85 lines
5.0 KiB
Python
85 lines
5.0 KiB
Python
"""Durable governed task binding for CREATE_NEW and CONTINUE_EXISTING."""
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass, asdict
|
|
import hashlib
|
|
import json
|
|
from pathlib import Path
|
|
import re
|
|
from typing import Any, Mapping
|
|
|
|
from aios_gitops_job_controller import GitOpsJobController, JobStore
|
|
|
|
OID_RE = re.compile(r"^[0-9a-f]{40}$")
|
|
BRANCH_RE = re.compile(r"^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$")
|
|
|
|
|
|
class BootstrapError(RuntimeError):
|
|
pass
|
|
|
|
|
|
@dataclass(frozen=True, slots=True)
|
|
class GovernedTaskBinding:
|
|
task_id: str
|
|
repository: str
|
|
base_oid: str
|
|
target_branch: str
|
|
risk: str
|
|
description: str
|
|
idempotency_key: str
|
|
expected_branch_oid: str
|
|
branch_mode: str
|
|
generation: int
|
|
job_id: str | None = None
|
|
|
|
def response(self, *, idempotent: bool = False) -> dict[str, Any]:
|
|
return {"task_id": self.task_id, "repository": self.repository, "base_oid": self.base_oid, "target_branch": self.target_branch, "expected_branch_oid": self.expected_branch_oid, "generation": self.generation, "branch_mode": self.branch_mode, "create_target_branch": self.branch_mode == "CREATE_NEW", "worktree_mode": "detached_at_base_oid" if self.branch_mode == "CREATE_NEW" else "detached_at_expected_head", "cas_ref_update_required": True, "idempotent": idempotent, "state": "BOUND", "job_id": self.job_id}
|
|
|
|
|
|
def _safe(value: str) -> str:
|
|
return re.sub(r"[^A-Za-z0-9_.-]+", "-", value).strip("-")[:120] or "task"
|
|
|
|
|
|
class GovernedTaskBootstrap:
|
|
def __init__(self, authority: Any, root: Path, *, remote_name: str, token_path: Path, ssh_key_path: Path, api_base: str = "https://g.cnnetmkt.top/git/api/v1") -> None:
|
|
self.authority = authority; self.root = Path(root); self.remote_name = remote_name; self.token_path = Path(token_path); self.ssh_key_path = Path(ssh_key_path); self.api_base = api_base; self.task_meta_root = self.root / "task-bindings"; self.job_root = self.root / "jobs"; self.task_meta_root.mkdir(parents=True, exist_ok=True); self.job_root.mkdir(parents=True, exist_ok=True)
|
|
|
|
def _store(self, task_id: str) -> tuple[JobStore, GitOpsJobController]:
|
|
root = self.job_root / _safe(task_id); store = JobStore(root, payload_root=root / "payloads"); return store, GitOpsJobController(store)
|
|
|
|
def _metadata(self, task_id: str) -> Path:
|
|
return self.task_meta_root / (_safe(task_id) + ".json")
|
|
|
|
def _read_existing(self, task_id: str) -> GovernedTaskBinding | None:
|
|
path = self._metadata(task_id)
|
|
if not path.is_file() or path.is_symlink(): return None
|
|
return GovernedTaskBinding(**json.loads(path.read_text(encoding="utf-8")))
|
|
|
|
def _write(self, binding: GovernedTaskBinding) -> None:
|
|
path = self._metadata(binding.task_id); temporary = path.with_suffix(".tmp"); temporary.write_text(json.dumps(asdict(binding), sort_keys=True), encoding="utf-8"); temporary.replace(path)
|
|
|
|
def create(self, request: Mapping[str, Any]) -> dict[str, Any]:
|
|
values = {key: str(request[key]) for key in ("task_id", "repository", "base_oid", "target_branch", "risk", "description", "idempotency_key")}
|
|
if values["repository"] != "aios/aios" or not OID_RE.fullmatch(values["base_oid"]): raise BootstrapError("TASK_BINDING_INVALID")
|
|
if not BRANCH_RE.fullmatch(values["target_branch"]): raise BootstrapError("TARGET_BRANCH_INVALID")
|
|
existing = self._read_existing(values["task_id"])
|
|
if existing is not None:
|
|
if any(getattr(existing, key) != values[key] for key in ("repository", "base_oid", "target_branch", "risk", "description")): raise BootstrapError("TASK_BINDING_CONFLICT")
|
|
return existing.response(idempotent=True)
|
|
if not self.authority.commit_exists(values["base_oid"]): raise BootstrapError("BASE_COMMIT_NOT_FOUND")
|
|
current = self.authority.read_ref("refs/heads/" + values["target_branch"])
|
|
expected = str(request.get("expected_branch_oid") or values["base_oid"])
|
|
if current is None:
|
|
mode, generation = "CREATE_NEW", 1
|
|
if expected != values["base_oid"]: raise BootstrapError("EXPECTED_BASE_CONFLICT")
|
|
else:
|
|
if expected != current: raise BootstrapError("EXISTING_BRANCH_OID_CONFLICT")
|
|
mode, generation = "CONTINUE_EXISTING", int(request.get("generation", 2))
|
|
if generation < 1: raise BootstrapError("GENERATION_INVALID")
|
|
payload = json.dumps(values, sort_keys=True, separators=(",", ":")).encode()
|
|
_, controller = self._store(values["task_id"])
|
|
receipt = controller.submit({"idempotency_key": values["idempotency_key"], "campaign_id": values["task_id"], "task_id": values["task_id"], "repository": values["repository"], "operation": "GOVERNED_TASK_CREATE", "branch": values["target_branch"], "expected_branch_oid": expected, "payload_digest": hashlib.sha256(payload).hexdigest(), "lineage_anchor_oid": values["base_oid"]}, payload=payload)
|
|
binding = GovernedTaskBinding(**values, expected_branch_oid=expected, branch_mode=mode, generation=generation, job_id=receipt.job_id)
|
|
self._write(binding)
|
|
return binding.response()
|