mirror of
https://github.com/Sea-Haven-Industries/.github.git
synced 2026-10-07 16:18:55 +00:00
Adam Moussa
e7712e6d0f
Deleted paths were excluded from the isolation diff, so a mixed change could pass. The checker now treats working-directory as the Terraform prefix.
117 lines
3.6 KiB
Python
117 lines
3.6 KiB
Python
#!/usr/bin/env python3
|
|
"""Fail when a change set mixes Terraform with deployable application files.
|
|
|
|
APP_PATHS is newline-separated. A trailing slash is a directory prefix.
|
|
Any other entry is an exact file. Paths that are not listed are neutral, so
|
|
workflows, docs, and tests may travel with either side. An empty APP_PATHS
|
|
skips the check.
|
|
|
|
TERRAFORM_DIR is the Terraform working directory (default terraform). A path
|
|
is Terraform when it equals that directory or sits under it.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import os
|
|
import sys
|
|
|
|
|
|
def parse_app_rules(raw: str) -> tuple[frozenset[str], frozenset[str]]:
|
|
prefixes: set[str] = set()
|
|
exact: set[str] = set()
|
|
for line in raw.splitlines():
|
|
item = line.strip().replace("\\", "/")
|
|
if not item or item.startswith("#"):
|
|
continue
|
|
if item.endswith("/"):
|
|
prefixes.add(item)
|
|
else:
|
|
exact.add(item)
|
|
return frozenset(prefixes), frozenset(exact)
|
|
|
|
|
|
def terraform_prefix(terraform_dir: str) -> str:
|
|
prefix = terraform_dir.replace("\\", "/").strip().strip("/")
|
|
return prefix or "terraform"
|
|
|
|
|
|
def is_terraform_path(path: str, terraform_dir: str = "terraform") -> bool:
|
|
normalized = path.replace("\\", "/")
|
|
prefix = terraform_prefix(terraform_dir)
|
|
return normalized == prefix or normalized.startswith(f"{prefix}/")
|
|
|
|
|
|
def is_app_path(path: str, prefixes: frozenset[str], exact: frozenset[str]) -> bool:
|
|
normalized = path.replace("\\", "/")
|
|
if normalized in exact:
|
|
return True
|
|
for prefix in prefixes:
|
|
if normalized.startswith(prefix) or f"{normalized}/" == prefix:
|
|
return True
|
|
return False
|
|
|
|
|
|
def isolation_violation(
|
|
paths: list[str],
|
|
app_paths: str,
|
|
terraform_dir: str = "terraform",
|
|
) -> tuple[list[str], list[str]] | None:
|
|
prefixes, exact = parse_app_rules(app_paths)
|
|
if not prefixes and not exact:
|
|
return None
|
|
terraform_files = sorted(
|
|
{path for path in paths if is_terraform_path(path, terraform_dir)}
|
|
)
|
|
app_files = sorted({path for path in paths if is_app_path(path, prefixes, exact)})
|
|
if terraform_files and app_files:
|
|
return terraform_files, app_files
|
|
return None
|
|
|
|
|
|
def first_isolation_violation(
|
|
file_sets: list[list[str]],
|
|
app_paths: str,
|
|
terraform_dir: str = "terraform",
|
|
) -> tuple[list[str], list[str]] | None:
|
|
for paths in file_sets:
|
|
violation = isolation_violation(paths, app_paths, terraform_dir)
|
|
if violation is not None:
|
|
return violation
|
|
return None
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument(
|
|
"paths",
|
|
nargs="*",
|
|
help="Changed paths. Omit and pass newline-separated paths on stdin.",
|
|
)
|
|
args = parser.parse_args()
|
|
paths = list(args.paths)
|
|
if not paths and not sys.stdin.isatty():
|
|
paths = [line.strip() for line in sys.stdin if line.strip()]
|
|
terraform_dir = terraform_prefix(os.environ.get("TERRAFORM_DIR", "terraform"))
|
|
violation = isolation_violation(
|
|
paths, os.environ.get("APP_PATHS", ""), terraform_dir
|
|
)
|
|
if violation is None:
|
|
print("PASS: application and Terraform changes are isolated")
|
|
return 0
|
|
terraform_files, app_files = violation
|
|
print(
|
|
f"FAIL: do not mix deployable application files with {terraform_dir}/",
|
|
file=sys.stderr,
|
|
)
|
|
print("terraform:", file=sys.stderr)
|
|
for path in terraform_files:
|
|
print(f" {path}", file=sys.stderr)
|
|
print("application:", file=sys.stderr)
|
|
for path in app_files:
|
|
print(f" {path}", file=sys.stderr)
|
|
return 1
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|