wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

feat(github): authorize controlled backup execution

Browse Source
This commit is contained in:
Your Name
2026-06-28 01:37:02 +08:00
parent d4fcce4170
commit 4de66bde2e
7 changed files with 809 additions and 92 deletions
Download Patch File Download Diff File Expand all files Collapse all files

91
apps/api/src/services/delivery_closure_workbench.py
View File

@@ -52,6 +52,7 @@ def build_delivery_closure_workbench(
"""Build the delivery workbench response from already validated snapshots."""
status_summary = _dict(status_cleanup.get("summary"))
github_summary = _dict(github.get("summary"))
github_boundaries = _dict(github.get("operation_boundaries"))
gitea_status = _dict(gitea.get("program_status"))
gitea_rollups = _dict(gitea.get("rollups"))
runtime_status = _dict(runtime.get("program_status"))
@@ -61,14 +62,18 @@ def build_delivery_closure_workbench(
github_required = _int(github_summary.get("approval_required_target_count"))
github_verified = _int(github_summary.get("private_backup_verified_count"))
runtime_action_required = set(_strings(runtime_rollups.get("action_required_surface_ids")))
runtime_action_required = set(
_strings(runtime_rollups.get("action_required_surface_ids"))
)
runtime_secret_surfaces = set(_strings(runtime_rollups.get("secret_surface_ids")))
lanes = [
{
"id": "release",
"source_id": "status_cleanup",
"completion_percent": _percent(status_summary.get("overall_completion_percent")),
"completion_percent": _percent(
status_summary.get("overall_completion_percent")
),
"status": str(status_summary.get("dashboard_status") or "unknown"),
"blocker_count": _int(status_summary.get("blocked_gate_count")),
"metric": {
@@ -93,14 +98,20 @@ def build_delivery_closure_workbench(
"total": github_required,
},
"href": "/governance?tab=automation-inventory",
"next_action": str(github.get("next_action") or _first_target_action(github.get("targets"))),
"next_action": str(
github.get("next_action") or _first_target_action(github.get("targets"))
),
},
{
"id": "gitea",
"source_id": "gitea_ci_cd",
"completion_percent": _percent(gitea_status.get("overall_completion_percent")),
"completion_percent": _percent(
gitea_status.get("overall_completion_percent")
),
"status": str(gitea_status.get("current_task_id") or "unknown"),
"blocker_count": len(_strings(gitea_rollups.get("runner_contracts_requiring_action"))),
"blocker_count": len(
_strings(gitea_rollups.get("runner_contracts_requiring_action"))
),
"metric": {
"kind": "workflow_count",
"count": _int(gitea_rollups.get("total_workflows")),
@@ -111,7 +122,9 @@ def build_delivery_closure_workbench(
{
"id": "runtime",
"source_id": "runtime_surface",
"completion_percent": _percent(runtime_status.get("overall_completion_percent")),
"completion_percent": _percent(
runtime_status.get("overall_completion_percent")
),
"status": str(runtime_status.get("current_task_id") or "unknown"),
"blocker_count": len(runtime_action_required | runtime_secret_surfaces),
"metric": {
@@ -124,7 +137,9 @@ def build_delivery_closure_workbench(
{
"id": "backup",
"source_id": "backup_dr",
"completion_percent": _percent(backup_status.get("overall_completion_percent")),
"completion_percent": _percent(
backup_status.get("overall_completion_percent")
),
"status": str(backup_status.get("current_task_id") or "unknown"),
"blocker_count": len(_strings(backup_rollups.get("blocked_row_ids"))),
"metric": {
@@ -137,7 +152,9 @@ def build_delivery_closure_workbench(
]
for lane in lanes:
lane["tone"] = _tone(_int(lane["blocker_count"]), _int(lane["completion_percent"]))
lane["tone"] = _tone(
_int(lane["blocker_count"]), _int(lane["completion_percent"])
)
source_statuses = [
_source_status("status_cleanup", status_cleanup),
@@ -146,7 +163,9 @@ def build_delivery_closure_workbench(
_source_status("runtime_surface", runtime),
_source_status("backup_dr", backup),
]
generated_candidates = [source["generated_at"] for source in source_statuses if source["generated_at"]]
