From d393c8c17508c46c61e97bd834a2e407367c69eb Mon Sep 17 00:00:00 2001 From: Jeppe B <2jepp9350@gmail.com> Date: Mon, 3 Aug 2026 16:27:43 +0200 Subject: [PATCH] Fix release version credential fallback (#258) ## Summary - fall back to the existing scoped `RELEASE_MANAGER_GATE_TOKEN` when `SERVER_UPDATE_TOKEN` is absent - record the exact frontend SHA through the release-gate endpoint, then independently read it back - preserve the legacy dedicated-token path when it is configured - carry the scoped credential and exact run-attempt build ID through normal releases, rollback recovery, and restore-on-failure ## Dependency Depends on backend PR copenhagentruckwash/api#342 being merged and deployed before this PR is merged. ## Verification - focused release-gate updater test: 1 passed - direct exact-SHA update/readback execution passed - ESLint passed for changed JavaScript/tests - Prettier passed for both workflows and changed JavaScript/tests - Node syntax and `git diff --check` passed The existing broader cPanel release test is also updated; the local cached dependency set cannot collect that file because `jszip` is absent, so protected CI remains the full-suite authority. --- .github/workflows/release-recovery.yml | 11 +++- .github/workflows/release.yml | 5 +- scripts/release/update-server-version.mjs | 68 ++++++++++++++++++----- tests/unit/cpanel-deploy.spec.js | 5 +- tests/unit/update-server-version.spec.js | 40 +++++++++++++ 5 files changed, 111 insertions(+), 18 deletions(-) create mode 100644 tests/unit/update-server-version.spec.js diff --git a/.github/workflows/release-recovery.yml b/.github/workflows/release-recovery.yml index 8fb9cc1e..551a0e1d 100644 --- a/.github/workflows/release-recovery.yml +++ b/.github/workflows/release-recovery.yml @@ -107,6 +107,7 @@ jobs: && proof.releaseManagerGate === "passed" && proof.serverVersionUpdated === true && proof.serverVersionReadBack === "passed" + && /^[1-9][0-9]*-[1-9][0-9]*$/.test(String(proof.buildId || "")) && typeof proof.activeTarget === "string" && proof.activeTarget.startsWith(expectedPrefix) && proof.activeTarget.endsWith("/dist"); @@ -115,6 +116,7 @@ jobs: throw new Error("Rollback target does not match the verified release proof."); } appendFileSync(process.env.GITHUB_OUTPUT, `verified_target=${proof.activeTarget}\n`); + appendFileSync(process.env.GITHUB_OUTPUT, `build_id=${proof.buildId}\n`); NODE - name: Capture current immutable target @@ -135,7 +137,10 @@ jobs: if (!/^[a-f0-9]{40}$/.test(sha) || !/^[A-Za-z0-9._-]{1,180}$/.test(build)) { throw new Error("Active manifest has invalid release identity."); } - appendFileSync(process.env.GITHUB_OUTPUT, `previous_sha=${sha}\nprevious_target=releases/${sha}-${build}/dist\n`); + if (!/^[1-9][0-9]*-[1-9][0-9]*$/.test(build)) { + throw new Error("Active manifest build id is not a release run identity."); + } + appendFileSync(process.env.GITHUB_OUTPUT, `previous_sha=${sha}\nprevious_build_id=${build}\nprevious_target=releases/${sha}-${build}/dist\n`); NODE - name: Setup Node.js @@ -224,7 +229,9 @@ jobs: run: npm run release:update-server-version env: SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }} + RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }} RELEASE_VERSION: ${{ inputs.source_sha }} + RELEASE_BUILD_ID: ${{ steps.authorize.outputs.build_id }} RELEASE_VERSION_UPDATE_REQUIRED: "true" - name: Publish recovery audit @@ -264,6 +271,7 @@ jobs: NODE_OPTIONS: --use-system-ca RELEASE_ROLLBACK_TARGET: ${{ steps.current.outputs.previous_target }} RELEASE_VERSION: ${{ steps.current.outputs.previous_sha }} + RELEASE_BUILD_ID: ${{ steps.current.outputs.previous_build_id }} RELEASE_VERSION_UPDATE_REQUIRED: "true" PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }} PRODUCTION_FTP_USER: ${{ secrets.PRODUCTION_FTP_USER }} @@ -272,3 +280,4 @@ jobs: PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }} PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }} SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }} + RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b3757c34..76d62b22 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -344,6 +344,7 @@ jobs: run: npm run release:update-server-version env: SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }} + RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }} RELEASE_VERSION: ${{ github.event.workflow_run.head_sha }} RELEASE_VERSION_UPDATE_REQUIRED: "true" @@ -425,8 +426,9 @@ jobs: run: | set -euo pipefail node scripts/release/deploy-cpanel.mjs --rollback - [[ "$RELEASE_ROLLBACK_TARGET" =~ ^releases/([a-f0-9]{40})-[A-Za-z0-9._-]+/dist$ ]] + [[ "$RELEASE_ROLLBACK_TARGET" =~ ^releases/([a-f0-9]{40})-([1-9][0-9]*-[1-9][0-9]*)/dist$ ]] export RELEASE_VERSION="${BASH_REMATCH[1]}" + export RELEASE_BUILD_ID="${BASH_REMATCH[2]}" npm run release:update-server-version env: NODE_OPTIONS: --use-system-ca @@ -438,6 +440,7 @@ jobs: PRODUCTION_ACTIVATION_KEY: ${{ secrets.PRODUCTION_ACTIVATION_KEY }} PRODUCTION_FRONTEND_URL: ${{ vars.PRODUCTION_FRONTEND_URL || 'https://truckwash.io' }} SERVER_UPDATE_TOKEN: ${{ secrets.SERVER_UPDATE_TOKEN }} + RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }} RELEASE_VERSION_UPDATE_REQUIRED: "true" - name: Upload Playwright report diff --git a/scripts/release/update-server-version.mjs b/scripts/release/update-server-version.mjs index ac111a5e..f88dec75 100644 --- a/scripts/release/update-server-version.mjs +++ b/scripts/release/update-server-version.mjs @@ -31,48 +31,86 @@ async function boundedJson(response, limit = 64 * 1024) { } export async function updateServerVersion(env = process.env, fetchImpl = globalThis.fetch) { - const token = env.SERVER_UPDATE_TOKEN; + const serverToken = String(env.SERVER_UPDATE_TOKEN || "").trim(); + const releaseGateToken = String(env.RELEASE_MANAGER_GATE_TOKEN || "").trim(); + const token = serverToken || releaseGateToken; + const useReleaseGate = !serverToken && Boolean(releaseGateToken); const required = env.RELEASE_VERSION_UPDATE_REQUIRED === "true"; if (!token) { if (required) { - throw new Error("SERVER_UPDATE_TOKEN is required after deploy verification."); + throw new Error("SERVER_UPDATE_TOKEN or RELEASE_MANAGER_GATE_TOKEN is required after deploy verification."); } - console.log("SERVER_UPDATE_TOKEN is not set. Skipping server version update."); + console.log("No server version credential is set. Skipping server version update."); return; } - const version = String(env.RELEASE_VERSION || env.RELEASE_EXPECTED_COMMIT || env.GITHUB_SHA || gitCommit()) - .toLowerCase(); + const version = String( + env.RELEASE_VERSION || env.RELEASE_EXPECTED_COMMIT || env.GITHUB_SHA || gitCommit() + ).toLowerCase(); if (!/^[a-f0-9]{40}$/.test(version)) { throw new Error("Server release version must be a full lowercase commit SHA."); } - const baseUrl = env.SERVER_UPDATE_URL || "https://api-v2.truckwash.io/master/api/worker/update-version"; + const baseUrl = + env.SERVER_UPDATE_URL || + (useReleaseGate + ? "https://api-v2.truckwash.io/master/api/release/gate/frontend-version" + : "https://api-v2.truckwash.io/master/api/worker/update-version"); const url = new URL(baseUrl); if (url.protocol !== "https:" || url.username || url.password) { throw new Error("SERVER_UPDATE_URL must be an HTTPS URL without embedded credentials."); } - url.searchParams.set("version", version); - - const response = await fetchImpl(url, { - method: "GET", + const request = { + method: useReleaseGate ? "POST" : "GET", redirect: "manual", signal: AbortSignal.timeout(30_000), headers: { Authorization: `Bearer ${token}`, "Cache-Control": "no-cache", }, - }); + }; + if (useReleaseGate) { + const repository = String(env.GITHUB_REPOSITORY || "copenhagentruckwash/pleno-vue").trim(); + const branch = String(env.RELEASE_BRANCH || "master") + .trim() + .toLowerCase(); + const buildId = String(env.RELEASE_BUILD_ID || env.RELEASE_EXPECTED_BUILD_ID || "").trim(); + if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(repository)) { + throw new Error("Frontend release repository is invalid."); + } + if (branch !== "master") { + throw new Error("Frontend release branch must be master."); + } + if (!/^[1-9][0-9]*-[1-9][0-9]*$/.test(buildId)) { + throw new Error("Frontend release build id is invalid."); + } + request.headers["Content-Type"] = "application/json"; + request.body = JSON.stringify({ version, repository, branch, build_id: buildId }); + } else { + url.searchParams.set("version", version); + } + + const response = await fetchImpl(url, request); const body = await boundedJson(response).catch(() => ({})); if (!response.ok) { throw new Error(`Server version update failed with HTTP ${response.status}.