karti
13dec6b4b8
Seven parallel agents and an adversarial verification pass. The three things worth knowing before reading the diff: RBAC WAS ALREADY BUILT. docs/build-plan.md marks F2 and F3 outstanding and is stale — packages/core/src/permissions.ts and lib/mutation.ts shipped long ago. So this does not rebuild them; it closes the gaps an audit found. The big one is that reads were entirely ungoverned: every GET was "any authenticated member", so a junior demand rep and a research contractor could both pull per-block supplier cost and break-even prices from /api/capacity/margin, and every contract's negotiated terms. For a company whose margin is the business, that was the hole that mattered. Adds book:read / economics:read / team:read, a readGuard middleware, and a `viewer` role below member. THE BUTTON AND THE 403 DISAGREED — the exact thing F3 said must never happen. Contracts.tsx never called can() at all, so its save button was always enabled against a server requiring contract:sign; Capacity.tsx gated commitment creation on deal:write/demand while the server wanted commitment:write/supply. POST /api/activities was the one write bypassing executeMutation: no capability check, and any member could mutate accounts.lastActivityAt as a side effect. It is now a proper mutation() behind activity:write. The shell becomes three panes — a collapsible shadcn sidebar with an account switcher on the Piggy accent, a header with real search, and Piggy docked to the right, page-aware and persistent across navigation. The phone keeps its bottom tab bar, which is the thing this product already beat trycompai/crm on, and gains the sidebar as a sheet. Calendar is a projection over thirteen dated sources rather than a new table, because a table would duplicate dates that already live on contracts, deals and commitments and would drift — and one ledger answering the question is the whole argument. It surfaces export_authorizations and compliance_artifacts, which had indexed expires_at columns, schema comments saying they must be alerted on, and no read endpoint or UI anywhere. Learn carries two tracks. Concepts are members-only; the platform track can be opened with a share code by someone with no account. The code mints a scoped learn-only token and never a Principal — every route here resolves a principal and then checks capabilities, so a principal-minting code would be one missing check away from leaking the book. "Only platform-track rows may be code-visible" is a database CHECK constraint as well as a write-path rule, and a test asserts a valid learn token still gets 401 on /api/dashboard, /api/accounts and /api/contracts — the same invariant scripts/deploy.sh refuses to ship without. CD becomes tag-to-ship. CI publishes an image to the Gitea registry on a release-* tag and cloud-2 pulls it, so no credential on the shared runner can execute anything on production — by construction rather than by policy. Both halves of deploy.sh's original rule survive: nothing on the runner reaches the host, and a human still decides when it ships. deploy.sh gains a rollback and a public-origin check, and PIG_IMAGE now reaches compose through `sudo env`, without which sudo's env_reset silently resolved every release to pig:local. Tests 141 -> 261. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
186 lines
8.0 KiB
Bash
Executable File
186 lines
8.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Poll the registry for a new release and deploy it. Runs on the production
