35 lines
2.3 KiB
Python
35 lines
2.3 KiB
Python
"""Apply reviewed owner sources only; unrelated work and index stay intact."""
|
|
from pathlib import Path
|
|
import argparse,hashlib,json,subprocess
|
|
base=Path(__file__).resolve().parent
|
|
handoffs=base.parent/'netkingdom-target-2026-10-16/recovery-owner-handoffs-r1'
|
|
p=argparse.ArgumentParser();p.add_argument('lane',choices=['cluster','secrets','sops']);args=p.parse_args()
|
|
if args.lane=='sops':
|
|
manifest=json.loads((base/'sops-fd-r2/manifest.json').read_text());owner='net-kingdom'
|
|
revision=manifest['owner_base'];patch=base/'sops-fd-r2/source.patch';pin=manifest['patch_sha256']
|
|
expected={e['path']:e['after_sha256'] for e in manifest['files']}
|
|
pre={e['path']:e['before_sha256'] for e in manifest['files']}
|
|
else:
|
|
review=json.loads((handoffs/'owner-handoff-review.json').read_text());owner='railiance-cluster' if args.lane=='cluster' else 'secrets-engine'
|
|
revision=review['owners'][owner]['baseline_head'];expected=review['owners'][owner]['paths'];pre={k:None for k in expected}
|
|
patch=handoffs/(owner+'.patch');pin=review['patches'][owner]
|
|
root=Path('/home/worsch')/owner
|
|
def sha(path):return 'sha256:'+hashlib.sha256(path.read_bytes()).hexdigest()
|
|
def git(*args):return subprocess.check_output(['git','-C',str(root),*args],stderr=subprocess.PIPE)
|
|
assert git('rev-parse','HEAD').decode().strip()==revision
|
|
assert sha(patch)==pin
|
|
paths=[s[6:] for s in patch.read_text().splitlines() if s.startswith('+++ b/')]
|
|
assert set(paths)==set(expected)
|
|
for rel in paths:
|
|
assert not Path(rel).is_absolute() and '..' not in Path(rel).parts
|
|
assert not git('status','--porcelain','--',rel).strip()
|
|
assert (sha(root/rel) if (root/rel).exists() else None)==pre[rel]
|
|
before_index=git('ls-files','--stage','--','.custodian-brief.md')
|
|
before_brief=(root/'.custodian-brief.md').read_bytes()
|
|
git('apply','--check',str(patch));git('apply',str(patch))
|
|
for rel,pin in expected.items():assert sha(root/rel)==pin
|
|
assert git('ls-files','--stage','--','.custodian-brief.md')==before_index
|
|
assert (root/'.custodian-brief.md').read_bytes()==before_brief
|
|
out={'owner':owner,'base_revision':revision,'applied':True,'files':expected,'preexisting_brief_preserved':True,'native_acceptance':False}
|
|
(base/(args.lane+'-integration.json')).write_text(json.dumps(out,indent=2)+'\n')
|
|
print(json.dumps({'owner':owner,'applied':True,'files':len(paths)}))
|