing rule was our structure with their
network semantics: the tor boolean becomes a network mode (clearnet | tor |
multi) throughout the variant layer, while this branch's architecture and mesh
axes, its extracted modules and its i18n content stay.

Where the two sides covered different ground, both are kept rather than one
picked:

- ca_injected answers a ca_client on the deployment's TLS mode OR on an SSO
  issuer that resolves self-signed. 3a3e9ed2c9 records why: an issuer is not
  an object store, so keeping only one side drops the other's coverage.
- get_merged_domains keeps the loud refusal when svc-net-tor is deployed
  without a provisioned node, now gated on their tor_serves_host; their
  node_onion_of returns an empty string there, which would have served every
  onion-exclusive app on clearnet in silence.
- sso_cookie_domains stays the single source for oauth2-proxy's cookie scope.
  Their per-network branch omitted the issuer domain on the onion arm, which
  breaks the callback leg.
- The clearnet CSP batch carries --clearnet-timeout again; their batch dict
  hardcoded zero while the role still passes the flag.
- The dashboard keeps its i18n content dir, image, version and design
  resolution; their side reduced the logo sources to the bare service
  provider values.

Their side wins where it is measurably better: the onion mirror rewrite is
gated per vhost rather than per app, the Playwright onion decision reads the
pass's own domain instead of the role's canonical one, and the matomo
reinjection and dashboard config render per network sibling.

Eight files were broken by the merge without ever carrying a conflict marker,
because git marks only the lines both sides touched:

- utils/cache/domains.py lost the onionize block that sat between two hunks
- roles/sys-front-inj-all/templates/body_filter.lua.j2 called it
- web-app-bluesky, keycloak sso_proxy: the get_entity_name filter was renamed
- trigger/__main__.py, playwright_coverage.py and its test: the deleted tor
  module
- cli/administration/deploy/ci/timings.py read Label.tor
- plugins/filter/csp_filters.py called _aligned_url with four of six arguments
- tests/unit/python/utils/cache/test_domains.py referenced a renamed class
- tests/.../sys-ctl-hlth-csp/files/test_script.py mocked a function main no
  longer calls

Verified: the variant layer (155 tests, 65 subtests), ca_injected (18),
the CI layer (175), the domains cache including the restored guard (32),
retrigger inputs (9), timings and the CSP health script (53). make
quality-high clears autoformat; its remaining findings are tracked separately.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-10-23 09:53:41 +02:00

136 lines
4.5 KiB
Python
Raw Blame History

This file contains invisible Unicode characters
This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
"""One deploy job's title and artifact name: how they are built and read back."""
from __future__ import annotations
import re
from typing import TYPE_CHECKING, NamedTuple
from utils.github.variant.pools import ARCHITECTURES, DISTROS, FILESYSTEMS, MODES
from utils.networks.reachability import CLEARNET, NODE_MODES
from utils.roles.display import VARIANT_SEPARATOR
from utils.symbol_glossary import to_emoji, to_word
if TYPE_CHECKING:
from collections.abc import Sequence
LOCAL_GLYPH = to_emoji("test_host")
_AXIS_GLYPHS = (
"".join(
to_emoji(word)
for word in (*NODE_MODES, "vpn", "direct", "priority", "instructions")
)
+ LOCAL_GLYPH
)
def _alternation(words: Sequence[str]) -> str:
"""A regex alternation over the glyphs of *words*."""
return "|".join(re.escape(to_emoji(word)) for word in words)
LABEL_RE = re.compile(
r"^.*(?P<mode>" + _alternation(MODES) + r")️?"
r"(?:(?P<network>"
+ _alternation(tuple(NODE_MODES))
+ r")|"
+ re.escape(LOCAL_GLYPH)
+ r")?️?"
r"(?P<vpn>" + re.escape(to_emoji("vpn")) + r")?️?"
r"(?:" + re.escape(to_emoji("direct")) + r")?️?"
r"(?P<distro>" + _alternation(DISTROS) + r")?️?"
r"(?P<filesystem>" + _alternation(FILESYSTEMS) + r")?️?"
r"(?P<architecture>" + _alternation(ARCHITECTURES) + r")?️?"
r"[" + re.escape(_AXIS_GLYPHS) + r"️\s]*"
r"(?P<name>.+?)"
r"(?:" + re.escape(VARIANT_SEPARATOR) + r"(?P<variant>[0-9,]+))?"
r"[" + re.escape(_AXIS_GLYPHS) + r"️\s]*$"
)
"""The leading ``.*`` is greedy on purpose: it anchors on the LAST mode glyph.
A reusable-workflow caller path can carry a mode glyph of its own (``z / 💻
Host / 💻 sys-front-proxy``), and matching the first one would swallow the
caller name into the role."""
class Label(NamedTuple):
"""One deploy job title, taken apart."""
mode: str
name: str
variant: str
network: str = CLEARNET
distro: str = ""
filesystem: str = ""
architecture: str = ""
vpn: bool = False
def parse_label(name: str) -> Label | None:
"""Take a deploy job title apart.
The inverse of what :func:`assign` builds, kept next to it so the two
cannot drift: consumers that hand-rolled their own regex over raw role
ids silently matched nothing once job titles carried display names, and
every failure went unreported.
Args:
name: the job title, with or without a reusable-workflow caller path
in front of it.
Returns:
``None`` when the title carries no deploy row. ``name`` is the display
name, returned unresolved -- callers decode it through
``utils.roles.display``, which is what knows the role tree. A title
without a network glyph (host rows) reads as ``clearnet``.
``network``, ``vpn``, ``distro``, ``filesystem`` and ``architecture``
matter because a priority role runs the same mode and variant several
times over, and only the glyphs tell those jobs apart -- a retrigger
built from the title alone would otherwise replay a different
combination than the one that failed.
"""
match = LABEL_RE.match(name.strip())
if match is None:
return None
glyph = match.group("network")
return Label(
to_word(match.group("mode")),
match.group("name").strip(),
match.group("variant") or "",
to_word(glyph) if glyph else CLEARNET,
to_word(match.group("distro") or ""),
to_word(match.group("filesystem") or ""),
to_word(match.group("architecture") or ""),
match.group("vpn") is not None,
)
def artifact_slug(
mode: str,
app: str,
variant: str,
network: str,
distro: str = "",
filesystem: str = "",
architecture: str = "",
vpn: bool = False,
) -> str:
"""What identifies one deploy job's artifacts.
Built here rather than as a workflow expression so the matrix entry and
every consumer read the same string: a priority role runs the same mode
and variant once per network mode, and two jobs uploading under one name
is an artifact conflict, not an overwrite. The distro and filesystem are
in it for the same reason -- a selection may name one row on two distros
(``role#0%debian role#0%fedora``), and those are two deploys of one mode,
variant and network mode.
"""
shards = (
variant,
"" if network == CLEARNET else network,
"vpn" if vpn else "",
distro,
filesystem,
architecture,
)
return f"{mode}-{app}" + "".join(f"-{shard}" for shard in shards if shard)