wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix(gitea): surface all product dev prod repo truth
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 1s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m12s
Details
CD Pipeline / build-and-deploy (push) Successful in 4m52s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m47s
Details

Browse Source
This commit is contained in:
Your Name
2026-07-03 08:38:04 +08:00
parent 0dc9e62b6d
commit fbd3ad2ca4
9 changed files with 1286 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files

118
apps/api/src/services/delivery_closure_workbench.py
View File

@@ -875,6 +875,14 @@ def build_delivery_closure_workbench(
"gitea_public_repo_count": _int(
private_inventory_rollups.get("gitea_public_repo_count")
),
"gitea_ssh_verified_repo_count": _int(
private_inventory_rollups.get("gitea_ssh_verified_repo_count")
),
"gitea_private_or_auth_only_repo_count": _int(
private_inventory_rollups.get(
"gitea_private_or_auth_only_repo_count"
)
),
"expected_product_count": _int(
private_inventory_rollups.get("expected_product_count")
),
@@ -884,6 +892,62 @@ def build_delivery_closure_workbench(
"missing_product_row_count": _int(
private_inventory_rollups.get("missing_product_row_count")
),
"ssh_verified_product_repo_count": _int(
private_inventory_rollups.get("ssh_verified_product_repo_count")
),
"main_branch_present_product_repo_count": _int(
private_inventory_rollups.get(
"main_branch_present_product_repo_count"
)
),
"dev_branch_present_product_repo_count": _int(
private_inventory_rollups.get(
"dev_branch_present_product_repo_count"
)
),
"dev_prod_environment_split_ready_count": _int(
private_inventory_rollups.get(
"dev_prod_environment_split_ready_count"
)
),
"public_visible_product_repo_count": _int(
private_inventory_rollups.get("public_visible_product_repo_count")
),
"private_or_auth_only_product_repo_count": _int(
private_inventory_rollups.get(
"private_or_auth_only_product_repo_count"
)
),
"tokenless_http_404_private_or_auth_product_repo_count": _int(
private_inventory_rollups.get(
"tokenless_http_404_private_or_auth_product_repo_count"
)
),
"missing_product_repo_count": _int(
private_inventory_rollups.get("missing_product_repo_count")
),
"missing_main_branch_product_repo_count": _int(
private_inventory_rollups.get(
"missing_main_branch_product_repo_count"
)
),
"missing_dev_branch_product_repo_count": _int(
private_inventory_rollups.get(
"missing_dev_branch_product_repo_count"
)
),
"all_expected_product_repos_have_ssh_refs": (
private_inventory_rollups.get(
"all_expected_product_repos_have_ssh_refs"
)
is True
),
"all_expected_product_repos_have_dev_and_main": (
private_inventory_rollups.get(
"all_expected_product_repos_have_dev_and_main"
)
is True
),
"accepted_inventory_payload_count": _int(
private_inventory_rollups.get("accepted_inventory_payload_count")
),
@@ -1601,6 +1665,12 @@ def build_delivery_closure_workbench(
"gitea_private_inventory_public_repo_count": _int(
private_inventory_rollups.get("gitea_public_repo_count")
),
"gitea_private_inventory_ssh_verified_repo_count": _int(
private_inventory_rollups.get("gitea_ssh_verified_repo_count")
),
"gitea_private_inventory_private_or_auth_only_repo_count": _int(
private_inventory_rollups.get("gitea_private_or_auth_only_repo_count")
),
"gitea_private_inventory_expected_product_count": _int(
private_inventory_rollups.get("expected_product_count")
),
@@ -1610,6 +1680,54 @@ def build_delivery_closure_workbench(
"gitea_private_inventory_missing_product_row_count": _int(
private_inventory_rollups.get("missing_product_row_count")
),
"gitea_private_inventory_ssh_verified_product_repo_count": _int(
private_inventory_rollups.get("ssh_verified_product_repo_count")
),
"gitea_private_inventory_main_branch_present_product_repo_count": _int(
private_inventory_rollups.get(
"main_branch_present_product_repo_count"
)
),
"gitea_private_inventory_dev_branch_present_product_repo_count": _int(
private_inventory_rollups.get("dev_branch_present_product_repo_count")
),
"gitea_private_inventory_dev_prod_environment_split_ready_count": _int(
private_inventory_rollups.get("dev_prod_environment_split_ready_count")
),
"gitea_private_inventory_public_visible_product_repo_count": _int(
private_inventory_rollups.get("public_visible_product_repo_count")
),
"gitea_private_inventory_private_or_auth_only_product_repo_count": _int(
private_inventory_rollups.get(
"private_or_auth_only_product_repo_count"
)
),
"gitea_private_inventory_tokenless_http_404_private_or_auth_product_repo_count": _int(
private_inventory_rollups.get(
"tokenless_http_404_private_or_auth_product_repo_count"
)
),
"gitea_private_inventory_missing_product_repo_count": _int(
private_inventory_rollups.get("missing_product_repo_count")
),
"gitea_private_inventory_missing_main_branch_product_repo_count": _int(
private_inventory_rollups.get(
"missing_main_branch_product_repo_count"
)
),
"gitea_private_inventory_missing_dev_branch_product_repo_count": _int(
private_inventory_rollups.get("missing_dev_branch_product_repo_count")
),
"gitea_private_inventory_all_expected_product_repos_have_ssh_refs": (
private_inventory_rollups.get("all_expected_product_repos_have_ssh_refs")
is True
),
"gitea_private_inventory_all_expected_product_repos_have_dev_and_main": (
private_inventory_rollups.get(
"all_expected_product_repos_have_dev_and_main"
)
is True
),
"gitea_private_inventory_accepted_payload_count": _int(
private_inventory_rollups.get("accepted_inventory_payload_count")
),

