mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-10 04:36:40 +00:00
kevinveenbirkenbachandClaude Opus 5
bf25eb2fc7
The sync job force-pushed the source repository's main onto this one so that `origin/main` would mean "upstream main" for the three consumers that diff against it. Carrying .github/workflows/** in that push is what GitHub refuses for an App token, and `workflows` is not a GITHUB_TOKEN permission scope, so the job needed an app installation that may write workflow files. Run 37169357364 showed the fork has no such secret at all. Nothing reads the pushed branch. push_ci_policy.sh, affected_roles.sh and new_roles.sh each fetch `origin main` into their own runner's clone before reading it, and no caller queries the branch through the API. Pointing those fetches at the configured source repository gives the same baseline read-only: no push, no credential, no app permission to widen. baseline_remote.sh resolves where that baseline comes from and keeps the normalization and the disabled-value list in one place: `origin` for the source repository itself, for a disabled sync and for a local clone without GITHUB_REPOSITORY, and the upstream fetch URL otherwise. The fetches now carry an explicit `main:refs/remotes/origin/main` refspec, which a URL needs and a remote name tolerates. The release guard keeps fetching `origin`: it asks whether a tag commit sits on this repository's own main, which is a different question from the diff baseline. Removed: the sync-main job, its `needs` edge, main_from_repository.sh and the directory that held it. test_diff_affected_roles.py copies only the script under test into its fixture, so it needed the new helper too. It also inherited the full environment, and a GITHUB_REPOSITORY present in CI would have sent the fixture's baseline fetch to the real upstream instead of its own bare remote: three of its five cases fail that way, and the run takes 24s instead of 0.3s because it goes to the network. The variable is now dropped alongside BASH_ENV. Verified by running the helper in all four contexts and affected_roles.sh from an empty refs/remotes/origin/main in a scratch clone as the fork, as the source repository and locally; each populated the ref and completed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
117 lines
3.8 KiB
Bash
Executable File
117 lines
3.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Compute which roles are affected by the current branch's diff against
|
|
# `origin/main`, expanded transitively over run_after + dependencies +
|
|
# services edges via cli.meta.roles.applications.resolution.affected.
|
|
#
|
|
# Output (single line on stdout):
|
|
# __ALL__ full deploy needed. Emitted when:
|
|
# * the diff is empty, OR
|
|
# * any changed path outside
|
|
# roles/<role>/ is not a Markdown
|
|
# or reStructuredText file (the
|
|
# `.md`/`.rst` skip-list mirrors
|
|
# scripts/meta/resolve/pr/scope.sh's
|
|
# `is_markdown_or_rst`), OR
|
|
# * the diff contains only such
|
|
# skipped paths and no role seeds
|
|
# could be derived, OR
|
|
# * any seed role is non-modellable
|
|
# in the reverse resolver
|
|
# (resolver exit 2), OR
|
|
# * the resolver itself errors out
|
|
# (any other non-zero exit).
|
|
# <token> [<token> ...] restricted deploy set (whitelist).
|
|
# A token is a role id, narrowed to the
|
|
# variants that reach a seed where not all
|
|
# of them do (`web-app-x#0,2`, see
|
|
# utils.github.variant.selection).
|
|
#
|
|
# Pre-conditions:
|
|
# - The host Python interpreter referenced by ${PYTHON:-python3} has the
|
|
# project's resolver deps installed (e.g. via `make install`).
|
|
# - `git fetch origin main` is reachable (caller already did checkout).
|
|
#
|
|
# Exit codes:
|
|
# 0 in all defined output cases (including the fail-safe __ALL__).
|
|
# The script is fail-safe by design: any resolver failure widens the
|
|
# deploy matrix to "all", it never narrows it.
|
|
|
|
set -euo pipefail
|
|
|
|
PYTHON="${PYTHON:-python3}"
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
REPO_ROOT="$(cd "$SCRIPT_DIR/../../../.." && pwd)"
|
|
cd "$REPO_ROOT"
|
|
|
|
if [[ -f "scripts/meta/env/load.sh" ]]; then
|
|
# shellcheck source=scripts/meta/env/load.sh
|
|
source "scripts/meta/env/load.sh"
|
|
fi
|
|
|
|
emit_all() {
|
|
echo "__ALL__"
|
|
exit 0
|
|
}
|
|
|
|
baseline_remote="$(./scripts/meta/resolve/baseline_remote.sh)"
|
|
git fetch --quiet --no-tags --depth=50 "${baseline_remote}" main:refs/remotes/origin/main --force >/dev/null 2>&1 ||
|
|
git fetch --quiet --no-tags "${baseline_remote}" main:refs/remotes/origin/main --force
|
|
|
|
if base="$(git merge-base origin/main HEAD 2>/dev/null)"; then
|
|
mapfile -t changed_paths < <(git diff --name-only "${base}" HEAD --)
|
|
else
|
|
mapfile -t changed_paths < <(git diff --name-only origin/main HEAD --)
|
|
fi
|
|
|
|
if ((${#changed_paths[@]} == 0)); then
|
|
emit_all
|
|
fi
|
|
|
|
declare -A seed_roles=()
|
|
|
|
for path in "${changed_paths[@]}"; do
|
|
[[ -z "${path}" ]] && continue
|
|
if [[ "${path}" != roles/*/* ]]; then
|
|
case "${path}" in
|
|
*.md | *.rst)
|
|
continue
|
|
;;
|
|
esac
|
|
emit_all
|
|
fi
|
|
role="${path#roles/}"
|
|
role="${role%%/*}"
|
|
[[ -z "${role}" ]] && emit_all
|
|
seed_roles["${role}"]=1
|
|
done
|
|
|
|
if ((${#seed_roles[@]} == 0)); then
|
|
emit_all
|
|
fi
|
|
|
|
mapfile -t seed_list < <(printf '%s\n' "${!seed_roles[@]}" | sort)
|
|
|
|
set +e
|
|
resolved="$(
|
|
"${PYTHON}" -m cli.meta.roles.applications.resolution.affected \
|
|
--changed-roles "${seed_list[@]}"
|
|
)"
|
|
resolver_rc=$?
|
|
set -e
|
|
|
|
if ((resolver_rc != 0)); then
|
|
emit_all
|
|
fi
|
|
|
|
resolved="${resolved//$'\r'/}"
|
|
resolved="${resolved#"${resolved%%[![:space:]]*}"}"
|
|
resolved="${resolved%"${resolved##*[![:space:]]}"}"
|
|
|
|
if [[ -z "${resolved}" ]]; then
|
|
emit_all
|
|
fi
|
|
|
|
printf '%s\n' "${resolved}"
|