Fix release version credential fallback (#258)
## Summary - fall back to the existing scoped `RELEASE_MANAGER_GATE_TOKEN` when `SERVER_UPDATE_TOKEN` is absent - record the exact frontend SHA through the release-gate endpoint, then independently read it back - preserve the legacy dedicated-token path when it is configured - carry the scoped credential and exact run-attempt build ID through normal releases, rollback recovery, and restore-on-failure ## Dependency Depends on backend PR copenhagentruckwash/api#342 being merged and deployed before this PR is merged. ## Verification - focused release-gate updater test: 1 passed - direct exact-SHA update/readback execution passed - ESLint passed for changed JavaScript/tests - Prettier passed for both workflows and changed JavaScript/tests - Node syntax and `git diff --check` passed The existing broader cPanel release test is also updated; the local cached dependency set cannot collect that file because `jszip` is absent, so protected CI remains the full-suite authority.
This commit is contained in:
Jeppe B
@@ -107,6 +107,7 @@ jobs:
|
||||
&& proof.releaseManagerGate === "passed"
|
||||
&& proof.serverVersionUpdated === true
|
||||
&& proof.serverVersionReadBack === "passed"
|
||||
&& /^[1-9][0-9]*-[1-9][0-9]*$/.test(String(proof.buildId || ""))
|
||||
&& typeof proof.activeTarget === "string"
|
||||
&& proof.activeTarget.startsWith(expectedPrefix)
|
||||
&& proof.activeTarget.endsWith("/dist");
|
||||
@@ -115,6 +116,7 @@ jobs:
|
||||
throw new Error("Rollback target does not match the verified release proof.");
|
||||
}
|
||||
appendFileSync(process.env.GITHUB_OUTPUT, `verified_target=${proof.activeTarget}\n`);
|
||||
appendFileSync(process.env.GITHUB_OUTPUT, `build_id=${proof.buildId}\n`);
|
||||
NODE
|
||||
|
||||
- name: Capture current immutable target
|
||||
@@ -135,7 +137,10 @@ jobs:
|
||||
if (!/^[a-f0-9]{40}$/.test(sha) || !/^[A-Za-z0-9._-]{1,180}$/.test(build)) {
|
||||
throw new Error("Active manifest has invalid release identity.");
|
||||
}
|
||||
appendFileSync(process.env.GITHUB_OUTPUT, `previous_sha=${sha}\nprevious_target=releases/${sha}-${build}/dist\n`);
|
||||
if (!/^[1-9][0-9]*-[1-9][0-9]*$/.test(build)) {
|
||||
throw new Error("Active manifest build id is not a release run identity.");
|
||||
}
|
||||
appendFileSync(process.env.GITHUB_OUTPUT, `previous_sha=${sha}\nprevious_build_id=${build}\nprevious_target=releases/${sha}-${build}/dist\n`);
|
||||
NODE
|
||||
|
||||
- name: Setup Node.js
|
||||
@@ -224,7 +229,9 @@ jobs:
|
||||
run: npm run release:update-server-version
|
||||
env:
|
||||
SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
|
||||
RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
|
||||
RELEASE_VERSION: ${{ inputs.source_sha }}
|
||||
RELEASE_BUILD_ID: ${{ steps.authorize.outputs.build_id }}
|
||||
RELEASE_VERSION_UPDATE_REQUIRED: "true"
|
||||
|
||||
- name: Publish recovery audit
|
||||
@@ -264,6 +271,7 @@ jobs:
|
||||
NODE_OPTIONS: --use-system-ca
|
||||
RELEASE_ROLLBACK_TARGET: ${{ steps.current.outputs.previous_target }}
|
||||
RELEASE_VERSION: ${{ steps.current.outputs.previous_sha }}
|
||||
RELEASE_BUILD_ID: ${{ steps.current.outputs.previous_build_id }}
|
||||
RELEASE_VERSION_UPDATE_REQUIRED: "true"
|
||||
PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }}
|
||||
PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }}
|
||||
@@ -272,3 +280,4 @@ jobs:
|
||||
PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
|
||||
PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
|
||||
SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
|
||||
RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
|
||||
|
||||
@@ -344,6 +344,7 @@ jobs:
|
||||
run: npm run release:update-server-version
|
||||
env:
|
||||
SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
|
||||
RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
|
||||
RELEASE_VERSION: ${{ github.event.workflow_run.head_sha }}
|
||||
RELEASE_VERSION_UPDATE_REQUIRED: "true"
|
||||
|
||||
@@ -425,8 +426,9 @@ jobs:
|
||||
run: |
|
||||
set -euo pipefail
|
||||
node scripts/release/deploy-cpanel.mjs --rollback
|
||||
[[ "$RELEASE_ROLLBACK_TARGET" =~ ^releases/([a-f0-9]{40})-[A-Za-z0-9._-]+/dist$ ]]
|
||||
[[ "$RELEASE_ROLLBACK_TARGET" =~ ^releases/([a-f0-9]{40})-([1-9][0-9]*-[1-9][0-9]*)/dist$ ]]
