mirror of
https://github.com/Sea-Haven-Industries/shoc-frontend-new.git
synced 2026-09-30 11:33:12 +00:00
c96a259365
Some checks failed
Deploy dev content / Deploy shoc-frontend-new-dev through Terraform (push) Has been cancelled
* ci(cd): convert SPA hosting to handbook HCP and GitHub content CD Give HCP the bucket and CloudFront with an empty origin path. GitHub owns bucket-root sync and invalidation so merge-to-main and a human staging tag can deploy without creating HCP runs. G13 fails PRs that mix terraform/ with deployable application files. * ci: run Frontend checks and Terraform CI on PRs to main and dev Match backend 148 so a PR targeting origin/dev still gets the required checks. Push remains main only. * refactor(terraform): keep live/dev and live/staging as HCP roots Leave the adopted working directories in place so this CD PR does not retarget two live HCP workspaces. Flattening stays a later change. * style: prettier terraform-validate.mjs * fix(terraform): pin githubdeploy assume-role policy in import checker Reject controlled role updates whose trust document is not the rendered GitHub OIDC policy, matching the bucket-policy pin.
82 lines
2.2 KiB
Python
82 lines
2.2 KiB
Python
#!/usr/bin/env python3
|
|
"""Fail when a change set mixes Terraform with deployable application files.
|
|
|
|
Workflow, docs, and gate-script changes may travel with either side.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import sys
|
|
|
|
APP_SCRIPT_NAMES = {
|
|
"scripts/deploy-web.sh",
|
|
}
|
|
|
|
APP_ROOTS = (
|
|
"src/",
|
|
"public/",
|
|
"pages/",
|
|
"config/",
|
|
)
|
|
|
|
APP_FILES = {
|
|
"index.html",
|
|
"vite.config.ts",
|
|
"vitest.config.ts",
|
|
}
|
|
|
|
|
|
def is_terraform_path(path: str) -> bool:
|
|
return path == "terraform" or path.startswith("terraform/")
|
|
|
|
|
|
def is_app_path(path: str) -> bool:
|
|
normalized = path.replace("\\", "/")
|
|
if normalized in APP_SCRIPT_NAMES or normalized in APP_FILES:
|
|
return True
|
|
if normalized in {"src", "public", "pages", "config"}:
|
|
return True
|
|
if normalized.startswith(APP_ROOTS):
|
|
return True
|
|
if normalized.startswith("tsconfig"):
|
|
return True
|
|
return normalized.startswith(".env")
|
|
|
|
|
|
def isolation_violation(paths: list[str]) -> tuple[list[str], list[str]] | None:
|
|
terraform_files = sorted({path for path in paths if is_terraform_path(path)})
|
|
app_files = sorted({path for path in paths if is_app_path(path)})
|
|
if terraform_files and app_files:
|
|
return terraform_files, app_files
|
|
return None
|
|
|
|
|
|
def main() -> int:
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument(
|
|
"paths",
|
|
nargs="*",
|
|
help="Changed paths. Omit and pass newline-separated paths on stdin.",
|
|
)
|
|
args = parser.parse_args()
|
|
paths = list(args.paths)
|
|
if not paths and not sys.stdin.isatty():
|
|
paths = [line.strip() for line in sys.stdin if line.strip()]
|
|
violation = isolation_violation(paths)
|
|
if violation is None:
|
|
print("PASS: application and Terraform changes are isolated")
|
|
return 0
|
|
terraform_files, app_files = violation
|
|
print("FAIL: do not mix deployable application files with terraform/", file=sys.stderr)
|
|
print("terraform:", file=sys.stderr)
|
|
for path in terraform_files:
|
|
print(f" {path}", file=sys.stderr)
|
|
print("application:", file=sys.stderr)
|
|
for path in app_files:
|
|
print(f" {path}", file=sys.stderr)
|
|
return 1
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|