57 lines
3.1 KiB
Python
57 lines
3.1 KiB
Python
|
"""Integrate three exact reviewed source patches. No commit, deploy or admission."""
|
||
|
|
from datetime import datetime, timezone
|
||
|
|
import hashlib
|
||
|
|
import json
|
||
|
|
from pathlib import Path
|
||
|
|
import subprocess
|
||
|
|
|
||
|
|
ROOT = Path(__file__).resolve().parent
|
||
|
|
TARGETS = (
|
||
|
|
("glas-harness", "agent-isolation", "glas-harness.patch",
|
||
|
|
"83eeeb0017603aabae0ff49a23f96248f677f6c9f3e2c01b22f6d0416fca69c7",
|
||
|
|
"dc88f302044c7c2b41795958527e64be8a83e3ab"),
|
||
|
|
("railiance-platform", "protected-execution-wave2", "platform-native-fixture.patch",
|
||
|
|
"c419ac0f6dba3e36f15dc51a6a36fbd87fe7d255cce40c33c7f4589d80355580",
|
||
|
|
"69a792c070238273acd9a989e2707072a5ef55ed"),
|
||
|
|
("secrets-engine", "decision-auth", "implementation-r2.patch",
|
||
|
|
"98c4300c42fe93759a55297fe6629f1d4aeed249c3625f7fd37c8ab523a08ca9",
|
||
|
|
"6bd7129eac94131b4cf689e47cbdc9899418beb3"),
|
||
|
|
)
|
||
|
|
|
||
|
|
|
||
|
|
def main():
|
||
|
|
prepared = []
|
||
|
|
for repo, part, patch_name, expected_patch, expected_head in TARGETS:
|
||
|
|
owner, folder = Path("/home/worsch") / repo, ROOT / part
|
||
|
|
patch = folder / patch_name
|
||
|
|
assert hashlib.sha256(patch.read_bytes()).hexdigest() == expected_patch, repo
|
||
|
|
head = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=owner, text=True).strip()
|
||
|
|
assert head == expected_head, f"owner revision changed: {repo}"
|
||
|
|
if repo == "glas-harness":
|
||
|
|
manifest = json.loads((folder / "source-manifest.json").read_text())
|
||
|
|
files = {item["path"]: item["candidate_sha256"] for item in manifest["changes"]}
|
||
|
|
elif repo == "railiance-platform":
|
||
|
|
files = json.loads((folder / "manifest.json").read_text())["files_sha256"]
|
||
|
|
else:
|
||
|
|
files = json.loads((folder / "reviewed-r2-file-hashes.json").read_text())
|
||
|
|
assert not subprocess.check_output(["git", "diff", "HEAD", "--", *files], cwd=owner), f"target files dirty: {repo}"
|
||
|
|
for name in files:
|
||
|
|
tracked = subprocess.run(["git", "ls-files", "--error-unmatch", name], cwd=owner, capture_output=True).returncode == 0
|
||
|
|
assert tracked or not (owner / name).exists(), f"untracked target collision: {repo}/{name}"
|
||
|
|
subprocess.run(["git", "apply", "--check", str(patch)], cwd=owner, check=True)
|
||
|
|
prepared.append((repo, owner, folder, patch, expected_patch, head, files))
|
||
|
|
for repo, owner, folder, patch, patch_hash, head, files in prepared:
|
||
|
|
subprocess.run(["git", "apply", str(patch)], cwd=owner, check=True)
|
||
|
|
for name, expected in files.items():
|
||
|
|
assert hashlib.sha256((owner / name).read_bytes()).hexdigest() == expected, f"integrated file differs: {repo}/{name}"
|
||
|
|
receipt = {"repo": repo, "base_commit": head, "patch_sha256": patch_hash,
|
||
|
|
"integrated_at": datetime.now(timezone.utc).isoformat(), "files_sha256": files,
|
||
|
|
"source_integrated": True, "committed": False, "published": False,
|
||
|
|
"native_accepted": False}
|
||
|
|
(folder / "canonical-integration.json").write_text(json.dumps(receipt, indent=2) + "\n")
|
||
|
|
print(f"{repo}: {len(files)} exact reviewed source files integrated")
|
||
|
|
|
||
|
|
|
||
|
|
if __name__ == "__main__":
|
||
|
|
main()
|