82 lines
4.5 KiB
Python
82 lines
4.5 KiB
Python
#!/usr/bin/env python3
|
|
"""ADVERSARY check6 — WC1.2 pre-deploy SAFETY gate (live, cold). A hold must do NO deploy.
|
|
(a) MAJOR fake tag 11.0.0+27.0.0 -> held-major, alert, kc untouched (TYPE same, 200)
|
|
(b) minor tag 10.7.2+26.6.3 + releaseNotes flagging manual migration -> held-manual-migration,
|
|
alert CARRIES the notes, kc untouched
|
|
Leaves the recipe + kc exactly as found (canonical, no fake tags/notes)."""
|
|
import json, os, subprocess, sys
|
|
sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
|
|
import warm_reconcile as wr
|
|
|
|
D = "warm-keycloak.ci.commoninternet.net"
|
|
RDIR = os.path.expanduser("~/.abra/recipes/keycloak")
|
|
GOOD = "04400df"; CANON = "10.7.1+26.6.2"
|
|
T_MAJOR = "11.0.0+27.0.0"; T_MINOR = "10.7.2+26.6.3"
|
|
NOTES = os.path.join(RDIR, "releaseNotes", T_MINOR + ".md")
|
|
ALERTS = os.path.join(wr.warmsnap.DEFAULT_WARM_ROOT, "alerts")
|
|
fails = []
|
|
|
|
def git(*a, check=True):
|
|
return subprocess.run(["git", "-C", RDIR, "-c", "user.email=adv@cc-ci", "-c", "user.name=adv", *a],
|
|
capture_output=True, text=True, check=check)
|
|
def reconcile():
|
|
env = {**os.environ, "CCCI_SKIP_FETCH": "1"}
|
|
r = subprocess.run(["python3", os.path.join(os.path.dirname(__file__), "warm_reconcile.py"), "keycloak"],
|
|
capture_output=True, text=True, env=env, timeout=300)
|
|
for line in r.stdout.splitlines():
|
|
if line.startswith("RECONCILE RESULT:"): return line.split(":", 1)[1].strip()
|
|
return f"<no result rc={r.returncode}> {r.stdout[-300:]} {r.stderr[-300:]}"
|
|
def alerts_now(): return set(os.listdir(ALERTS)) if os.path.isdir(ALERTS) else set()
|
|
|
|
type0, lg0 = wr.current_version(D), wr.read_last_good("keycloak")
|
|
print(f"START TYPE={type0} last_good={lg0} health={wr.health_code(wr.SPECS['keycloak'])}")
|
|
assert type0 == CANON, f"precond: kc not canonical ({type0})"
|
|
|
|
# (a) MAJOR -> held-major, no deploy
|
|
git("reset", "--hard", GOOD)
|
|
git("tag", "-a", "-m", "adv", T_MAJOR, GOOD + "^{commit}", check=False)
|
|
a0 = alerts_now()
|
|
res_a = reconcile()
|
|
new_a = sorted(alerts_now() - a0)
|
|
print(f"(a) MAJOR {T_MAJOR}: result={res_a!r} TYPE={wr.current_version(D)} new_alerts={new_a}")
|
|
if not res_a.startswith("held-major"): fails.append(f"(a) not held-major: {res_a}")
|
|
if wr.current_version(D) != CANON: fails.append(f"(a) kc TYPE changed to {wr.current_version(D)}")
|
|
hm = [x for x in new_a if "held-major" in x]
|
|
if not hm: fails.append("(a) no held-major alert")
|
|
else:
|
|
rec = json.load(open(os.path.join(ALERTS, hm[0])))
|
|
if rec.get("latest") != T_MAJOR: fails.append(f"(a) alert latest={rec.get('latest')}")
|
|
if "release_notes" not in rec: fails.append("(a) alert missing release_notes field")
|
|
git("tag", "-d", T_MAJOR, check=False)
|
|
|
|
# (b) minor + manual-migration notes -> held-manual-migration, no deploy, alert carries notes
|
|
git("tag", "-a", "-m", "adv", T_MINOR, GOOD + "^{commit}", check=False)
|
|
os.makedirs(os.path.dirname(NOTES), exist_ok=True)
|
|
open(NOTES, "w").write("# 10.7.2\n\nThis release requires a **manual migration**: run the DB upgrade by hand.\n")
|
|
b0 = alerts_now()
|
|
res_b = reconcile()
|
|
new_b = sorted(alerts_now() - b0)
|
|
print(f"(b) MINOR+migration {T_MINOR}: result={res_b!r} TYPE={wr.current_version(D)} new_alerts={new_b}")
|
|
if not res_b.startswith("held-manual-migration"): fails.append(f"(b) not held-manual-migration: {res_b}")
|
|
if wr.current_version(D) != CANON: fails.append(f"(b) kc TYPE changed to {wr.current_version(D)}")
|
|
hmm = [x for x in new_b if "manual-migration" in x]
|
|
if not hmm: fails.append("(b) no held-manual-migration alert")
|
|
else:
|
|
rec = json.load(open(os.path.join(ALERTS, hmm[0])))
|
|
if "manual migration" not in (rec.get("release_notes") or "").lower():
|
|
fails.append(f"(b) alert release_notes lacks the notes: {rec.get('release_notes')!r}")
|
|
|
|
# cleanup
|
|
git("tag", "-d", T_MINOR, check=False)
|
|
if os.path.exists(NOTES): os.remove(NOTES)
|
|
git("reset", "--hard", GOOD)
|
|
faketags = [t for t in git("tag").stdout.split() if t in (T_MAJOR, T_MINOR)]
|
|
print(f"END TYPE={wr.current_version(D)} last_good={wr.read_last_good('keycloak')} "
|
|
f"health={wr.health_code(wr.SPECS['keycloak'])} faketags={faketags} notes_exists={os.path.exists(NOTES)}")
|
|
if wr.current_version(D) != CANON: fails.append(f"END not canonical: {wr.current_version(D)}")
|
|
if faketags: fails.append(f"leftover fake tags {faketags}")
|
|
if wr.read_last_good("keycloak") != CANON: fails.append(f"last_good moved to {wr.read_last_good('keycloak')}")
|
|
|
|
print("\nRESULT:", "FAIL: " + "; ".join(fails) if fails else "PASS — WC1.2 holds major + manual-migration with notes-carrying alert; kc untouched (no deploy/last_good churn)")
|
|
sys.exit(1 if fails else 0)
|