mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 4.8
fc77d9d265
Resolve the 80 open CodeQL/code-scanning alerts on this branch. Security-sensitive fixes: - cli/administration/deploy/development: break the unsafe import cycle by extracting the env/arg helpers into a leaf module `env.py`, giving the load-time DAG compose -> common -> deps -> env. - web-app-bluesky login-broker server.js: prototype-pollution guard on cookie parsing, CR/LF + control-char log sanitisation, HTML-escaped exception text, and a ReDoS-bounded handle regex. - web-app-baserow SSO: harden the open-redirect `next` handling. - network diagnose probes: require TLS >= 1.2. - actionlint installer: validate tar members against path traversal. - decidim/apt-purge lint regexes: rewrite to avoid catastrophic backtracking. - 6x Playwright URL regexes anchored; crs-k/stale-branches pinned to a commit SHA. Mechanical cleanups: unused imports/globals/locals, empty-except comments, import-and-import-from, implicit-string-concat, multiple-definition, unreachable/useless-assignment. False positives are intentionally left in place (Django settings patches, Odoo __manifest__, side-effect imports, cross-module symbols). Recurrence guards: - import-linter contract (pyproject + tests/lint) locks the dev-deploy package acyclic; a new cycle now fails CI instead of only CodeQL. - new lint test requires every bandit (S###) `noqa` to carry a justification. - BLE001 (blind-except) added to ruff as a ratchet (tests/roles exempt, current production offenders grandfathered). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
87 lines
2.8 KiB
Python
87 lines
2.8 KiB
Python
from __future__ import annotations
|
|
|
|
import os
|
|
import subprocess
|
|
from typing import TYPE_CHECKING
|
|
|
|
from . import PROJECT_ROOT
|
|
from .env import resolve_distro
|
|
|
|
if TYPE_CHECKING:
|
|
import argparse
|
|
|
|
|
|
def add_parser(sub: argparse._SubParsersAction) -> None:
|
|
p = sub.add_parser(
|
|
"build", help="Build infinito image using scripts/image/build.sh (SPOT)."
|
|
)
|
|
p.add_argument("--missing", action="store_true", help="Build only if missing.")
|
|
p.add_argument("--no-cache", action="store_true", help="Build with --no-cache.")
|
|
p.add_argument("--target", help="Dockerfile target (e.g. virgin).", default="")
|
|
p.add_argument("--tag", help="Override output tag.", default="")
|
|
p.add_argument("--push", action="store_true", help="Push image (buildx).")
|
|
p.add_argument(
|
|
"--publish", action="store_true", help="Publish semantic tags (implies --push)."
|
|
)
|
|
p.add_argument("--registry", default="", help="Registry (e.g. ghcr.io).")
|
|
p.add_argument("--owner", default="", help="Owner/namespace (e.g. org/user).")
|
|
p.add_argument(
|
|
"--repo-prefix",
|
|
default="",
|
|
help="Repo prefix (default: current repository name).",
|
|
)
|
|
p.add_argument("--version", default="", help="Version (required for --publish).")
|
|
p.add_argument(
|
|
"--stable", choices=["true", "false"], default="", help="Publish stable tags."
|
|
)
|
|
|
|
p.set_defaults(_handler=handler)
|
|
|
|
|
|
def handler(args: argparse.Namespace) -> int:
|
|
repo_root = PROJECT_ROOT
|
|
script = repo_root / "scripts" / "image" / "build.sh"
|
|
repository_name_script = (
|
|
repo_root / "scripts" / "meta" / "resolve" / "repository" / "name.sh"
|
|
)
|
|
|
|
env = dict(os.environ)
|
|
env["INFINITO_DISTRO"] = resolve_distro()
|
|
if not args.repo_prefix and not env.get("INFINITO_IMAGE_REPOSITORY"):
|
|
resolved_repo = subprocess.run(
|
|
[str(repository_name_script)],
|
|
cwd=repo_root,
|
|
env=env,
|
|
check=True,
|
|
capture_output=True,
|
|
text=True,
|
|
).stdout.strip()
|
|
env["INFINITO_IMAGE_REPOSITORY"] = resolved_repo
|
|
|
|
cmd: list[str] = [str(script)]
|
|
if args.missing:
|
|
cmd.append("--missing")
|
|
if args.no_cache:
|
|
cmd.append("--no-cache")
|
|
if args.target:
|
|
cmd += ["--target", args.target]
|
|
if args.tag:
|
|
cmd += ["--tag", args.tag]
|
|
if args.push:
|
|
cmd.append("--push")
|
|
if args.publish:
|
|
cmd.append("--publish")
|
|
if args.registry:
|
|
cmd += ["--registry", args.registry]
|
|
if args.owner:
|
|
cmd += ["--owner", args.owner]
|
|
if args.repo_prefix:
|
|
cmd += ["--repo-prefix", args.repo_prefix]
|
|
if args.version:
|
|
cmd += ["--version", args.version]
|
|
if args.stable:
|
|
cmd += ["--stable", args.stable]
|
|
|
|
r = subprocess.run(cmd, cwd=repo_root, env=env, check=False)
|
|
return int(r.returncode)
|