|
||||
export RELEASE_VERSION="${BASH_REMATCH[1]}"
|
||||
export RELEASE_BUILD_ID="${BASH_REMATCH[2]}"
|
||||
npm run release:update-server-version
|
||||
env:
|
||||
NODE_OPTIONS: --use-system-ca
|
||||
@@ -438,6 +440,7 @@ jobs:
|
||||
PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }}
|
||||
PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }}
|
||||
SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }}
|
||||
RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}
|
||||
RELEASE_VERSION_UPDATE_REQUIRED: "true"
|
||||
|
||||
- name: Upload Playwright report
|
||||
|
||||
@@ -31,48 +31,86 @@ async function boundedJson(response, limit = 64 * 1024) {
|
||||
}
|
||||
|
||||
export async function updateServerVersion(env = process.env, fetchImpl = globalThis.fetch) {
|
||||
const token = env.SERVER_UPDATE_TOKEN;
|
||||
const serverToken = String(env.SERVER_UPDATE_TOKEN || "").trim();
|
||||
const releaseGateToken = String(env.RELEASE_MANAGER_GATE_TOKEN || "").trim();
|
||||
const token = serverToken || releaseGateToken;
|
||||
const useReleaseGate = !serverToken && Boolean(releaseGateToken);
|
||||
const required = env.RELEASE_VERSION_UPDATE_REQUIRED === "true";
|
||||
if (!token) {
|
||||
if (required) {
|
||||
throw new Error("SERVER_UPDATE_TOKEN is required after deploy verification.");
|
||||
throw new Error("SERVER_UPDATE_TOKEN or RELEASE_MANAGER_GATE_TOKEN is required after deploy verification.");
|
||||
}
|
||||
console.log("SERVER_UPDATE_TOKEN is not set. Skipping server version update.");
|
||||
console.log("No server version credential is set. Skipping server version update.");
|
||||
return;
|
||||
}
|
||||
|
||||
const version = String(env.RELEASE_VERSION || env.RELEASE_EXPECTED_COMMIT || env.GITHUB_SHA || gitCommit())
|
||||
.toLowerCase();
|
||||
const version = String(
|
||||
env.RELEASE_VERSION || env.RELEASE_EXPECTED_COMMIT || env.GITHUB_SHA || gitCommit()
|
||||
).toLowerCase();
|
||||
if (!/^[a-f0-9]{40}$/.test(version)) {
|
||||
throw new Error("Server release version must be a full lowercase commit SHA.");
|
||||
}
|
||||
|
||||
const baseUrl = env.SERVER_UPDATE_URL || "https://api-v2.truckwash.io/master/api/worker/update-version";
|
||||
const baseUrl =
|
||||
env.SERVER_UPDATE_URL ||
|
||||
(useReleaseGate
|
||||
? "https://api-v2.truckwash.io/master/api/release/gate/frontend-version"
|
||||
: "https://api-v2.truckwash.io/master/api/worker/update-version");
|
||||
const url = new URL(baseUrl);
|
||||
if (url.protocol !== "https:" || url.username || url.password) {
|
||||
throw new Error("SERVER_UPDATE_URL must be an HTTPS URL without embedded credentials.");
|
||||
}
|
||||
url.searchParams.set("version", version);
|
||||
|
||||
const response = await fetchImpl(url, {
|
||||
method: "GET",
|
||||
const request = {
|
||||
method: useReleaseGate ? "POST" : "GET",
|
||||
redirect: "manual",
|
||||
signal: AbortSignal.timeout(30_000),
|
||||
headers: {
|
||||
Authorization: `Bearer ${token}`,
|
||||
"Cache-Control": "no-cache",
|
||||
},
|
||||
});
|
||||
};
|
||||
if (useReleaseGate) {
|
||||
const repository = String(env.GITHUB_REPOSITORY || "copenhagentruckwash/pleno-vue").trim();
|
||||
const branch = String(env.RELEASE_BRANCH || "master")
|
||||
.trim()
|
||||
.toLowerCase();
|
||||
const buildId = String(env.RELEASE_BUILD_ID || env.RELEASE_EXPECTED_BUILD_ID || "").trim();
|
||||
if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository)) {
|
||||
throw new Error("Frontend release repository is invalid.");
|
||||
}
|
||||
if (branch !== "master") {
|
||||
throw new Error("Frontend release branch must be master.");
|
||||
}
|
||||
if (!/^[1-9][0-9]*-[1-9][0-9]*$/.test(buildId)) {
|
||||
throw new Error("Frontend release build id is invalid.");
|
||||
}
|
||||
request.headers["Content-Type"] = "application/json";
|
||||
request.body = JSON.stringify({ version, repository, branch, build_id: buildId });
|
||||
} else {
|
||||
url.searchParams.set("version", version);
|
||||
}
|
||||
|
||||
const response = await fetchImpl(url, request);
|
||||
|
||||
const body = await boundedJson(response).catch(() => ({}));
|
||||
if (!response.ok) {
|
||||
throw new Error(`Server version update failed with HTTP ${response.status}.`);
|
||||
}
|
||||
|
||||
