alexei.dolgolyov
7733e64b08
A dockerfile or static workload can opt in to reading its deploy config from a
.tinyforge.yml in its own repo. Tinyforge fetches the file, shows field-level
drift vs the live config, and an admin applies it with an explicit Sync. The
repo becomes the source of truth for the declared fields. Manual-sync only;
no auto-apply on deploy, no multi-workload reconcile, no create/delete in v1.
Scope is deliberately source-aware and source_config-resident: dockerfile
declares port/healthcheck/deploy_strategy, static declares deploy_strategy.
The file never carries repo coords or secrets (those stay in the encrypted
DB), which keeps credentials out of the repo.
Backend:
- internal/gitops: Spec/ParseSpec (KnownFields rejects unknown keys), a
source-aware ApplyPlan/BuildPlan, MergeAndValidate (omitted-field-preserving
deep merge + validate-the-merged-result-then-commit — never a partial
config), declared-only Drift with normalization, and Fetch with
ok/no_file/fetch_failed/invalid statuses and token-redacted messages.
- staticsite: DownloadFile added to GitProvider + Gitea/GitHub/GitLab impls,
reusing each provider's SSRF-safe client; 64 KiB cap; ErrFileNotFound.
- store: 4 additive gitops_* columns + setters (disjoint from UpdateWorkload
so the edit-form save and a sync never clobber each other).
- api: GET /workloads/{id}/gitops (status + raw + live drift + managed_fields),
PUT /gitops (admin, enable/path, traversal-safe), POST /gitops/sync (admin,
per-workload locked read->merge->validate->write, audited to event_log).
Frontend:
- GitOpsPanel.svelte: status pill, a purpose-built field-level drift view,
.tinyforge.yml preview, enable ToggleSwitch, Sync via ConfirmDialog; all five
statuses handled, admin affordances gated on the real viewer role.
- GitOps-managed badge (list + detail hero) and a read-only edit-form banner.
- api.ts fetchers + types; i18n apps.detail.gitops.* (en + ru parity).
Built phase-by-phase with an adversarial plan review (caught 5 design flaws
pre-implementation) and an independent review per phase (go / security / ts /
final) — all APPROVE, 0 CRITICAL/HIGH. docs/gitops.md documents the schema and
what's intentionally out of v1. Plan: plans/gitops/.
49 lines
1.7 KiB
Go
49 lines
1.7 KiB
Go
package gitops
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
)
|
|
|
|
// MergeAndValidate overlays the plan's SourceConfigPatch onto a copy of the
|
|
// live source_config and returns the merged JSON — but only after the target
|
|
// source's own Validate accepts the *merged* result. This is the hard apply
|
|
// gate (review C4):
|
|
//
|
|
// - omitted-field-preserving: keys the file doesn't declare are untouched, so
|
|
// a partial .tinyforge.yml never clears live config;
|
|
// - validate-then-commit: a patch that would produce an invalid config (e.g.
|
|
// deploy_strategy "blue-green" on a source that rejects it, or a bad port)
|
|
// is refused as a whole — the function never returns a partial/empty config;
|
|
// - pure: it does not write anything; the caller persists the returned bytes.
|
|
//
|
|
// validate is the matching Source.Validate (passed in to keep this package
|
|
// decoupled from the source plugins).
|
|
func MergeAndValidate(live json.RawMessage, plan ApplyPlan, validate func(json.RawMessage) error) (json.RawMessage, error) {
|
|
// Decode the live config into a generic map we can overlay. An empty/null
|
|
// live config starts from an empty object rather than failing.
|
|
merged := map[string]any{}
|
|
if len(live) > 0 {
|
|
if err := json.Unmarshal(live, &merged); err != nil {
|
|
return nil, fmt.Errorf("gitops: decode live source_config: %w", err)
|
|
}
|
|
}
|
|
|
|
// Overlay only the declared patch keys — everything else is preserved.
|
|
for k, v := range plan.SourceConfigPatch {
|
|
merged[k] = v
|
|
}
|
|
|
|
out, err := json.Marshal(merged)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("gitops: encode merged source_config: %w", err)
|
|
}
|
|
|
|
if validate != nil {
|
|
if err := validate(out); err != nil {
|
|
return nil, fmt.Errorf("gitops: merged config rejected: %w", err)
|
|
}
|
|
}
|
|
return out, nil
|
|
}
|