0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-09 20:26:33 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.7 f67b913a4b feat(swarm): swarm-aware deploy CLI with inventory-derived dep closure

New ``cli.administration.deploy.swarm`` package wraps the strict
``cli.administration.deploy.dedicated`` runner with a layered closure
so swarm deploys never require operators (or test scripts) to
enumerate every infra role:

  effective --id = seed (operator --id, else inventory_role_groups)
                ∪ dep-walk(seed via applications_if_group_and_all_deps)
                ∪ default-placement safety net

The dep-walker is the same SPOT
(``utils.roles.applications.in_group_deps.applications_if_group_and_all_deps``)
the runtime constructor consumes via ``lookup('applications_current_play')``,
so the CLI-side closure and the in-play role set stay in sync.

The dedicated CLI keeps strict explicit-only semantics: ``main`` was
split into ``parse_args`` + ``run_from_args`` so the swarm wrapper
can share parser, mode wiring, validator and runner verbatim and
only mutate ``args.id``.

Meta-side: ``svc-db-postgres`` gains ``default_placement: manager``
(semantic symmetry with mariadb). ``default_placement`` is now a
PLACEMENT hint only ("if deployed, run on the manager"); deploy
decisions come from the dep-walk. Apps that declare ``mariadb:``
pull svc-db-mariadb; apps that declare ``postgres:`` pull
svc-db-postgres; apps that declare neither get no central DB.

Shared utils extracted so the four consumers stay aligned:
  * ``utils.inventory.groups.inventory_has_group``: YAML + INI static
    inventory group probe (extracted from ValidDeployId).
  * ``utils.roles.meta_lookup.{get_role_default_placement,
    iter_roles_with_default_placement}``: single source of truth for
    ``default_placement`` discovery (lookup plugin is now a thin wrapper).

Test pipeline (``scripts/tests/deploy/swarm/*``):
  * Heredoc-Python shells converted to proper modules under
    ``utils.tests.swarm.*`` and invoked via ``python -m``:
      - extend_inventory.py (was 08_extend_inventory.sh)
      - write_extras.py     (was 09_write_extras.sh dynamic half)
      - derive_includes.py  (replaces 06's hardcoded includes array)
      - write_hosts_entries.py (replaces 02's hardcoded /etc/hosts heredoc;
        derives every canonical + www-redirect domain from APP_ID via
        canonical_domains_map + generate_all_domains, so the test
        works for any app in the matrix without per-app maintenance)
  * 01_create_network.sh deleted (single docker command inlined in workflow).
  * 11_deploy.sh deleted (swarm CLI now called directly in workflow).
  * 09_write_extras.sh: static half moved to inventories/development/swarm.yml.
  * Remaining shell scripts renumbered 01-13 without gaps.
  * 08_wait_converge.sh: case block on DB_DEP replaced with single
    conditional (container name == DB_DEP).
  * 06_provision_inventory.sh: hardcoded includes array replaced with
    `mapfile -t includes < <(python -m utils.tests.swarm.derive_includes)`.
  * Workflow YAML step references updated to new script names + module
    invocations.

New tests (39 covering the closure surface):
  * tests/unit/cli/administration/deploy/swarm/test_closure.py (14)
  * tests/unit/utils/inventory/test_groups.py (11)
  * tests/unit/utils/roles/test_meta_lookup.py (+3 for default_placement)
  * tests/unit/utils/roles/validation/test_deploy_id.py (unchanged
    8 tests still pass after refactor onto the shared util).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-06-05 02:24:51 +02:00

__init__.py

…

deploy_id.py

feat(swarm): swarm-aware deploy CLI with inventory-derived dep closure

2026-06-05 02:24:51 +02:00

invokable.py

Merge branch 'main' into feature/req-21-sso-flavor-migration

2026-05-27 18:24:00 +02:00

README.md

…

resources.py

chore(ruff): enable TC + N rules

2026-05-08 18:57:07 +02:00

README.md

Role Validation Helpers ✅

Validators that gate role inputs and outputs against project rules.

Scope 📋

Modules in utils/roles/validation/ MUST limit themselves to checking that role artefacts and their derived names obey the constraints documented in docs/contributing/: legal application identifiers, deployment-target invokability, container resource shape.

Validators MUST raise typed exceptions (or return the offending value with a clear message) so callers can surface the failure at the right layer (CLI exit code, lint test failure, runtime assertion).

Validators MUST stay independent of Ansible plugin loader behavior at import time so the same code runs from filter plugins, lookup plugins, the CLI, and tests.

Modules 📦

Module	Validates
deploy_id.py	Application id strings against the canonical `<bucket>-<entity>` shape and the active deploy-id grammar.
invokable.py	Whether an application can legitimately be invoked under a given deployment type (e.g. `server`, `workstation`, `universal`).
resources.py	Container resource declarations (`cpus`, `mem_reservation`, `mem_limit`, `pids_limit`) for shape and unit consistency.

Example Imports ✍️

from utils.roles.validation.deploy_id import validate_deploy_id
from utils.roles.validation.invokable import is_invokable_for
from utils.roles.validation.resources import validate_resource_block