mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 19:56:53 +00:00
kevinveenbirkenbachandClaude Opus 5
677a63931c
Resolves 68 conflicted files. The governing rule was our structure with their
network semantics: the tor boolean becomes a network mode (clearnet | tor |
multi) throughout the variant layer, while this branch's architecture and mesh
axes, its extracted modules and its i18n content stay.
Where the two sides covered different ground, both are kept rather than one
picked:
- ca_injected answers a ca_client on the deployment's TLS mode OR on an SSO
issuer that resolves self-signed. 3a3e9ed2c9 records why: an issuer is not
an object store, so keeping only one side drops the other's coverage.
- get_merged_domains keeps the loud refusal when svc-net-tor is deployed
without a provisioned node, now gated on their tor_serves_host; their
node_onion_of returns an empty string there, which would have served every
onion-exclusive app on clearnet in silence.
- sso_cookie_domains stays the single source for oauth2-proxy's cookie scope.
Their per-network branch omitted the issuer domain on the onion arm, which
breaks the callback leg.
- The clearnet CSP batch carries --clearnet-timeout again; their batch dict
hardcoded zero while the role still passes the flag.
- The dashboard keeps its i18n content dir, image, version and design
resolution; their side reduced the logo sources to the bare service
provider values.
Their side wins where it is measurably better: the onion mirror rewrite is
gated per vhost rather than per app, the Playwright onion decision reads the
pass's own domain instead of the role's canonical one, and the matomo
reinjection and dashboard config render per network sibling.
Eight files were broken by the merge without ever carrying a conflict marker,
because git marks only the lines both sides touched:
- utils/cache/domains.py lost the onionize block that sat between two hunks
- roles/sys-front-inj-all/templates/body_filter.lua.j2 called it
- web-app-bluesky, keycloak sso_proxy: the get_entity_name filter was renamed
- trigger/__main__.py, playwright_coverage.py and its test: the deleted tor
module
- cli/administration/deploy/ci/timings.py read Label.tor
- plugins/filter/csp_filters.py called _aligned_url with four of six arguments
- tests/unit/python/utils/cache/test_domains.py referenced a renamed class
- tests/.../sys-ctl-hlth-csp/files/test_script.py mocked a function main no
longer calls
Verified: the variant layer (155 tests, 65 subtests), ca_injected (18),
the CI layer (175), the domains cache including the restored guard (32),
retrigger inputs (9), timings and the CSP health script (53). make
quality-high clears autoformat; its remaining findings are tracked separately.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
73 lines
2.6 KiB
Python
73 lines
2.6 KiB
Python
"""Which matrix entry replays its role's README instructions.
|
|
|
|
The replay used to be a job of its own, picking one random role per run. It
|
|
rides on a deploy row instead, marked with ``instructions`` (the mode the
|
|
replay runs in). The job title says nothing about it: the row is an ordinary
|
|
deploy of its variant, and the guide host is one more service that variant
|
|
pulls in.
|
|
|
|
Which row carries it is declared, not computed: the role's ``meta/variants.yml``
|
|
switches the ``docs`` service on in exactly one variant, and the deploy pulls
|
|
the guide host in through that service edge. This module only reads that
|
|
declaration back out and turns it into matrix entries.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from typing import TYPE_CHECKING
|
|
|
|
from utils.roles.guide import GUIDE_SERVICE_KEY, guide_deployable
|
|
|
|
if TYPE_CHECKING:
|
|
from collections.abc import Mapping, Sequence
|
|
from typing import Any
|
|
|
|
|
|
def redundant(entry: Mapping[str, str]) -> bool:
|
|
"""Whether the sweep drops this row as coverage an earlier row already has."""
|
|
if entry["priority"] == "true":
|
|
return False
|
|
return entry["clone"] == "true" or entry["covered"] != "0"
|
|
|
|
|
|
def _carries_guide(
|
|
app: str,
|
|
variant: str,
|
|
variants_per_app: Mapping[str, Sequence[Mapping[str, Any]]] | None,
|
|
) -> bool:
|
|
"""Whether *app*'s *variant* switches the guide host on."""
|
|
variants = (variants_per_app or {}).get(app) or []
|
|
if not variant.isdigit() or int(variant) >= len(variants):
|
|
return False
|
|
services = (variants[int(variant)] or {}).get("services") or {}
|
|
return (services.get(GUIDE_SERVICE_KEY) or {}).get("enabled") is True
|
|
|
|
|
|
def mark(
|
|
entries: list[dict[str, str]],
|
|
variants_per_app: Mapping[str, Sequence[Mapping[str, Any]]] | None,
|
|
) -> list[dict[str, str]]:
|
|
"""Hand one entry per role the replay.
|
|
|
|
Only the first entry of the chosen variant: a priority row runs every mode
|
|
and network mode it offers, and replaying the same README block in each of
|
|
them proves nothing the first replay did not.
|
|
|
|
The row has to run in the guide's own mode. The replay is a second deploy
|
|
on the same runner, so hanging it on a swarm row would ask that runner to
|
|
bring a compose stack up beside a swarm one.
|
|
"""
|
|
marked: set[str] = set()
|
|
for entry in entries:
|
|
app = entry["apps"]
|
|
if app in marked or redundant(entry):
|
|
continue
|
|
mode = guide_deployable(app)
|
|
if not mode or entry["mode"] != mode:
|
|
continue
|
|
if not _carries_guide(app, entry["variant"], variants_per_app):
|
|
continue
|
|
entry["instructions"] = mode
|
|
marked.add(app)
|
|
return entries
|