Add reproducible Engine L2 deployment artifact

2026-07-23 12:25:05 +03:00
parent 2a30e1e991
commit ad3760e767
2 changed files with 370 additions and 0 deletions
@@ -0,0 +1,139 @@
+import hashlib
+import importlib.machinery
+import importlib.util
+import json
+import os
+from pathlib import Path
+import subprocess
+import tarfile
+import tempfile
+import unittest
+
+
+SCRIPT_DIR = Path(__file__).resolve().parent
+RUNNER_PATH = SCRIPT_DIR / "nodedc-deploy"
+BUILDER_PATH = SCRIPT_DIR / "build-engine-l2-closed-loop-artifact.mjs"
+ENGINE_ROOT = SCRIPT_DIR.parent.parent.parent / "NODEDC_ENGINE_INFRA"
+PATCH_ID = "engine-l2-closed-loop-20991231-999"
+SOURCE_COMMIT = "dda405cff27977622af0c218abb4d4420c408536"
+
+
+def load_runner():
+    loader = importlib.machinery.SourceFileLoader(
+        "nodedc_engine_l2_closed_loop",
+        str(RUNNER_PATH),
+    )
+    spec = importlib.util.spec_from_loader(loader.name, loader)
+    module = importlib.util.module_from_spec(spec)
+    loader.exec_module(module)
+    return module
+
+
+RUNNER = load_runner()
+
+
+class EngineL2ClosedLoopArtifactTest(unittest.TestCase):
+    def require_target_commit(self):
+        current = subprocess.run(
+            ["git", "-C", str(ENGINE_ROOT), "rev-parse", "HEAD"],
+            check=True,
+            capture_output=True,
+            text=True,
+        ).stdout.strip()
+        if current != SOURCE_COMMIT:
+            self.skipTest("historical Engine L2 closed-loop source has advanced")
+
+    def build(self, artifact_dir):
+        self.require_target_commit()
+        environment = os.environ.copy()
+        environment["NODEDC_ENGINE_SOURCE_ROOT"] = str(ENGINE_ROOT)
+        environment["NODEDC_DEPLOY_ARTIFACT_DIR"] = str(artifact_dir)
+        completed = subprocess.run(
+            ["node", str(BUILDER_PATH), PATCH_ID],
+            check=True,
+            capture_output=True,
+            text=True,
+            env=environment,
+        )
+        return json.loads(completed.stdout)
+
+    def test_builder_is_commit_bound_and_byte_deterministic(self):
+        with tempfile.TemporaryDirectory(prefix="nodedc-engine-l2-closed-loop-") as directory:
+            root = Path(directory)
+            first = self.build(root / "first")
+            second = self.build(root / "second")
+            first_artifact = Path(first["artifact"])
+            second_artifact = Path(second["artifact"])
+
+            self.assertEqual(first["sourceCommit"], SOURCE_COMMIT)
+            self.assertEqual(first_artifact.read_bytes(), second_artifact.read_bytes())
+            self.assertEqual(
+                first["sha256"],
+                hashlib.sha256(first_artifact.read_bytes()).hexdigest(),
+            )
+            self.assertEqual(first["services"], ["nodedc-backend", "app"])
+            self.assertEqual(first["mcpVersion"], "0.7.0")
+
+    def test_artifact_is_a_safe_exact_engine_overlay(self):
+        with tempfile.TemporaryDirectory(prefix="nodedc-engine-l2-overlay-") as directory:
+            root = Path(directory)
+            built = self.build(root / "artifact")
+            artifact = Path(built["artifact"])
+
+            with tarfile.open(artifact, "r:gz") as archive:
+                members = archive.getmembers()
+                for member in members:
+                    self.assertIn(member.type, (tarfile.REGTYPE, tarfile.DIRTYPE))
+                    self.assertEqual(member.uid, 0)
+                    self.assertEqual(member.gid, 0)
+                    self.assertEqual(member.mtime, 0)
+                    self.assertNotIn(".DS_Store", member.name)
+                    self.assertNotIn("__MACOSX", member.name)
+                archive.extractall(root / "extract", filter="data")
+
+            manifest, entries, payload = RUNNER.load_artifact(
+                artifact,
+                root / "loaded",
+            )
+            self.assertEqual(manifest["component"], "engine")
+            self.assertEqual(manifest["type"], "app-overlay")
+            self.assertEqual(tuple(entries), tuple(built["entries"]))
+            self.assertEqual(
+                RUNNER.component_services("engine", entries),
+                ("nodedc-backend", "app"),
+            )
+            self.assertEqual(
+                RUNNER.component_healthchecks(
+                    "engine",
+                    entries,
+                    ("nodedc-backend", "app"),
+                ),
+                (
+                    "http://127.0.0.1:8080/",
+                    "http://127.0.0.1:3001/health",
+                ),
+            )
+            self.assertTrue(RUNNER.component_publish_dist("engine", entries))
+            self.assertEqual(RUNNER.component_builds("engine", entries), ())
+
+            payload_files = {
+                path.relative_to(payload).as_posix()
+                for path in payload.rglob("*")
+                if path.is_file()
+            }
+            self.assertEqual(payload_files, set(built["targetSha256"]))
+            for relative_path, expected in built["targetSha256"].items():
+                self.assertEqual(
+                    hashlib.sha256((payload / relative_path).read_bytes()).hexdigest(),
+                    expected,
+                )
+
+            self.assertTrue(all("/tests/" not in path for path in payload_files))
+            self.assertTrue(all("/data/" not in path for path in payload_files))
+            self.assertTrue(all("/storage/" not in path for path in payload_files))
+            self.assertTrue(all("/logs/" not in path for path in payload_files))
+            self.assertTrue(all(not path.endswith(".env") for path in payload_files))
+
+
+if __name__ == "__main__":
+    unittest.main(verbosity=2)