claude-hdb
a10349d835
Public tool, private state. cast holds no hostnames, no bindings, no secrets: it joins a product repo's .infra/ manifest with a state directory you point it at, and makes Coolify match. Extracted from heavy-duty/infra, which was half tool and half state — the inconsistency that made it impossible to say whether "infra" named a CLI or a runbook. rig builds the boxes; cast fills them; infra is what they are filled with. Two changes were required to make it genuinely stateless and publishable: - The implicit cwd contract (environments.yaml / secrets/ / .coolify.env resolved against the working directory, silently reading the wrong file from the wrong place) is now an explicit --state <dir> / $CAST_STATE. - BANNED_IN_PROD — a hardcoded list of one product's ALLOW_* flags, the only product knowledge in the executor — becomes the generic, operator- owned environments.<env>.forbidden_var_patterns. The guard now lives in private state, so a product-side change cannot lower its own guard, and it is a pattern rather than a list, so it catches unforeseen siblings. Age identities resolve as $CAST_AGE_KEY_FILE_<ENV> then ~/.config/cast/age-<env>.key — which is the entire attended-vs-unattended apply mechanism, with no environment names known to the tool. Instance identity (org names, the GitHub App name, founder domains) is out of the fixtures and out of register-github-app.sh, which took APP_NAME and ORG as arguments rather than baking them in. 69 tests green; bin/cast + curl installer mirror rig's shape. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
66 lines
2.2 KiB
TypeScript
66 lines
2.2 KiB
TypeScript
import type { CoolifyClient } from "./coolify.js";
|
|
|
|
export async function smoke(
|
|
client: CoolifyClient,
|
|
targetAppUuid: string,
|
|
): Promise<void> {
|
|
const KEEP_KEY = "INFRA_SMOKE_KEEP";
|
|
const PROBE_KEY = "INFRA_SMOKE_PROBE";
|
|
const envsPath = `/applications/${targetAppUuid}/envs`;
|
|
type EnvVar = {
|
|
key: string;
|
|
value: string;
|
|
is_buildtime?: boolean;
|
|
uuid: string;
|
|
};
|
|
const readEnvs = async (): Promise<EnvVar[]> =>
|
|
(await client.get(envsPath)) as EnvVar[];
|
|
|
|
// First var goes in via the singular envs endpoint — this is the
|
|
// never-delete canary the bulk write below must not disturb.
|
|
await client.post(envsPath, {
|
|
key: KEEP_KEY,
|
|
value: "1",
|
|
is_buildtime: false,
|
|
is_preview: false,
|
|
});
|
|
|
|
// Second var goes in via the bulk endpoint (the one apply's syncEnv uses,
|
|
// see cli.ts) with a payload containing ONLY the second var. The bulk
|
|
// envs endpoint is documented/verified as UPSERT-only (never deletes
|
|
// unlisted keys) — that's the load-bearing guarantee behind the iron rule
|
|
// that apply never deletes. If a Coolify upgrade regresses it to
|
|
// full-replace, KEEP_KEY will vanish from the read-back below.
|
|
await client.patch(`${envsPath}/bulk`, {
|
|
data: [
|
|
{
|
|
key: PROBE_KEY,
|
|
value: "1",
|
|
is_buildtime: false,
|
|
is_preview: false,
|
|
},
|
|
],
|
|
});
|
|
|
|
const envs = await readEnvs();
|
|
const keep = envs.find((e) => e.key === KEEP_KEY);
|
|
const probe = envs.find((e) => e.key === PROBE_KEY);
|
|
|
|
if (!keep) {
|
|
// Clean up whatever did survive before failing loudly.
|
|
if (probe) await client.delete_(`${envsPath}/${probe.uuid}`);
|
|
throw new Error(
|
|
"smoke FAIL: bulk env write is destructive (full-replace) — never-delete broken; do not apply with this Coolify version",
|
|
);
|
|
}
|
|
if (!probe) throw new Error("smoke FAIL: probe var not readable back");
|
|
if (probe.is_buildtime !== false) {
|
|
throw new Error(
|
|
`smoke FAIL: is_buildtime round-trip broken (got ${probe.is_buildtime}) — Coolify upgrade regression?`,
|
|
);
|
|
}
|
|
|
|
await client.delete_(`${envsPath}/${keep.uuid}`);
|
|
await client.delete_(`${envsPath}/${probe.uuid}`);
|
|
console.log(`smoke OK against Coolify ${await client.version()}`);
|
|
}
|