fix: close deployment decoupling review

2026-08-05 07:52:32 +02:00
parent 5d037e97c4
commit 09834d5cd4
45 changed files with 1082 additions and 791 deletions
@@ -1,69 +1,125 @@
 #!/usr/bin/env bash
+# Category-based guard for active build, runtime, install, and launch coupling.
 set -euo pipefail

-cd "$(dirname "$0")/.."
+script_root="$(cd "$(dirname "$0")/.." && pwd -P)"
+scan_root="$script_root"
+if [[ "${1:-}" == --root ]]; then
+  [[ $# -eq 2 ]] || { echo "usage: $0 [--root PATH]" >&2; exit 2; }
+  scan_root="$2"
+elif [[ $# -ne 0 ]]; then
+  echo "usage: $0 [--root PATH]" >&2
+  exit 2
+fi
+[[ -d "$scan_root" ]] || { echo "coupling scan root is not a directory: $scan_root" >&2; exit 2; }
+cd "$scan_root"

-content_targets=(
-  .dockerignore
-  compose.yaml
-  docker-compose.dev.yml
-  deploy
-  docker
-  frontend/vite.config.ts
-  README.md
-  docs/install
-  docs/installazione-docker-4-contesti.md
-  .env.example
-  scripts/run-stack.sh
-  scripts/docker-smoke.sh
-)
+runtime_files=()
+install_files=()
+operator_files=()
+contract_test_files=()
+add_file() {
+  local array_name="$1" file="$2"
+  [[ ! -f "$file" ]] || eval "$array_name+=(\"\$file\")"
+}

-matches=$(
-  rg -n -i \
-    -g '!deploy/workspaces/**' \
-    -g '!docker/session-migrate.sh' \
-    -g '!docker/cutover-legacy-sessions.sh' \
-    -g '!docker/smoke/**' \
-    'omics_portal|chirone|localllm_default|datamart-builder|compose\.production\.yaml|compose\.psd-local\.yaml' \
-    "${content_targets[@]}" || true
-)
+for file in .dockerignore compose.yaml docker-compose.dev.yml frontend/vite.config.ts; do
+  add_file runtime_files "$file"
+done
+if [[ -d deploy ]]; then
+  while IFS= read -r -d '' file; do runtime_files+=("${file#./}"); done < <(
+    find deploy -type f ! -path 'deploy/workspaces/*' -print0
+  )
+fi
+if [[ -d docker ]]; then
+  while IFS= read -r -d '' file; do
+    case "$file" in
+      docker/session-migrate.sh|docker/cutover-legacy-sessions.sh) continue ;;
+    esac
+    runtime_files+=("${file#./}")
+  done < <(find docker -type f -print0)
+fi

-runtime_psd_matches=$(
-  rg -n -i \
-    -g '!deploy/workspaces/**' \
-    -g '!docker/session-migrate.sh' \
-    -g '!docker/cutover-legacy-sessions.sh' \
-    -g '!docker/smoke/**' \
-    '\bpsd\b' \
-    .dockerignore compose.yaml docker-compose.dev.yml deploy docker frontend/vite.config.ts \
-    .env.example scripts/run-stack.sh scripts/docker-smoke.sh || true
-)
+for file in README.md .env.example docs/installazione-docker-4-contesti.md; do
+  add_file install_files "$file"
+done
+if [[ -d docs/install ]]; then
+  while IFS= read -r -d '' file; do install_files+=("${file#./}"); done < <(
+    find docs/install -type f -print0
+  )
+fi
+
+if [[ -d scripts ]]; then
+  while IFS= read -r -d '' file; do
+    case "${file#scripts/}" in
+      test-no-deployment-coupling.sh|test-no-deployment-coupling-scope.sh) continue ;;
+      test-*.sh)
+        contract_test_files+=("${file#./}")
+        continue
+        ;;
+      verify-*.sh) continue ;;
+    esac
+    operator_files+=("${file#./}")
+  done < <(find scripts -maxdepth 1 -type f -print0)
+fi

 offenders=()
-for superseded_file in \
+scan_category() {
+  local label="$1" pattern="$2"; shift 2
+  local output rg_status
+  (($#)) || return 0
+  set +e
+  output="$(rg -n -i --with-filename -- "$pattern" "$@" 2>&1)"
+  rg_status=$?
+  set -e
+  case "$rg_status" in
+    0)
+      while IFS= read -r match; do offenders+=("$label: $match"); done <<<"$output"
+      ;;
+    1) ;;
+    *)
+      echo "coupling scan failed in $label (rg status $rg_status)" >&2
+      printf '%s\n' "$output" >&2
+      exit "$rg_status"
+      ;;
+  esac
+}
+
+for forbidden_file in \
  deploy/compose.production.yaml \
  deploy/compose.psd-local.yaml.example \
  deploy/compose.psd-local.yaml \
  scripts/bootstrap-local-psd-docker-config.sh \
-  harness/tests/test_psd_local_compose_contract.py
-do
-  [[ ! -e "$superseded_file" ]] || offenders+=("$superseded_file (forbidden active deployment filename)")
+  scripts/test-qwen-network-config.sh \
+  harness/tests/test_psd_local_compose_contract.py; do
+  [[ ! -e "$forbidden_file" ]] \
+    || offenders+=("active filename: $forbidden_file (superseded deployment contract)")
 done

-if [[ -n "$matches" ]]; then
-  while IFS= read -r match; do
-    offenders+=("$match")
-  done <<<"$matches"
-fi
+forbidden='omics_portal|chirone|localllm_default|datamart-builder|compose\.production\.yaml|compose\.psd-local\.yaml|\bpsd\b'
+scan_category runtime "$forbidden" "${runtime_files[@]}"
+scan_category install "$forbidden" "${install_files[@]}"
+scan_category operator "$forbidden" "${operator_files[@]}"
+# Contract tests legitimately quote forbidden names in negative assertions. Scan their positive
+# deployment wiring constructs instead, so a provider-owned network or retired overlay cannot be
+# required under a different test filename.
+positive_contract='networks(\?|\.)?\.?localllm_default|services(\?|\.)?\.?core(\?|\.)?\.?networks(\?|\.)?\.?localllm_default|docker compose[^\n]*(compose\.psd-local|compose\.production)|THT_PSD_[A-Z0-9_]*='
+scan_category contract-test "$positive_contract" "${contract_test_files[@]}"

-if [[ -n "$runtime_psd_matches" ]]; then
-  while IFS= read -r match; do
-    offenders+=("$match")
-  done <<<"$runtime_psd_matches"
-fi
-
-if rg -n 'command -v pi|PI_BIN="pi"|PI_BIN=pi' scripts/run-stack.sh >/dev/null; then
-  offenders+=("scripts/run-stack.sh (requires a host Pi binary)")
+if [[ -f scripts/run-stack.sh ]]; then
+  set +e
+  host_pi="$(rg -n 'command -v pi|PI_BIN="pi"|PI_BIN=pi' scripts/run-stack.sh 2>&1)"
+  host_pi_status=$?
+  set -e
+  case "$host_pi_status" in
+    0) offenders+=("operator: $host_pi") ;;
+    1) ;;
+    *)
+      echo "coupling scan failed in host-Pi contract (rg status $host_pi_status)" >&2
+      printf '%s\n' "$host_pi" >&2
+      exit "$host_pi_status"
+      ;;
+  esac
 fi

 if ((${#offenders[@]})); then