claude-hdb
a10349d835
Public tool, private state. cast holds no hostnames, no bindings, no secrets: it joins a product repo's .infra/ manifest with a state directory you point it at, and makes Coolify match. Extracted from heavy-duty/infra, which was half tool and half state — the inconsistency that made it impossible to say whether "infra" named a CLI or a runbook. rig builds the boxes; cast fills them; infra is what they are filled with. Two changes were required to make it genuinely stateless and publishable: - The implicit cwd contract (environments.yaml / secrets/ / .coolify.env resolved against the working directory, silently reading the wrong file from the wrong place) is now an explicit --state <dir> / $CAST_STATE. - BANNED_IN_PROD — a hardcoded list of one product's ALLOW_* flags, the only product knowledge in the executor — becomes the generic, operator- owned environments.<env>.forbidden_var_patterns. The guard now lives in private state, so a product-side change cannot lower its own guard, and it is a pattern rather than a list, so it catches unforeseen siblings. Age identities resolve as $CAST_AGE_KEY_FILE_<ENV> then ~/.config/cast/age-<env>.key — which is the entire attended-vs-unattended apply mechanism, with no environment names known to the tool. Instance identity (org names, the GitHub App name, founder domains) is out of the fixtures and out of register-github-app.sh, which took APP_NAME and ORG as arguments rather than baking them in. 69 tests green; bin/cast + curl installer mirror rig's shape. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
35 lines
992 B
TypeScript
35 lines
992 B
TypeScript
import { execFileSync } from "node:child_process";
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
function runCli(args: string[]): { code: number; output: string } {
|
|
try {
|
|
const output = execFileSync("node", ["dist/cli.js", ...args], {
|
|
encoding: "utf8",
|
|
stdio: "pipe",
|
|
});
|
|
return { code: 0, output };
|
|
} catch (e) {
|
|
const err = e as { status: number; stderr: string; stdout: string };
|
|
return { code: err.status, output: `${err.stdout}${err.stderr}` };
|
|
}
|
|
}
|
|
|
|
describe("infra cli", () => {
|
|
it("refuses apply --path with --env prod, exit non-zero", () => {
|
|
const r = runCli([
|
|
"apply",
|
|
"acme/widget",
|
|
"--env",
|
|
"prod",
|
|
"--path",
|
|
"/tmp/x",
|
|
]);
|
|
expect(r.code).not.toBe(0);
|
|
expect(r.output).toMatch(/--path.*prod/);
|
|
});
|
|
it("prints usage on unknown command", () => {
|
|
const r = runCli(["frobnicate"]);
|
|
expect(r.code).not.toBe(0);
|
|
expect(r.output).toMatch(/usage: cast (apply|diff)/i);
|
|
});
|
|
});
|