103
apps/api/src/services/gitea_private_inventory_p0_scorecard.py
View File

@@ -62,6 +62,10 @@ def _build_payload(scorecard: dict[str, Any], path: Path) -> dict[str, Any]:
owner_response_validation = _dict(scorecard.get("owner_response_validation"))
controlled_closeout_receipt = _dict(scorecard.get("controlled_closeout_receipt"))
product_coverage = _dict(scorecard.get("product_row_coverage"))
product_environment_coverage = _dict(
scorecard.get("product_repo_environment_coverage")
)
dev_prod_repo_readback = _dict(scorecard.get("dev_prod_repo_readback"))
active_blockers = _strings(scorecard.get("active_blockers"))
exit_criteria = _strings(scorecard.get("exit_criteria"))
met_criteria = _met_exit_criteria(scorecard, gitea_inventory, product_coverage)
@@ -94,6 +98,8 @@ def _build_payload(scorecard: dict[str, Any], path: Path) -> dict[str, Any]:
"safe_next_step": str(scorecard.get("safe_next_step") or ""),
},
"gitea_inventory": gitea_inventory,
"dev_prod_repo_readback": dev_prod_repo_readback,
"product_repo_environment_coverage": product_environment_coverage,
"authenticated_import_acceptance": import_acceptance,
"authenticated_payload_validation": payload_validation,
"authenticated_inventory_single_preflight_intake_ready": True,
@@ -119,6 +125,12 @@ def _build_payload(scorecard: dict[str, Any], path: Path) -> dict[str, Any]:
gitea_inventory.get("visibility_scope") or "unknown"
),
"gitea_public_repo_count": _int(gitea_inventory.get("repo_count")),
"gitea_ssh_verified_repo_count": _int(
gitea_inventory.get("ssh_verified_repo_count")
),
"gitea_private_or_auth_only_repo_count": _int(
gitea_inventory.get("private_or_auth_only_repo_count")
),
"accepted_inventory_payload_count": _int(
import_acceptance.get("accepted_payload_count")
),
@@ -203,6 +215,53 @@ def _build_payload(scorecard: dict[str, Any], path: Path) -> dict[str, Any]:
)
is True
),
"product_repo_environment_status": str(
product_environment_coverage.get("status") or ""
),
"ssh_verified_product_repo_count": _int(
product_environment_coverage.get("ssh_repo_present_count")
),
"main_branch_present_product_repo_count": _int(
product_environment_coverage.get("main_branch_present_count")
),
"dev_branch_present_product_repo_count": _int(
product_environment_coverage.get("dev_branch_present_count")
),
"dev_prod_environment_split_ready_count": _int(
product_environment_coverage.get("environment_split_ready_count")
),
"public_visible_product_repo_count": _int(
product_environment_coverage.get("public_visible_count")
),
"private_or_auth_only_product_repo_count": _int(
product_environment_coverage.get("private_or_auth_only_count")
),
"tokenless_http_404_private_or_auth_product_repo_count": _int(
product_environment_coverage.get(
"tokenless_http_404_private_or_auth_count"
)
),
"missing_product_repo_count": _int(
product_environment_coverage.get("missing_repo_count")
),
"missing_main_branch_product_repo_count": _int(
product_environment_coverage.get("missing_main_branch_count")
),
"missing_dev_branch_product_repo_count": _int(
product_environment_coverage.get("missing_dev_branch_count")
),
