feat(automation): enforce typed SRE execution domains

scripts/ops/render-service-registry-configmap.py

@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+"""Render the production Service Registry ConfigMap from one canonical source."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+from pathlib import Path
+
+
+REPO_ROOT = Path(__file__).resolve().parents[2]
+SOURCE = REPO_ROOT / "ops" / "config" / "service-registry.yaml"
+TARGET = REPO_ROOT / "k8s" / "awoooi-prod" / "15-service-registry-configmap.yaml"
+
+
+def render(source_text: str) -> str:
+    if not source_text.endswith("\n"):
+        source_text += "\n"
+    digest = hashlib.sha256(source_text.encode("utf-8")).hexdigest()
+    embedded = "".join(
+        f"    {line}" if line.strip() else line
+        for line in source_text.splitlines(keepends=True)
+    )
+    return (
+        "# Generated by scripts/ops/render-service-registry-configmap.py.\n"
+        "# Source: ops/config/service-registry.yaml; do not edit this file by hand.\n"
+        "apiVersion: v1\n"
+        "kind: ConfigMap\n"
+        "metadata:\n"
+        "  name: service-registry\n"
+        "  namespace: awoooi-prod\n"
+        "  labels:\n"
+        "    app: awoooi\n"
+        "    component: service-registry\n"
+        "  annotations:\n"
+        f"    awoooi.wooo.work/source-sha256: \"{digest}\"\n"
+        "data:\n"
+        "  service-registry.yaml: |\n"
+        f"{embedded}"
+    )
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--check",
+        action="store_true",
+        help="fail if the committed ConfigMap is not an exact render",
+    )
+    args = parser.parse_args()
+
+    expected = render(SOURCE.read_text(encoding="utf-8"))
+    if args.check:
+        actual = TARGET.read_text(encoding="utf-8") if TARGET.exists() else ""
+        if actual != expected:
+            raise SystemExit(
+                "service registry ConfigMap drift: run "
+                "scripts/ops/render-service-registry-configmap.py"
+            )
+        return 0
+
+    TARGET.write_text(expected, encoding="utf-8")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())