24 lines
1.3 KiB
Python
24 lines
1.3 KiB
Python
"""Mandatory C132 pre/post gate for reviewed deployment helpers; no deployment or service control."""
|
|
from pathlib import Path
|
|
import subprocess, tempfile, json, os
|
|
|
|
def assert_diagnostics_off(root, candidate_inertia=None, payload=None):
|
|
root=Path(root).resolve()
|
|
php=os.environ.get('INVESTMOZ_DEPLOY_PHP','C:/laragon/bin/php/php-8.5.11-Win32-vs17-x64/php.exe')
|
|
args=[php,str(root/'tools/portal-diagnostics-deployment-guard.php'),'--root',str(root)]
|
|
temp=None
|
|
try:
|
|
if payload is not None and 'config/inertia.php' in payload:
|
|
# Only verified configuration bytes are written to a transient guard input. No secrets or destination changes.
|
|
with tempfile.NamedTemporaryFile(suffix='.php',delete=False) as f:
|
|
f.write(payload['config/inertia.php']);temp=Path(f.name)
|
|
candidate_inertia=temp
|
|
if candidate_inertia is not None:args+=['--candidate-inertia',str(candidate_inertia)]
|
|
r=subprocess.run(args,capture_output=True,text=True)
|
|
if r.returncode!=0:raise RuntimeError('C132 deployment blocked: diagnostics OFF could not be verified')
|
|
proof=json.loads(r.stdout)
|
|
if proof['result']!='passed':raise RuntimeError('C132 diagnostics guard failed')
|
|
return proof
|
|
finally:
|
|
if temp is not None:temp.unlink()
|