const readUrl = new URL(env.SERVER_VERSION_READ_URL
|
||||
|| "https://api-v2.truckwash.io/master/api/worker/version");
|
||||
if (readUrl.protocol !== "https:" || readUrl.origin !== url.origin
|
||||
|| readUrl.username || readUrl.password || readUrl.search || readUrl.hash) {
|
||||
const readUrl = new URL(
|
||||
env.SERVER_VERSION_READ_URL ||
|
||||
(useReleaseGate
|
||||
? "https://api-v2.truckwash.io/master/api/release/gate/frontend-version"
|
||||
: "https://api-v2.truckwash.io/master/api/worker/version")
|
||||
);
|
||||
if (
|
||||
readUrl.protocol !== "https:" ||
|
||||
readUrl.origin !== url.origin ||
|
||||
readUrl.username ||
|
||||
readUrl.password ||
|
||||
readUrl.search ||
|
||||
readUrl.hash
|
||||
) {
|
||||
throw new Error("SERVER_VERSION_READ_URL must be an exact HTTPS URL on the update origin.");
|
||||
}
|
||||
readUrl.searchParams.set("verify", `${Date.now()}`);
|
||||
|
||||
@@ -81,6 +81,7 @@ describe("Control Plane release evidence", () => {
|
||||
expect(workflow).toContain("steps.credentialed_live_config.outputs.configured == 'true'");
|
||||
expect(workflow).toContain("Roll back after any post-deployment verification failure");
|
||||
expect(workflow).toContain('RELEASE_VERSION_UPDATE_REQUIRED: "true"');
|
||||
expect(workflow).toContain("RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}");
|
||||
expect(workflow).toContain("npm run release:update-server-version");
|
||||
expect(workflow).not.toContain("continue-on-error: true\n timeout-minutes: 5");
|
||||
expect(workflow.indexOf("Roll back after any post-deployment verification failure")).toBeGreaterThan(
|
||||
@@ -109,6 +110,8 @@ describe("Control Plane release evidence", () => {
|
||||
expect(recovery).toContain("node scripts/release/deploy-cpanel.mjs --rollback");
|
||||
expect(recovery).toContain('PLAYWRIGHT_REQUIRE_LIVE_CREDENTIALS: "true"');
|
||||
expect(recovery).toContain("RELEASE_VERSION: ${{ inputs.source_sha }}");
|
||||
expect(recovery).toContain("RELEASE_BUILD_ID: ${{ steps.authorize.outputs.build_id }}");
|
||||
expect(recovery).toContain("RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}");
|
||||
expect(recovery).toContain("PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }}");
|
||||
});
|
||||
});
|
||||
@@ -144,7 +147,7 @@ describe("server version release proof", () => {
|
||||
},
|
||||
fetchImpl
|
||||
)
|
||||
).rejects.toThrow("SERVER_UPDATE_TOKEN is required");
|
||||
).rejects.toThrow("SERVER_UPDATE_TOKEN or RELEASE_MANAGER_GATE_TOKEN is required");
|
||||
});
|
||||
});
|
||||
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
import { describe, expect, it, vi } from "vitest";
|
||||
|
||||
import { updateServerVersion } from "../../scripts/release/update-server-version.mjs";
|
||||
|
||||
describe("release gate server version proof", () => {
|
||||
it("uses the scoped release gate and independently reads back the exact full SHA", async () => {
|
||||
const version = "b".repeat(40);
|
||||
const calls = [];
|
||||
const fetchImpl = vi.fn(async (url, options) => {
|
||||
calls.push({ url: String(url), options });
|
||||
return new Response(JSON.stringify({ data: { version } }));
|
||||
});
|
||||
|
||||
const result = await updateServerVersion(
|
||||
{
|
||||
RELEASE_MANAGER_GATE_TOKEN: "release-gate-token",
|
||||
RELEASE_VERSION_UPDATE_REQUIRED: "true",
|
||||
RELEASE_VERSION: version,
|
||||
RELEASE_BUILD_ID: "30818161014-2",
|
||||
GITHUB_REPOSITORY: "copenhagentruckwash/pleno-vue",
|
||||
SERVER_UPDATE_URL: "https://api.example.test/release/gate/frontend-version",
|
||||
SERVER_VERSION_READ_URL: "https://api.example.test/release/gate/frontend-version",
|
||||
},
|
||||
fetchImpl
|
||||
);
|
||||
|
||||
expect(result.observed).toBe(version);
|
||||
expect(calls).toHaveLength(2);
|
||||
expect(calls[0].options.method).toBe("POST");
|
||||
expect(calls[0].options.headers.Authorization).toBe("Bearer release-gate-token");
|
||||
expect(JSON.parse(calls[0].options.body)).toEqual({
|
||||
version,
|
||||
repository: "copenhagentruckwash/pleno-vue",
|
||||
branch: "master",
|
||||
build_id: "30818161014-2",
|
||||
});
|
||||
expect(calls[1].options.method).toBe("GET");
|
||||
expect(calls[1].url).toContain("/release/gate/frontend-version?verify=");
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user