`); } - const readUrl = new URL(env.SERVER_VERSION_READ_URL - || "https://api-v2.truckwash.io/master/api/worker/version"); - if (readUrl.protocol !== "https:" || readUrl.origin !== url.origin - || readUrl.username || readUrl.password || readUrl.search || readUrl.hash) { + const readUrl = new URL( + env.SERVER_VERSION_READ_URL || + (useReleaseGate + ? "https://api-v2.truckwash.io/master/api/release/gate/frontend-version" + : "https://api-v2.truckwash.io/master/api/worker/version") + ); + if ( + readUrl.protocol !== "https:" || + readUrl.origin !== url.origin || + readUrl.username || + readUrl.password || + readUrl.search || + readUrl.hash + ) { throw new Error("SERVER_VERSION_READ_URL must be an exact HTTPS URL on the update origin."); } readUrl.searchParams.set("verify", `${Date.now()}`); diff --git a/tests/unit/cpanel-deploy.spec.js b/tests/unit/cpanel-deploy.spec.js index 0bd09ad1..72c26224 100644 --- a/tests/unit/cpanel-deploy.spec.js +++ b/tests/unit/cpanel-deploy.spec.js @@ -81,6 +81,7 @@ describe("Control Plane release evidence", () => { expect(workflow).toContain("steps.credentialed_live_config.outputs.configured == 'true'"); expect(workflow).toContain("Roll back after any post-deployment verification failure"); expect(workflow).toContain('RELEASE_VERSION_UPDATE_REQUIRED: "true"'); + expect(workflow).toContain("RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}"); expect(workflow).toContain("npm run release:update-server-version"); expect(workflow).not.toContain("continue-on-error: true\n timeout-minutes: 5"); expect(workflow.indexOf("Roll back after any post-deployment verification failure")).toBeGreaterThan( @@ -109,6 +110,8 @@ describe("Control Plane release evidence", () => { expect(recovery).toContain("node scripts/release/deploy-cpanel.mjs --rollback"); expect(recovery).toContain('PLAYWRIGHT_REQUIRE_LIVE_CREDENTIALS: "true"'); expect(recovery).toContain("RELEASE_VERSION: ${{ inputs.source_sha }}"); + expect(recovery).toContain("RELEASE_BUILD_ID: ${{ steps.authorize.outputs.build_id }}"); + expect(recovery).toContain("RELEASE_MANAGER_GATE_TOKEN: ${{ secrets.RELEASE_MANAGER_GATE_TOKEN }}"); expect(recovery).toContain("PRODUCTION_FTP_HOST: ${{ secrets.PRODUCTION_FTP_HOST }}"); }); }); @@ -144,7 +147,7 @@ describe("server version release proof", () => { }, fetchImpl ) - ).rejects.toThrow("SERVER_UPDATE_TOKEN is required"); + ).rejects.toThrow("SERVER_UPDATE_TOKEN or RELEASE_MANAGER_GATE_TOKEN is required"); }); }); diff --git a/tests/unit/update-server-version.spec.js b/tests/unit/update-server-version.spec.js new file mode 100644 index 00000000..0dec2c66 --- /dev/null +++ b/tests/unit/update-server-version.spec.js @@ -0,0 +1,40 @@ +import { describe, expect, it, vi } from "vitest"; + +import { updateServerVersion } from "../../scripts/release/update-server-version.mjs"; + +describe("release gate server version proof", () => { + it("uses the scoped release gate and independently reads back the exact full SHA", async () => { + const version = "b".repeat(40); + const calls = []; + const fetchImpl = vi.fn(async (url, options) => { + calls.push({ url: String(url), options }); + return new Response(JSON.stringify({ data: { version } })); + }); + + const result = await updateServerVersion( + { + RELEASE_MANAGER_GATE_TOKEN: "release-gate-token", + RELEASE_VERSION_UPDATE_REQUIRED: "true", + RELEASE_VERSION: version, + RELEASE_BUILD_ID: "30818161014-2", + GITHUB_REPOSITORY: "copenhagentruckwash/pleno-vue", + SERVER_UPDATE_URL: "https://api.example.test/release/gate/frontend-version", + SERVER_VERSION_READ_URL: "https://api.example.test/release/gate/frontend-version", + }, + fetchImpl + ); + + expect(result.observed).toBe(version); + expect(calls).toHaveLength(2); + expect(calls[0].options.method).toBe("POST"); + expect(calls[0].options.headers.Authorization).toBe("Bearer release-gate-token"); + expect(JSON.parse(calls[0].options.body)).toEqual({ + version, + repository: "copenhagentruckwash/pleno-vue", + branch: "master", + build_id: "30818161014-2", + }); + expect(calls[1].options.method).toBe("GET"); + expect(calls[1].url).toContain("/release/gate/frontend-version?verify="); + }); +});