339 lines
12 KiB
Ruby
339 lines
12 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require "fileutils"
|
|
require "json"
|
|
require "open3"
|
|
require "rubygems"
|
|
|
|
module OpenCodeCompat
|
|
class LockstepClientContract
|
|
class ContractError < StandardError; end
|
|
|
|
CONTRACT_NAME = "opencode-client-lockstep"
|
|
REQUIRED_ENV = %w[
|
|
OPENCODE_RUBY_PATH
|
|
OPENCODE_RUBY_COMMIT
|
|
OPENCODE_RUBY_TAG
|
|
OPENCODE_RUBY_TAG_OBJECT
|
|
OPENCODE_RUBY_VERSION
|
|
OPENCODE_RAILS_PATH
|
|
OPENCODE_RAILS_COMMIT
|
|
OPENCODE_RAILS_TAG
|
|
OPENCODE_RAILS_TAG_OBJECT
|
|
OPENCODE_RAILS_VERSION
|
|
].freeze
|
|
|
|
def self.from_environment(env: ENV, git_resolver: nil, git_head_resolver: nil)
|
|
require "bundler"
|
|
require "opencode-rails"
|
|
|
|
new(
|
|
env: env,
|
|
git_resolver: git_resolver,
|
|
git_head_resolver: git_head_resolver,
|
|
loaded_specs: Gem.loaded_specs,
|
|
bundle_specs: Bundler.load.specs,
|
|
runtime_ruby_version: RUBY_VERSION,
|
|
ruby_version: Opencode::VERSION,
|
|
rails_version: Opencode::RAILS_VERSION
|
|
)
|
|
end
|
|
|
|
def self.canonical_json(value)
|
|
JSON.generate(canonicalize(value))
|
|
end
|
|
|
|
def self.canonicalize(value)
|
|
case value
|
|
when Hash
|
|
value.keys.map(&:to_s).sort.to_h do |key|
|
|
source_key = value.key?(key) ? key : value.keys.find { |candidate| candidate.to_s == key }
|
|
[key, canonicalize(value.fetch(source_key))]
|
|
end
|
|
when Array
|
|
value.map { |entry| canonicalize(entry) }
|
|
else
|
|
value
|
|
end
|
|
end
|
|
private_class_method :canonicalize
|
|
|
|
def initialize(
|
|
env:,
|
|
loaded_specs:,
|
|
bundle_specs:,
|
|
ruby_version:,
|
|
rails_version:,
|
|
runtime_ruby_version: RUBY_VERSION,
|
|
git_resolver: nil,
|
|
git_head_resolver: nil
|
|
)
|
|
@env = env
|
|
@loaded_specs = loaded_specs
|
|
@bundle_specs = bundle_specs
|
|
@ruby_version = ruby_version.to_s
|
|
@rails_version = rails_version.to_s
|
|
@runtime_ruby_version = runtime_ruby_version.to_s
|
|
@git_resolver = git_resolver || method(:resolve_git)
|
|
@git_head_resolver = git_head_resolver
|
|
end
|
|
|
|
def verify
|
|
ensure_required_environment!
|
|
|
|
ruby_path = realpath("OPENCODE_RUBY_PATH")
|
|
rails_path = realpath("OPENCODE_RAILS_PATH")
|
|
ruby_commit = exact_commit("OPENCODE_RUBY_COMMIT")
|
|
rails_commit = exact_commit("OPENCODE_RAILS_COMMIT")
|
|
expected_ruby_version = exact_version("OPENCODE_RUBY_VERSION")
|
|
expected_rails_version = exact_version("OPENCODE_RAILS_VERSION")
|
|
|
|
assert_equal!(ruby_commit, checkout_head(ruby_path, "opencode-ruby"), "opencode-ruby checkout commit")
|
|
assert_equal!(rails_commit, checkout_head(rails_path, "opencode-rails"), "opencode-rails checkout commit")
|
|
ruby_tag_provenance = annotated_tag_provenance(
|
|
path: ruby_path,
|
|
label: "opencode-ruby",
|
|
tag_name: "OPENCODE_RUBY_TAG",
|
|
tag_object: "OPENCODE_RUBY_TAG_OBJECT",
|
|
expected_commit: ruby_commit
|
|
)
|
|
rails_tag_provenance = annotated_tag_provenance(
|
|
path: rails_path,
|
|
label: "opencode-rails",
|
|
tag_name: "OPENCODE_RAILS_TAG",
|
|
tag_object: "OPENCODE_RAILS_TAG_OBJECT",
|
|
expected_commit: rails_commit
|
|
)
|
|
assert_equal!(expected_ruby_version, @ruby_version, "loaded Opencode::VERSION")
|
|
assert_equal!(expected_rails_version, @rails_version, "loaded Opencode::RAILS_VERSION")
|
|
assert_equal!(expected_ruby_version, expected_rails_version, "lockstep client version")
|
|
|
|
ruby_spec = loaded_spec!("opencode-ruby")
|
|
rails_spec = loaded_spec!("opencode-rails")
|
|
assert_equal!(expected_ruby_version, ruby_spec.version.to_s, "loaded opencode-ruby gem version")
|
|
assert_equal!(expected_rails_version, rails_spec.version.to_s, "loaded opencode-rails gem version")
|
|
assert_equal!(rails_path, File.realpath(rails_spec.full_gem_path), "loaded opencode-rails checkout")
|
|
|
|
dependency = exact_runtime_dependency!(rails_spec, expected_ruby_version)
|
|
bundle_spec = bundled_ruby_spec!