"all_expected_product_repos_have_ssh_refs": (
product_environment_coverage.get(
"all_expected_product_repos_have_ssh_refs"
)
is True
),
"all_expected_product_repos_have_dev_and_main": (
product_environment_coverage.get(
"all_expected_product_repos_have_dev_and_main"
)
is True
),
"github_lane_excluded_from_p0_blocker_count": (
scorecard.get("github_lane_excluded_from_p0_blocker_count")
is True
@@ -402,6 +461,29 @@ def _require_source_scorecard(payload: dict[str, Any], label: str) -> None:
f"{label}: owner response validation boundaries must remain false: "
f"{owner_response_drift}"
)
dev_prod_readback = _dict(payload.get("dev_prod_repo_readback"))
if dev_prod_readback:
if dev_prod_readback.get("source_control_authority") != "gitea":
raise ValueError(f"{label}: dev/prod readback must use gitea authority")
boundaries = _dict(dev_prod_readback.get("operation_boundaries"))
if boundaries.get("ssh_refs_read_only") is not True:
raise ValueError(f"{label}: dev/prod readback must be SSH read-only")
blocked_flags = {
"token_value_collection_allowed",
"secret_value_collection_allowed",
"gitea_api_write_allowed",
"gitea_repo_creation_allowed",
"gitea_refs_sync_allowed",
"gitea_visibility_change_allowed",
"github_api_allowed",
"github_cli_allowed",
"raw_session_or_sqlite_read_allowed",
}
opened = sorted(
flag for flag in blocked_flags if boundaries.get(flag) is not False
)
if opened:
raise ValueError(f"{label}: dev/prod readback boundaries opened: {opened}")
def _require_operation_boundaries(payload: dict[str, Any], label: str) -> None:
@@ -452,6 +534,19 @@ def _require_rollup_consistency(payload: dict[str, Any], label: str) -> None:
is not True
):
raise ValueError(f"{label}: active product owner readiness rows incomplete")
if rollups.get("ssh_verified_product_repo_count") and (
rollups.get("ssh_verified_product_repo_count")
!= rollups.get("expected_product_count")
):
raise ValueError(f"{label}: SSH verified product repo count mismatch")
if rollups.get("missing_product_repo_count") not in {None, 0}:
raise ValueError(f"{label}: product repo readback must have zero missing repos")
if rollups.get("missing_main_branch_product_repo_count") not in {None, 0}:
raise ValueError(f"{label}: product repo readback must have zero missing main branches")
if rollups.get("missing_dev_branch_product_repo_count") not in {None, 0}:
raise ValueError(f"{label}: product repo readback must have zero missing dev branches")
if rollups.get("all_expected_product_repos_have_dev_and_main") is False:
raise ValueError(f"{label}: product repo readback must have dev and main")
if (
rollups.get("next_owner_response_validation_lane_id")
!= "s4_9_gitea_inventory_owner_attestation_response"
@@ -563,6 +658,14 @@ def _met_exit_criteria(
is True
):
met.append("all_active_product_repos_have_gitea_owner_readiness_row=true")
product_environment_coverage = _dict(
scorecard.get("product_repo_environment_coverage")
)
if (
product_environment_coverage.get("all_expected_product_repos_have_dev_and_main")
is True
):
met.append("all_expected_product_repos_have_dev_and_main=true")
return met