35 lines
8.4 KiB
JSON
35 lines
8.4 KiB
JSON
[
|
|
{
|
|
"file": "/var/www/deploy/investmoz-pipeline.py",
|
|
"range": [
|
|
190,
|
|
213
|
|
],
|
|
"source": "190: (release/'storage'/directory).mkdir(parents=True,exist_ok=True)\n191: with self.qa_database():\n192: self.run(['composer','install','--no-interaction','--prefer-dist','--no-scripts'],cwd=release,env=env)\n193: self.run([self.c['php'],'artisan','package:discover','--ansi'],cwd=release,env=env)\n194: # The guard is verified against the actual PostgreSQL identity, not only environment strings.\n195: guard = \"require 'vendor/autoload.php'; $app=require 'bootstrap/app.php'; $app->make(Illuminate\\\\Contracts\\\\Console\\\\Kernel::class)->bootstrap(); if (!App\\\\Support\\\\IsolatedQaDatabase::allowsSchemaChanges()) exit(91);\"\n196: self.run([self.c['php'],'-r',guard],cwd=release,env=env)\n197: # The project intentionally gates later schemas behind nominal authenticated\n198: # installation. Reuse its accepted isolated baseline lifecycle test instead\n199: # of bypassing those guards with a generic migrate of every module.\n200: self.run([self.c['php'],'vendor/bin/phpunit','--configuration=phpunit.investmoz.xml','--do-not-cache-result'],cwd=release,env=env)\n201: self.run(['npm','ci','--no-audit','--no-fund'],cwd=release,env=env)\n202: self.run(['npm','run','build'],cwd=release,env=env)\n203: self.run(['npm','run','types:check'],cwd=release,env=env)\n204: self.run([self.c['php'],'tools/portal-diagnostics-deployment-guard.php'],cwd=release,env=env)\n205: # Unit fixtures mock DB/mail and select their own feature settings.\n206: # Do not inject the destination's enabled-module flags into those mocks.\n207: unit_env={k:v for k,v in env.items() if not k.startswith(('PORTAL_','INVESTMOZ_'))}\n208: self.run([self.c['php'],'vendor/bin/phpunit','--configuration=phpunit.xml','--testsuite','Unit','--do-not-cache-result'],cwd=release,env=unit_env)\n209: tests=sorted((release/'tests/frontend').glob('*.test.mjs'))\n210: self.run(['node','--test',*tests],cwd=release,env=env)\n211: # Final production vendor from the same lock, before linking any real configuration.\n212: self.run(['composer','install','--no-dev','--no-scripts','--no-interaction','--prefer-dist','--optimize-autoloader'],cwd=release,env=env)\n213: self.run(['composer','check-platform-reqs','--no-dev'],cwd=release,env=env)"
|
|
},
|
|
{
|
|
"file": "/var/www/deploy/investmoz-pipeline.py",
|
|
"range": [
|
|
238,
|
|
277
|
|
],
|
|
"source": "238: 'built_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),\n239: 'manifest_sha256':digest(release/'public/build/manifest.json')})\n240: for directory in [release/'bootstrap/cache']:\n241: os.chmod(directory,0o2770)\n242: \n243: def health(self, target: str) -> None:\n244: request=urllib.request.Request(self.c['target_url']+'/build/revision.json',headers={'User-Agent':'Mozilla/5.0 InvesteMoz-Delivery','Cache-Control':'no-cache'})\n245: with urllib.request.urlopen(request,timeout=20) as response:info=json.load(response)\n246: if info.get('commit')!=target:raise RuntimeError('Served commit differs from built commit')\n247: request=urllib.request.Request(self.c['target_url']+'/',headers={'User-Agent':'Mozilla/5.0 InvesteMoz-Delivery','Cache-Control':'no-cache'})\n248: with urllib.request.urlopen(request,timeout=20) as response:\n249: if response.status!