| #!/usr/bin/env node |
| |
| import { execFileSync } from 'node:child_process'; |
| import { createHash } from 'node:crypto'; |
| import { writeFileSync, readFileSync, mkdtempSync, rmSync } from 'node:fs'; |
| import os from 'node:os'; |
| import { manifestName, treeHash } from './release-identity.mjs'; |
| import path from 'node:path'; |
| import { assertCleanWorkingTree } from './check-clean-working-tree.mjs'; |
| const git = (...args) => |
| execFileSync('git', args, { encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 }).trim(); |
| const output = path.resolve(process.argv[2] || '/tmp/automaker-hf.tar'); |
| const sha = git('rev-parse', 'HEAD'); |
| assertCleanWorkingTree('Deployment export'); |
| const files = git('ls-tree', '-r', '--name-only', 'HEAD').split('\n'); |
| const forbidden = files.filter( |
| (f) => |
| /(^|\/)(\.automaker|\.aws|\.ssh|node_modules|data)(\/|$)/.test(f) || |
| (/(^|\/)\.env(?:\.|$)/.test(f) && !f.endsWith('.example')) || |
| (f !== '.npmrc' && /(^|\/)(id_rsa|id_ed25519|credentials|\.npmrc)$/.test(f)) || |
| /\.(pem|key|p12)$/.test(f) |
| ); |
| if ( |
| files.includes('.npmrc') && |
| git('show', 'HEAD:.npmrc') |
| .split('\n') |
| .some((line) => line.trim() && !/^[#;]/.test(line.trim())) |
| ) |
| throw new Error('Root .npmrc must contain comments only for this deployment export'); |
| if (forbidden.length) throw new Error(`Forbidden files tracked in source: ${forbidden.join(', ')}`); |
| for (const required of [ |
| 'Dockerfile', |
| 'entrypoint.sh', |
| 'update_settings.py', |
| 'package.json', |
| 'package-lock.json', |
| 'scripts/argus_runtime_bridge.py', |
| 'apps/server/package.json', |
| 'apps/ui/package.json', |
| 'libs/types/package.json', |
| ]) |
| if (!files.includes(required)) throw new Error(`Required deployment source missing: ${required}`); |
| if (files.includes(manifestName) || files.includes('build-provenance.json')) |
| throw new Error('Generated release manifests must never be tracked'); |
| const entries = execFileSync('git', ['ls-tree', '-rz', 'HEAD']) |
| .toString('utf8') |
| .split('\0') |
| .filter(Boolean) |
| .map((line) => { |
| const match = /^(\d+) blob ([a-f0-9]{40})\t([\s\S]+)$/.exec(line); |
| if (!match) throw new Error('Unsupported Git tree entry'); |
| return { mode: match[1], oid: match[2], path: match[3] }; |
| }); |
| const commit = execFileSync('git', ['cat-file', 'commit', sha]); |
| if (treeHash(entries) !== git('rev-parse', 'HEAD^{tree}')) throw new Error('Release tree mismatch'); |
| const buildTimestamp = new Date( |
| Number(git('show', '-s', '--format=%ct', 'HEAD')) * 1000 |
| ).toISOString(); |
| const manifest = { |
| schema: 1, |
| sourceSha: sha, |
| buildTimestamp, |
| commitBase64: commit.toString('base64'), |
| files: entries, |
| }; |
| |
| execFileSync('git', ['-c', 'tar.umask=0022', 'archive', '--format=tar', `--output=${output}`, sha]); |
| const temp = mkdtempSync(path.join(os.tmpdir(), 'argus-release-')); |
| try { |
| writeFileSync(path.join(temp, manifestName), JSON.stringify(manifest, null, 2) + '\n', { |
| mode: 0o644, |
| }); |
| execFileSync('tar', [ |
| '--append', |
| '--file', |
| output, |
| '--format=ustar', |
| '--mtime', |
| buildTimestamp, |
| '--owner=0', |
| '--group=0', |
| '--numeric-owner', |
| '-C', |
| temp, |
| manifestName, |
| ]); |
| } finally { |
| rmSync(temp, { recursive: true, force: true }); |
| } |
| const provenance = { |
| gitSha: sha, |
| buildTimestamp, |
| sha256: createHash('sha256').update(readFileSync(output)).digest('hex'), |
| format: 'git-archive-tar', |
| sourceFiles: files.length, |
| }; |
| writeFileSync(`${output}.provenance.json`, `${JSON.stringify(provenance, null, 2)}\n`, { |
| mode: 0o600, |
| }); |
| console.log(JSON.stringify({ output, ...provenance })); |
|
|
