mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 4.7
d3afe0bc81
Hard-coded self-path references rot the moment the file moves: a header
comment ``# utils/foo/bar.py`` at the top of a module, a docstring
mentioning ``utils/foo/bar.py``, or a docs entry linking
``utils/foo/bar.py`` from inside ``utils/foo/bar.py`` itself all silently
desync from reality after the next ``git mv``.
The new lint walks every project file, computes its POSIX-style relative
path from PROJECT_ROOT, and reports any line whose text contains that
path as a substring. Files at the repo root (no ``/`` in their relative
path) and setuptools-generated ``*.egg-info/`` artefacts are exempt.
Per-line opt-out via ``# nocheck: self-path-reference`` on the offending
line, registered in the suppression catalog.
Existing offenders cleaned up:
- 72 redundant ``# <self-path>`` header lines removed across roles,
cli, plugins, scripts, tests, and utils.
- 4 prometheus templates that told consumers to "update
<self-template-path>" rewritten to drop the redundant self-reference.
- 8 docstring/comment self-references in cli, plugins, tests, utils,
and the dashboard oidc.js.j2 header rewritten to describe the layout
without naming the file's own path.
- 17 legitimate usage examples (shell scripts, test data lists, one
template self-include doc-block) marked with ``nocheck:
self-path-reference``.
- ``container.sh`` heredoc usage strings switched to ``${0}`` so the
marker stays out of the user-visible help output.
- ``healthcheck/http.yml.j2`` doc-block rewritten to prose because
``{# ... #}`` Jinja comments cannot host an inner ``{# nocheck #}``
(the inner ``#}`` closes the outer comment).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
56 lines
1.8 KiB
Bash
Executable File
56 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Resolve the effective WHITELIST that the discover step should pass to
|
|
# scripts/github/output_apps.sh, and write it to GITHUB_OUTPUT.
|
|
#
|
|
# Inputs via env:
|
|
# INPUT_WHITELIST caller-provided whitelist (space-separated).
|
|
# Three cases, in this order of precedence:
|
|
# * "__ALL__" (sentinel, case-insensitive): force
|
|
# full deploy across the workflow's scope. Skips
|
|
# the diff logic and emits an empty whitelist.
|
|
# * any other non-empty value: used verbatim.
|
|
# * empty: trigger the diff-based derivation.
|
|
#
|
|
# Output (GITHUB_OUTPUT):
|
|
# whitelist=<value> effective whitelist. An empty string means
|
|
# "no restriction; deploy everything in scope".
|
|
#
|
|
# Diff logic (only when INPUT_WHITELIST is empty):
|
|
# 1. Run scripts/meta/resolve/diff/affected_roles.sh.
|
|
# 2. If it returns "__ALL__", emit empty whitelist.
|
|
# 3. Otherwise emit the resolved (transitively expanded) role list.
|
|
|
|
set -euo pipefail
|
|
|
|
: "${GITHUB_OUTPUT:?Missing GITHUB_OUTPUT}"
|
|
|
|
input="${INPUT_WHITELIST:-}"
|
|
input_trimmed="${input//[[:space:]]/}"
|
|
|
|
shopt -s nocasematch
|
|
if [[ "${input_trimmed}" == "__ALL__" ]]; then
|
|
shopt -u nocasematch
|
|
printf 'whitelist=\n' >>"${GITHUB_OUTPUT}"
|
|
echo "Caller forced full deploy via '__ALL__' sentinel."
|
|
exit 0
|
|
fi
|
|
shopt -u nocasematch
|
|
|
|
if [[ -n "${input_trimmed}" ]]; then
|
|
printf 'whitelist=%s\n' "${input}" >>"${GITHUB_OUTPUT}"
|
|
echo "Using caller-supplied whitelist: ${input}"
|
|
exit 0
|
|
fi
|
|
|
|
resolved="$(./scripts/meta/resolve/diff/affected_roles.sh)"
|
|
|
|
if [[ "${resolved}" == "__ALL__" ]]; then
|
|
printf 'whitelist=\n' >>"${GITHUB_OUTPUT}"
|
|
echo "Diff vs origin/main implies full deploy (no whitelist)."
|
|
exit 0
|
|
fi
|
|
|
|
printf 'whitelist=%s\n' "${resolved}" >>"${GITHUB_OUTPUT}"
|
|
echo "Diff-derived whitelist: ${resolved}"
|