generated_candidates = [
source["generated_at"] for source in source_statuses if source["generated_at"]
]
loaded_source_count = sum(1 for source in source_statuses if source["loaded"])
high_risk_blocker_count = sum(_int(lane["blocker_count"]) for lane in lanes)
average_completion = _percent(
@@ -166,17 +185,28 @@ def build_delivery_closure_workbench(
return {
"schema_version": _SCHEMA_VERSION,
"generated_at": max(generated_candidates) if generated_candidates else "",
"status": "blocked_delivery_actions_required" if high_risk_blocker_count else "ready",
"status": "blocked_delivery_actions_required"
if high_risk_blocker_count
else "ready",
"summary": {
"source_count": len(source_statuses),
"loaded_source_count": loaded_source_count,
"average_completion_percent": average_completion,
"high_risk_blocker_count": high_risk_blocker_count,
"runtime_execution_authorized": False,
"remote_write_authorized": False,
"repo_creation_authorized": False,
"refs_sync_authorized": False,
"workflow_trigger_authorized": False,
"remote_write_authorized": github_boundaries.get("github_api_write_allowed")
is True,
"repo_creation_authorized": github_summary.get("repo_creation_authorized")
is True,
"visibility_change_authorized": github_summary.get(
"visibility_change_authorized"
)
is True,
"refs_sync_authorized": github_summary.get("refs_sync_authorized") is True,
"workflow_trigger_authorized": github_summary.get(
"workflow_trigger_authorized"
)
is True,
"secret_values_collected": False,
},
"source_statuses": source_statuses,
@@ -185,11 +215,19 @@ def build_delivery_closure_workbench(
"operation_boundaries": {
"read_only_api_allowed": True,
"runtime_write_allowed": False,
"remote_write_allowed": False,
"repo_creation_allowed": False,
"visibility_change_allowed": False,
"refs_sync_allowed": False,
"workflow_trigger_allowed": False,
"remote_write_allowed": github_boundaries.get("github_api_write_allowed")
is True,
"repo_creation_allowed": github_boundaries.get("repo_creation_allowed")
is True,
"visibility_change_allowed": github_boundaries.get(
"visibility_change_allowed"
)
is True,
"refs_sync_allowed": github_boundaries.get("refs_sync_allowed") is True,
"workflow_trigger_allowed": github_boundaries.get(
"workflow_trigger_allowed"
)
is True,
"secret_value_collection_allowed": False,
"backup_restore_execution_allowed": False,
"active_scan_allowed": False,
@@ -204,7 +242,9 @@ def _source_status(source_id: str, payload: dict[str, Any]) -> dict[str, Any]:
"loaded": not source_missing,
"schema_version": str(payload.get("schema_version") or ""),
"generated_at": str(payload.get("generated_at") or ""),
"missing_reason": str(payload.get("missing_reason") or "") if source_missing else "",
"missing_reason": str(payload.get("missing_reason") or "")
if source_missing
else "",
}
@@ -218,7 +258,9 @@ def _load_github_private_backup_evidence_gate() -> dict[str, Any]:
except ModuleNotFoundError as exc:
if exc.name != "src.services.github_target_private_backup_evidence_gate":
raise
return _missing_github_private_backup_source("service_module_missing_on_release_base")
return _missing_github_private_backup_source(
"service_module_missing_on_release_base"
)
except FileNotFoundError:
return _missing_github_private_backup_source("snapshot_missing_on_release_base")
@@ -255,7 +297,7 @@ def _dict(value: Any) -> dict[str, Any]:
def _int(value: Any) -> int:
if isinstance(value, bool):
return int(value)
if isinstance(value, (int, float)):
if isinstance(value, int | float):
return int(value)
return 0
@@ -307,7 +349,10 @@ def _first_backup_action(value: Any) -> str:
if not isinstance(value, list):
return ""
for row in value:
if isinstance(row, dict) and row.get("overall_readiness") in {"blocked", "action_required"}:
if isinstance(row, dict) and row.get("overall_readiness") in {
"blocked",
"action_required",
}:
return str(row.get("next_action") or "")
return _first_row_action(value)