coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Verify domain definition projection against pinned frontend source
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 20s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e241-8285-7a63-8c0c-51c9cb824dc3
This commit is contained in:
tegwick 2026-09-27 15:26:04 +02:00
parent c12a8fbcfb
commit 68063cc57a
4 changed files with 42 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

22
scripts/render_gitops.py
View file

@ -1,5 +1,9 @@
"""Render only the reviewed application resource set, excluding jobs and custody."""
import argparse
import hashlib
import json
import re
import urllib.request
from pathlib import Path
import yaml
ROOT=Path(__file__).resolve().parents[1]
@ -22,9 +26,25 @@ def render():
if d['metadata'].get('namespace')!='activity-core': raise ValueError('namespace outside grant')
selected.append(d)
return '# Generated by scripts/render_gitops.py; do not edit directly.\n'+'---\n'.join(yaml.dump(d,Dumper=Dumper,sort_keys=False) for d in selected)
def verify_frontend(source_dir=None):
pin=json.loads((ROOT/'k8s/gitops/frontend-source.json').read_text())
names={f'frontend-patterns-{mode}.md' for mode in ('daily','weekly','monthly')}
if pin.get('schema_version')!=1 or pin.get('repository')!='coulomb/frontend-patterns' or set(pin['files'])!=names or not re.fullmatch('[0-9a-f]{40}',pin['revision']):
raise ValueError('invalid frontend source pin')
cm=next(d for d in yaml.safe_load_all(render()) if d['metadata']['name']=='actcore-external-activity-definitions')
for name,digest in pin['files'].items():
if source_dir is None:
url=f"https://forgejo.coulomb.social/coulomb/frontend-patterns/raw/commit/{pin['revision']}/activity-definitions/{name}"
with urllib.request.urlopen(url,timeout=10) as response: body=response.read(32769)
else: body=(Path(source_dir)/name).read_bytes()
if len(body)>32768 or hashlib.sha256(body).hexdigest()!=digest or cm['data'][name].encode()!=body:
raise ValueError('frontend definition projection mismatch: '+name)
if __name__=='__main__':
parser=argparse.ArgumentParser(); parser.add_argument('--check',action='store_true'); args=parser.parse_args()
parser=argparse.ArgumentParser(); parser.add_argument('--check',action='store_true'); parser.add_argument('--verify-frontend',action='store_true'); args=parser.parse_args()
path=ROOT/'k8s/gitops/runtime.yaml'; text=render()
if args.check:
if path.read_text()!=text: raise SystemExit('GitOps projection stale; run scripts/render_gitops.py')
else: path.write_text(text)
if args.verify_frontend: verify_frontend()