mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 03:38:23 +00:00
kevinveenbirkenbachandClaude Opus 5
36cd39533a
The pipeline gate only listed twelve of seventeen jobs in its needs, leaving out wait-fork-prereq-run, fork-prereqs-ready, build-ci-images, images-mirror-missing and test-dns. A failure in any of them turns its dependents into skipped rather than failure, and the gate's check matches only failure and cancelled, so the run would have concluded green without images ever being built. A caller-supplied whitelist was also passed through verbatim. Run 30492550883 was dispatched with web-app-prometheu; discovery dropped the unknown id without a warning, the empty resolution became [], the deploy workflows skipped their whole matrix on that condition and the parent job still concluded success. Validate every id against roles/<id> and exit naming the offenders, so a typo cannot quietly remove an application from a run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
65 lines
2.2 KiB
Bash
Executable File
65 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Resolve the effective INFINITO_WHITELIST that the discover step should pass to
|
|
# scripts/github/resolve/output_apps.sh, and write it to GITHUB_OUTPUT.
|
|
#
|
|
# Inputs via env:
|
|
# INPUT_WHITELIST caller-provided whitelist (space-separated).
|
|
# Three cases, in this order of precedence:
|
|
# * "__ALL__" (sentinel, case-insensitive): force
|
|
# full deploy across the workflow's scope. Skips
|
|
# the diff logic and emits an empty whitelist.
|
|
# * any other non-empty value: used verbatim.
|
|
# * empty: trigger the diff-based derivation.
|
|
#
|
|
# Output (GITHUB_OUTPUT):
|
|
# whitelist=<value> effective whitelist. An empty string means
|
|
# "no restriction; deploy everything in scope".
|
|
#
|
|
# Diff logic (only when INPUT_WHITELIST is empty):
|
|
# 1. Run scripts/meta/resolve/diff/affected_roles.sh.
|
|
# 2. If it returns "__ALL__", emit empty whitelist.
|
|
# 3. Otherwise emit the resolved (transitively expanded) role list.
|
|
|
|
set -euo pipefail
|
|
|
|
: "${GITHUB_OUTPUT:?Missing GITHUB_OUTPUT}"
|
|
|
|
input="${INPUT_WHITELIST:-}"
|
|
input_trimmed="${input//[[:space:]]/}"
|
|
|
|
shopt -s nocasematch
|
|
if [[ "${input_trimmed}" == "__ALL__" ]]; then
|
|
shopt -u nocasematch
|
|
printf 'whitelist=\n' >>"${GITHUB_OUTPUT}"
|
|
echo "Caller forced full deploy via '__ALL__' sentinel."
|
|
exit 0
|
|
fi
|
|
shopt -u nocasematch
|
|
|
|
if [[ -n "${input_trimmed}" ]]; then
|
|
unknown=()
|
|
for role in ${input}; do
|
|
[[ -d "roles/${role}" ]] || unknown+=("${role}")
|
|
done
|
|
if ((${#unknown[@]})); then
|
|
echo "[ERROR] Unknown role id(s) in the caller-supplied whitelist: ${unknown[*]}" >&2
|
|
echo "[ERROR] They match no directory under roles/, so they would be dropped silently and never deployed." >&2
|
|
exit 1
|
|
fi
|
|
printf 'whitelist=%s\n' "${input}" >>"${GITHUB_OUTPUT}"
|
|
echo "Using caller-supplied whitelist: ${input}"
|
|
exit 0
|
|
fi
|
|
|
|
resolved="$(./scripts/meta/resolve/diff/affected_roles.sh)"
|
|
|
|
if [[ "${resolved}" == "__ALL__" ]]; then
|
|
printf 'whitelist=\n' >>"${GITHUB_OUTPUT}"
|
|
echo "Diff vs origin/main implies full deploy (no whitelist)."
|
|
exit 0
|
|
fi
|
|
|
|
printf 'whitelist=%s\n' "${resolved}" >>"${GITHUB_OUTPUT}"
|
|
echo "Diff-derived whitelist: ${resolved}"
|