|
|
source = bundle_spec.source
|
|
unless source && source.respond_to?(:revision) && source.class.name.match?(/(?:\A|::)Git\z/)
|
|
raise ContractError, "Bundler opencode-ruby source must be a Git source"
|
|
end
|
|
|
|
bundler_revision = source.revision.to_s
|
|
assert_exact_commit!(bundler_revision, "Bundler opencode-ruby revision")
|
|
assert_equal!(ruby_commit, bundler_revision, "Bundler opencode-ruby revision")
|
|
|
|
{
|
|
"contract" => CONTRACT_NAME,
|
|
"opencode_rails" => {
|
|
"checkout_commit" => rails_commit,
|
|
"gem_version" => rails_spec.version.to_s,
|
|
"loaded_version" => @rails_version,
|
|
"tag_provenance" => rails_tag_provenance,
|
|
"runtime_dependency" => {
|
|
"name" => dependency.name,
|
|
"requirement" => dependency.requirement.to_s
|
|
}
|
|
},
|
|
"opencode_ruby" => {
|
|
"bundler_git_revision" => bundler_revision,
|
|
"bundler_source" => source.class.name,
|
|
"checkout_commit" => ruby_commit,
|
|
"gem_version" => ruby_spec.version.to_s,
|
|
"loaded_version" => @ruby_version,
|
|
"tag_provenance" => ruby_tag_provenance
|
|
},
|
|
"ruby_runtime_version" => @runtime_ruby_version,
|
|
"schema_version" => 1,
|
|
"status" => "pass",
|
|
"workflow" => {
|
|
"head_sha" => @env["OPENCODE_COMPAT_HEAD_SHA"],
|
|
"repository" => @env["OPENCODE_COMPAT_REPOSITORY"],
|
|
"run_attempt" => @env["OPENCODE_COMPAT_RUN_ATTEMPT"],
|
|
"run_id" => @env["OPENCODE_COMPAT_RUN_ID"],
|
|
"run_url" => @env["OPENCODE_COMPAT_RUN_URL"]
|
|
}
|
|
}
|
|
rescue Errno::ENOENT, Errno::EACCES => error
|
|
raise ContractError, error.message
|
|
end
|
|
|
|
def emit(io: $stdout)
|
|
document = verify
|
|
json = self.class.canonical_json(document)
|
|
evidence_path = @env["OPENCODE_COMPAT_EVIDENCE_PATH"].to_s
|
|
|
|
unless evidence_path.empty?
|
|
expanded_path = File.expand_path(evidence_path)
|
|
FileUtils.mkdir_p(File.dirname(expanded_path))
|
|
File.binwrite(expanded_path, "#{json}\n")
|
|
end
|
|
|
|
io.puts(json)
|
|
document
|
|
end
|
|
|
|
private
|
|
|
|
def ensure_required_environment!
|
|
missing = REQUIRED_ENV.select { |name| @env[name].to_s.empty? }
|
|
return if missing.empty?
|
|
|
|
raise ContractError, "missing required environment: #{missing.join(', ')}"
|
|
end
|
|
|
|
def realpath(name)
|
|
File.realpath(@env.fetch(name))
|
|
end
|
|
|
|
def exact_commit(name)
|
|
value = @env.fetch(name)
|
|
assert_exact_commit!(value, name)
|
|
value
|
|
end
|
|
|
|
def exact_tag(name)
|
|
value = @env.fetch(name)
|
|
if value.match?(/\A[A-Za-z0-9][A-Za-z0-9._-]*\z/) && !value.include?("..") && !value.end_with?(".")
