mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 11:46:35 +00:00
kevinveenbirkenbachandClaude Opus 4.8
fc77d9d265
Resolve the 80 open CodeQL/code-scanning alerts on this branch. Security-sensitive fixes: - cli/administration/deploy/development: break the unsafe import cycle by extracting the env/arg helpers into a leaf module `env.py`, giving the load-time DAG compose -> common -> deps -> env. - web-app-bluesky login-broker server.js: prototype-pollution guard on cookie parsing, CR/LF + control-char log sanitisation, HTML-escaped exception text, and a ReDoS-bounded handle regex. - web-app-baserow SSO: harden the open-redirect `next` handling. - network diagnose probes: require TLS >= 1.2. - actionlint installer: validate tar members against path traversal. - decidim/apt-purge lint regexes: rewrite to avoid catastrophic backtracking. - 6x Playwright URL regexes anchored; crs-k/stale-branches pinned to a commit SHA. Mechanical cleanups: unused imports/globals/locals, empty-except comments, import-and-import-from, implicit-string-concat, multiple-definition, unreachable/useless-assignment. False positives are intentionally left in place (Django settings patches, Odoo __manifest__, side-effect imports, cross-module symbols). Recurrence guards: - import-linter contract (pyproject + tests/lint) locks the dev-deploy package acyclic; a new cycle now fails CI instead of only CodeQL. - new lint test requires every bandit (S###) `noqa` to carry a justification. - BLE001 (blind-except) added to ruff as a ratchet (tests/roles exempt, current production offenders grandfathered). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
55 lines
1.7 KiB
Python
55 lines
1.7 KiB
Python
from __future__ import annotations
|
|
|
|
import os
|
|
from typing import TYPE_CHECKING
|
|
|
|
from . import PROJECT_ROOT
|
|
from .deps import apps_with_deps, resolve_run_after
|
|
from .env import resolve_distro
|
|
|
|
if TYPE_CHECKING:
|
|
from .compose import Compose
|
|
|
|
|
|
# Mirrors INFINITO_INVENTORY_VARS_FILE from default.env; drift-guarded.
|
|
DEV_INVENTORY_VARS_FILE: str = (
|
|
os.environ.get("INFINITO_INVENTORY_VARS_FILE")
|
|
or "inventories/development/default.yml"
|
|
)
|
|
|
|
|
|
def resolve_container() -> str:
|
|
"""Return INFINITO_CONTAINER; raise SystemExit if unset."""
|
|
container = os.environ["INFINITO_CONTAINER"].strip()
|
|
if not container:
|
|
raise SystemExit(
|
|
"INFINITO_CONTAINER is not set. Run 'make dotenv' (or source scripts/meta/env/load.sh) "
|
|
"before invoking cli.administration.deploy.development."
|
|
)
|
|
return container
|
|
|
|
|
|
def make_compose() -> Compose:
|
|
from .compose import Compose
|
|
|
|
distro = resolve_distro()
|
|
# Surface env-script gap here rather than as a cryptic compose error later.
|
|
resolve_container()
|
|
return Compose(repo_root=PROJECT_ROOT, distro=distro)
|
|
|
|
|
|
def resolve_deploy_ids_for_app(compose: Compose, app_id: str) -> list[str]:
|
|
deps = resolve_run_after(compose, app_id)
|
|
return apps_with_deps(app_id, deps_role_names=deps)
|
|
|
|
|
|
def resolve_deploy_ids_for_apps(compose: Compose, app_spec: str) -> list[str]:
|
|
"""Resolve deploy ids for one or more space- or comma-separated app ids."""
|
|
app_ids = [a.strip() for a in app_spec.replace(",", " ").split() if a.strip()]
|
|
result: list[str] = []
|
|
for app_id in app_ids:
|
|
for dep in resolve_deploy_ids_for_app(compose, app_id):
|
|
if dep not in result:
|
|
result.append(dep)
|
|
return result
|