=200 or response.headers.get('WWW-Authenticate'):raise RuntimeError('Public access regression')\n250: \n251: def deliver(self, target: str) -> dict:\n252: installed_file=self.state/'installed.json'\n253: installed=json.loads(installed_file.read_text())\n254: if installed.get('commit')==target:\n255: refuse_drift(self.current.resolve(),installed['hashes'])\n256: return {'status':'already_installed','commit':target}\n257: refuse_drift(self.current.resolve(),installed['hashes'])\n258: self.releases.mkdir(parents=True,exist_ok=True)\n259: if shutil.disk_usage(self.releases).free < 5 * 1024**3:\n260: raise RuntimeError('Insufficient free space for an isolated build; active release preserved')\n261: release=self.releases/(target+'-'+uuid.uuid4().hex[:8]);release.mkdir(mode=0o750)\n262: self.build(target,release)\n263: if self.latest()!=target:\n264: latest=self.git('rev-parse','refs/heads/delivery-target')\n265: write_json(self.state/'requests'/(latest+'.json'),{'commit':latest,'reason':'newer integration during build'})\n266: return {'status':'superseded','commit':target,'newer_commit':latest}\n267: # A programmer may have edited the served release while CI was running.\n268: # Recheck immediately before the atomic switch, preserving that work.\n269: refuse_drift(self.current.resolve(),installed['hashes'])\n270: previous=promote(self.current,release,lambda:self.health(target))\n271: try:\n272: self.run([self.c['php'],str(release/'artisan'),'queue:restart'],cwd=release)\n273: write_json(self.state/'previous.json',installed)\n274: info={'status':'installed','commit':target,'release':str(release),'previous_release':str(previous),\n275: 'hashes':tree_hashes(release),'database_migrations':0,'content_imports':0}\n276: write_json(installed_file,info)\n277: except Exception:"
|
|
},
|
|
{
|
|
"file": "/var/www/deploy/investmoz-pipeline.py",
|
|
"range": [
|
|
287,
|
|
308
|
|
],
|
|
"source": "287: fcntl.flock(lock,fcntl.LOCK_EX)\n288: succeeded=True\n289: for _ in range(3):\n290: requests=sorted((self.state/'requests').glob('*.json'))\n291: if not requests:return succeeded\n292: for path in requests:\n293: if not SHA.fullmatch(path.stem):raise RuntimeError('Unexpected queue entry')\n294: path.rename(self.state/'processed'/(path.stem+'-'+uuid.uuid4().hex[:8]+'.json'))\n295: target=None;report={}\n296: with (self.state/'logs'/(str(time.time_ns())+'.log')).open('wb') as self.log:\n297: try:\n298: target=self.latest();report=self.deliver(target)\n299: except Exception as error:\n300: succeeded=False\n301: report={'status':'failed','commit':target,'error':str(error),'active_release_preserved':True}\n302: finally:self.log=None\n303: report.update(requested_commits=[p.stem for p in requests],finished_at=datetime.datetime.now(datetime.timezone.utc).isoformat())\n304: write_json(self.state/'reports'/((target or 'fetch-failed')+'-'+str(time.time_ns())+'.json'),report)\n305: print(json.dumps(report),flush=True)\n306: return succeeded\n307: \n308: def rollback(self) -> dict:"
|
|
},
|
|
{
|
|
"file": "/var/www/deploy/investmoz-pipeline.py",
|
|
"range": [
|
|
310,
|
|
327
|
|
],
|
|
"source": "310: with (self.state/'delivery.lock').open('a') as lock:\n311: fcntl.flock(lock,fcntl.LOCK_EX)\n312: installed=json.loads((self.state/'installed.json').read_text())\n313: previous=json.loads((self.state/'previous.json').read_text())\n314: refuse_drift(self.current.resolve(),installed['hashes'])\n315: prior=Path(previous['release'])\n316: refuse_drift(prior,previous['hashes'])\n317: current=self.current.resolve()\n318: promote(self.current,prior,lambda:self.health(previous['commit']))\n319: try:\n320: self.run([self.c['php'],str(prior/'artisan'),'queue:restart'],cwd=prior)\n321: write_json(self.state/'installed.json',previous)\n322: write_json(self.state/'previous.json',installed)\n323: except Exception:\n324: point_current(self.current,current)\n325: write_json(self.state/'installed.json',installed)\n326: raise\n327: report={'status':'rolled_back','commit':previous['commit'],'release':str(prior),"
|
|
}
|
|
]
|