alexei.dolgolyov
7733e64b08
A dockerfile or static workload can opt in to reading its deploy config from a
.tinyforge.yml in its own repo. Tinyforge fetches the file, shows field-level
drift vs the live config, and an admin applies it with an explicit Sync. The
repo becomes the source of truth for the declared fields. Manual-sync only;
no auto-apply on deploy, no multi-workload reconcile, no create/delete in v1.
Scope is deliberately source-aware and source_config-resident: dockerfile
declares port/healthcheck/deploy_strategy, static declares deploy_strategy.
The file never carries repo coords or secrets (those stay in the encrypted
DB), which keeps credentials out of the repo.
Backend:
- internal/gitops: Spec/ParseSpec (KnownFields rejects unknown keys), a
source-aware ApplyPlan/BuildPlan, MergeAndValidate (omitted-field-preserving
deep merge + validate-the-merged-result-then-commit — never a partial
config), declared-only Drift with normalization, and Fetch with
ok/no_file/fetch_failed/invalid statuses and token-redacted messages.
- staticsite: DownloadFile added to GitProvider + Gitea/GitHub/GitLab impls,
reusing each provider's SSRF-safe client; 64 KiB cap; ErrFileNotFound.
- store: 4 additive gitops_* columns + setters (disjoint from UpdateWorkload
so the edit-form save and a sync never clobber each other).
- api: GET /workloads/{id}/gitops (status + raw + live drift + managed_fields),
PUT /gitops (admin, enable/path, traversal-safe), POST /gitops/sync (admin,
per-workload locked read->merge->validate->write, audited to event_log).
Frontend:
- GitOpsPanel.svelte: status pill, a purpose-built field-level drift view,
.tinyforge.yml preview, enable ToggleSwitch, Sync via ConfirmDialog; all five
statuses handled, admin affordances gated on the real viewer role.
- GitOps-managed badge (list + detail hero) and a read-only edit-form banner.
- api.ts fetchers + types; i18n apps.detail.gitops.* (en + ru parity).
Built phase-by-phase with an adversarial plan review (caught 5 design flaws
pre-implementation) and an independent review per phase (go / security / ts /
final) — all APPROVE, 0 CRITICAL/HIGH. docs/gitops.md documents the schema and
what's intentionally out of v1. Plan: plans/gitops/.
39 lines
2.2 KiB
Markdown
39 lines
2.2 KiB
Markdown
# Phase 3 — Frontend experience (frontend-design + UI/UX agent showcase)
|
|
|
|
Built by the **frontend implementer agent** under the frontend-design skill. Must follow
|
|
project conventions: Svelte 5 runes, `ToggleSwitch` for booleans, `ConfirmDialog` for the
|
|
sync action, `$t` with **en+ru parity**, the `.panel` vocabulary from `DeployHistoryPanel`.
|
|
|
|
## Tasks
|
|
|
|
- [ ] **`web/src/lib/api.ts`**: `GitOpsStatus` + `DriftEntry` interfaces; `fetchWorkloadGitOps(id)`,
|
|
`fetchWorkloadDrift(id)`, `syncWorkloadGitOps(id)`, `setWorkloadGitOps(id, {enabled, path})`
|
|
following the existing `get<T>`/`post<T>` typed-fetcher pattern (mirror `fetchWorkloadDeploys`).
|
|
- [ ] **`GitOpsPanel.svelte`** (mounted on `apps/[id]` near the other panels): the
|
|
centerpiece. Sections:
|
|
- Header: title + status pill (`synced` / `N changes` / `no file` / `fetch failed`) +
|
|
last-sync/commit meta + enable/disable `ToggleSwitch`.
|
|
- **Drift view** — the design focus. For each declared field show repo-value vs
|
|
live-value with a clean/changed state. Distinctive, legible, on-brand (forge tokens,
|
|
`--forge-mono`, the `--color-warning`/`--color-success` hues already used). No diff
|
|
library exists — design a purpose-built field-level diff (NOT a generic `<pre>` dump).
|
|
- Rendered `.tinyforge.yml` preview (the `.code-area`/editor frame vocabulary).
|
|
- "Sync now" button → `ConfirmDialog` ("apply repo config to live") → `syncWorkloadGitOps`
|
|
→ toast + refresh. Admin-only affordance.
|
|
- `no_file` / `fetch_failed` empty states (clear, not alarming).
|
|
- [ ] **GitOps-managed badge** on apps list rows (`apps/+page.svelte`, only dockerfile/static)
|
|
and the detail hero — reuse the `.badge` chip vocabulary.
|
|
- [ ] **Read-only gate** on the source-config edit form: when managed, lock exactly the
|
|
fields the synced overlay declares (derive from the drift/parsed payload) + a banner
|
|
("managed by `.tinyforge.yml` — edit the file and sync").
|
|
- [ ] **i18n**: `apps.detail.gitops.*` in BOTH `en.json` and `ru.json` (verify parity).
|
|
|
|
## Verify
|
|
|
|
- `npm run check` (0 errors), `npm run build`, `npm run test` green; i18n key parity equal.
|
|
- Restart dev server (`./scripts/dev-server.sh`).
|
|
|
|
## Handoff notes
|
|
|
|
_(filled after implementation)_
|