63 lines
2.0 KiB
Python
63 lines
2.0 KiB
Python
from __future__ import annotations
|
|
|
|
import argparse
|
|
import json
|
|
from pathlib import Path
|
|
|
|
import yaml
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
DEFAULT_WORKFLOW = ROOT / ".gitea" / "workflows" / "ci.yml"
|
|
|
|
|
|
def _load_yaml(path: Path) -> dict:
|
|
return yaml.safe_load(path.read_text(encoding="utf-8")) or {}
|
|
|
|
|
|
def main() -> int:
|
|
ap = argparse.ArgumentParser(description="Lint the QuantEngine CI workflow for recurring service-binding mistakes.")
|
|
ap.add_argument("--workflow", default=str(DEFAULT_WORKFLOW))
|
|
args = ap.parse_args()
|
|
|
|
workflow_path = Path(args.workflow)
|
|
if not workflow_path.is_absolute():
|
|
workflow_path = (ROOT / workflow_path).resolve()
|
|
data = _load_yaml(workflow_path)
|
|
|
|
errors: list[str] = []
|
|
evidence: dict[str, object] = {
|
|
"workflow": str(workflow_path.relative_to(ROOT)),
|
|
"jobs": sorted((data.get("jobs") or {}).keys()),
|
|
}
|
|
|
|
jobs = data.get("jobs") or {}
|
|
core = jobs.get("validate-core") or {}
|
|
services = core.get("services") or {}
|
|
postgres = services.get("postgres") or {}
|
|
|
|
ports = postgres.get("ports") or []
|
|
if any(str(port).strip() == "5432:5432" for port in ports):
|
|
errors.append("validate-core.services.postgres.ports contains fixed host mapping 5432:5432")
|
|
|
|
if "PGHOST: postgres" not in workflow_path.read_text(encoding="utf-8"):
|
|
errors.append("workflow does not pin PGHOST=postgres for CI database steps")
|
|
|
|
if "QE_WBS_PG_DSN=host=postgres" not in workflow_path.read_text(encoding="utf-8"):
|
|
errors.append("workflow does not publish QE_WBS_PG_DSN with service hostname")
|
|
|
|
result = {
|
|
"formula_id": "GITEA_CI_WORKFLOW_LINT_V1",
|
|
"gate": "PASS" if not errors else "FAIL",
|
|
"errors": errors,
|
|
"evidence": evidence,
|
|
}
|
|
out = ROOT / "Temp" / "gitea_ci_workflow_lint_v1.json"
|
|
out.write_text(json.dumps(result, ensure_ascii=False, indent=2), encoding="utf-8")
|
|
print(json.dumps(result, ensure_ascii=False, indent=2))
|
|
return 0 if not errors else 1
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|