|
|
return value
|
|
end
|
|
|
|
raise ContractError, "#{name} must be a safe exact Git tag name, got #{value.inspect}"
|
|
end
|
|
|
|
def exact_tag_object(name)
|
|
value = @env.fetch(name)
|
|
return value if value.match?(/\A[0-9a-f]{40}\z/)
|
|
|
|
raise ContractError,
|
|
"#{name} must be a full lowercase 40-character Git object ID, got #{value.inspect}"
|
|
end
|
|
|
|
def assert_exact_commit!(value, label)
|
|
return if value.match?(/\A[0-9a-f]{40}\z/)
|
|
|
|
raise ContractError, "#{label} must be a full lowercase 40-character Git commit, got #{value.inspect}"
|
|
end
|
|
|
|
def exact_version(name)
|
|
value = @env.fetch(name)
|
|
return value if Gem::Version.correct?(value)
|
|
|
|
raise ContractError, "#{name} must be an exact RubyGems version, got #{value.inspect}"
|
|
end
|
|
|
|
def checkout_head(path, label)
|
|
head = if @git_head_resolver
|
|
@git_head_resolver.call(path).to_s.strip
|
|
else
|
|
git_value(path, "#{label} checkout HEAD", "rev-parse", "--verify", "HEAD^{commit}")
|
|
end
|
|
assert_exact_commit!(head, "#{label} checkout HEAD")
|
|
head
|
|
rescue ContractError
|
|
raise
|
|
rescue StandardError => error
|
|
raise ContractError, "could not resolve #{label} checkout HEAD: #{error.message}"
|
|
end
|
|
|
|
def annotated_tag_provenance(path:, label:, tag_name:, tag_object:, expected_commit:)
|
|
tag = exact_tag(tag_name)
|
|
object = exact_tag_object(tag_object)
|
|
tag_ref = "refs/tags/#{tag}"
|
|
|
|
object_type = git_value(path, "#{label} annotated tag object type", "cat-file", "-t", object)
|
|
assert_equal!("tag", object_type, "#{label} annotated tag object type")
|
|
|
|
resolved_object = git_value(path, "#{label} local tag ref", "rev-parse", "--verify", tag_ref)
|
|
assert_exact_commit!(resolved_object, "#{label} local tag ref object")
|
|
assert_equal!(object, resolved_object, "#{label} local tag ref object")
|
|
|
|
object_commit = git_value(path, "#{label} annotated tag peel", "rev-parse", "--verify", "#{object}^{commit}")
|
|
assert_exact_commit!(object_commit, "#{label} annotated tag peeled commit")
|
|
assert_equal!(expected_commit, object_commit, "#{label} annotated tag peeled commit")
|
|
|
|
ref_commit = git_value(path, "#{label} local tag ref peel", "rev-parse", "--verify", "#{tag_ref}^{commit}")
|
|
assert_exact_commit!(ref_commit, "#{label} local tag ref peeled commit")
|
|
assert_equal!(expected_commit, ref_commit, "#{label} local tag ref peeled commit")
|
|
|
|
{
|
|
"annotated_tag_object" => object,
|
|
"peeled_commit" => object_commit,
|
|
"tag" => tag
|
|
}
|
|
end
|
|
|
|
def git_value(path, label, *arguments)
|
|
@git_resolver.call(path, *arguments).to_s.strip
|
|
rescue StandardError => error
|
|
raise ContractError, "could not resolve #{label}: #{error.message}"
|
|
end
|
|
|
|
def resolve_git(path, *arguments)
|
|
stdout, stderr, status = Open3.capture3("git", "-C", path, *arguments)
|
|
return stdout.strip if status.success?
|
|
|
|
detail = stderr.strip
|
|
detail = "git exited #{status.exitstatus}" if detail.empty?
|
|
raise ContractError, detail
|
|
end
|
|
|
|
def loaded_spec!(name)
|
|
@loaded_specs.fetch(name)
|
|
rescue KeyError
|
|
raise ContractError, "#{name} is not present in Gem.loaded_specs"
|
|
end
|
|
|
|
def exact_runtime_dependency!(rails_spec, ruby_version)
|
|
dependencies = rails_spec.runtime_dependencies.select { |dependency| dependency.name == "opencode-ruby" }
|
|
unless dependencies.length == 1
|
|
raise ContractError, "opencode-rails must declare exactly one runtime dependency on opencode-ruby"
|
|
end
|
|
|
|
dependency = dependencies.first
|
|
expected = [["=", Gem::Version.new(ruby_version)]]
|
|
unless dependency.requirement.requirements == expected
|
|
raise ContractError,
|
|
"opencode-rails must require opencode-ruby = #{ruby_version}, got #{dependency.requirement}"
|
|
end
|
|
|
|
dependency
|
|
end
|
|
|
|
def bundled_ruby_spec!
|
|
specs = @bundle_specs.select { |spec| spec.name == "opencode-ruby" }
|
|
return specs.first if specs.length == 1
|
|
|
|
raise ContractError, "Bundler must resolve exactly one opencode-ruby spec, found #{specs.length}"
|
|
end
|
|
|
|
def assert_equal!(expected, actual, label)
|
|
return if expected == actual
|
|
|
|
raise ContractError, "#{label} must equal #{expected.inspect}, got #{actual.inspect}"
|
|
end
|
|
end
|
|
end
|
|
|
|
if $PROGRAM_NAME == __FILE__
|
|
begin
|
|
OpenCodeCompat::LockstepClientContract.from_environment.emit
|
|
rescue StandardError => error
|
|
failure = OpenCodeCompat::LockstepClientContract.canonical_json(
|
|
"contract" => OpenCodeCompat::LockstepClientContract::CONTRACT_NAME,
|
|
"error" => "#{error.class}: #{error.message}",
|
|
"schema_version" => 1,
|
|
"status" => "fail"
|
|
)
|
|
if (evidence_path = ENV["OPENCODE_COMPAT_EVIDENCE_PATH"]) && !evidence_path.empty?
|
|
expanded_path = File.expand_path(evidence_path)
|
|
FileUtils.mkdir_p(File.dirname(expanded_path))
|
|
File.binwrite(expanded_path, "#{failure}\n")
|
|
end
|
|
warn failure
|
|
exit 1
|
|
end
|
|
end
|