|
|
# host, on a timer. Installation: see deploy/README.md.
|
|
#
|
|
# This is the half of "push to deploy" that does not require handing the CI
|
|
# runner a key to this machine. CI publishes an image when a human tags
|
|
# `release-*`; this pulls. The only credential involved lives HERE, is
|
|
# read-only, and can do nothing but fetch a manifest.
|
|
#
|
|
# What it does, in order:
|
|
#
|
|
# 1. Ask the registry for the newest release-* tag.
|
|
# 2. Compare that tag's manifest digest with the digest of the image the
|
|
# running app container was started from. Equal -> exit 0, silently. This
|
|
# is the normal case and it happens every five minutes.
|
|
# 3. Otherwise check the working tree out at that tag — the compose file and
|
|
# the migrations must come from the same commit as the image — and hand
|
|
# over to scripts/deploy.sh with PIG_IMAGE set.
|
|
#
|
|
# A failed deploy is recorded and NOT retried. A poller that reattempts the
|
|
# same broken release every five minutes turns one bad tag into a restart loop;
|
|
# deleting the record (or tagging a new release) is the human's signal to try
|
|
# again.
|
|
|
|
set -euo pipefail
|
|
|
|
# git checkout rewrites this file while bash is reading it — bash reads a
|
|
# script incrementally, by byte offset, so a checkout mid-run resumes at an
|
|
# offset into different content. Re-exec from a private copy before touching
|
|
# git. This has a long history of producing genuinely baffling syntax errors.
|
|
if [ "${PIG_AUTODEPLOY_REEXEC:-}" != '1' ]; then
|
|
_copy=$(mktemp -t pig-autodeploy.XXXXXX)
|
|
cat "$0" > "$_copy"
|
|
PIG_AUTODEPLOY_REEXEC=1 exec bash "$_copy" "$@"
|
|
fi
|
|
trap 'rm -f "$0"' EXIT
|
|
|
|
REPO_DIR="${PIG_REPO_DIR:-/opt/pig}"
|
|
REGISTRY="${PIG_REGISTRY:-git.karti.ai}"
|
|
# Gitea namespaces packages under the lowercased owner: PIG/pig -> pig/pig.
|
|
IMAGE_REPO="${PIG_IMAGE_REPO:-pig/pig}"
|
|
TOKEN_FILE="${PIG_REGISTRY_TOKEN_FILE:-/etc/pig/registry-token}"
|
|
REGISTRY_USER="${PIG_REGISTRY_USER:-pig-deploy}"
|
|
STATE_DIR="${PIG_STATE_DIR:-/var/lib/pig}"
|
|
TAG_PREFIX="${PIG_RELEASE_TAG_PREFIX:-release-}"
|
|
|
|
IMAGE_NAME="$REGISTRY/$IMAGE_REPO"
|
|
FAILED_MARKER="$STATE_DIR/failed-release"
|
|
|
|
log() { printf '%s autodeploy: %s\n' "$(date -Is)" "$*"; }
|
|
die() { log "ERROR: $*"; exit 1; }
|
|
|
|
# Only one deploy at a time. The systemd timer will not overlap a run with
|
|
# itself, but a human running this by hand during a scheduled run would.
|
|
LOCK="${PIG_LOCK_FILE:-/var/lock/pig-autodeploy.lock}"
|
|
exec 9>"$LOCK"
|
|
if ! flock -n 9; then
|
|
log "another run holds $LOCK; nothing to do"
|
|
exit 0
|
|
fi
|
|
|
|
[ -r "$TOKEN_FILE" ] || die "no readable registry token at $TOKEN_FILE"
|
|
# The token is the only secret here and it is pull-only, but a world-readable
|
|
# credential on a production host is still worth refusing.
|
|
PERMS=$(stat -c '%a' "$TOKEN_FILE")
|
|
case "$PERMS" in
|
|
600|400) ;;
|
|
*) die "$TOKEN_FILE is mode $PERMS; must be 0600" ;;
|
|
esac
|
|
REGISTRY_TOKEN=$(tr -d '\r\n' < "$TOKEN_FILE")
|
|
[ -n "$REGISTRY_TOKEN" ] || die "$TOKEN_FILE is empty"
|
|
|
|
cd "$REPO_DIR" || die "no checkout at $REPO_DIR"
|
|
|
|
# ---------------------------------------------------------------- registry
|
|
#
|
|
# Gitea's registry speaks the standard v2 token dance: an unauthenticated
|
|
# request gets a 401 pointing at /v2/token. Exchange the pull-only credential
|
|
# for a bearer token scoped to this one repository and fall back to basic auth
|
|
# if the exchange gives nothing, because Gitea accepts both and which one you
|
|
# get has changed across versions.
|
|
AUTH_ARGS=()
|
|
BEARER=$(curl -sS --max-time 20 -u "$REGISTRY_USER:$REGISTRY_TOKEN" \
|
|
"https://$REGISTRY/v2/token?service=$REGISTRY&scope=repository:$IMAGE_REPO:pull" \
|
|
2>/dev/null | sed -n 's/.*"token":"\([^"]*\)".*/\1/p' | head -n1 || true)
|
|
if [ -n "$BEARER" ]; then
|
|
AUTH_ARGS=(-H "Authorization: Bearer $BEARER")
|
|
else
|
|
AUTH_ARGS=(-u "$REGISTRY_USER:$REGISTRY_TOKEN")
|
|
fi
|
|
|
|
MANIFEST_ACCEPT=(
|
|
-H 'Accept: application/vnd.oci.image.index.v1+json'
|
|
-H 'Accept: application/vnd.oci.image.manifest.v1+json'
|
|
-H 'Accept: application/vnd.docker.distribution.manifest.list.v2+json'
|
|
-H 'Accept: application/vnd.docker.distribution.manifest.v2+json'
|
|
)
|
|
|
|
TAGS_JSON=$(curl -sS --max-time 30 "${AUTH_ARGS[@]}" \
|
|
"https://$REGISTRY/v2/$IMAGE_REPO/tags/list?n=1000") \
|
|
|| die "could not reach https://$REGISTRY/v2/$IMAGE_REPO/tags/list"
|
|
|
|
# sort -V rather than sort: release-10 must come after release-9. This assumes
|
|
# release tags sort sensibly — date-stamped or semver. A tag scheme that does
|
|
# not is a tag scheme this poller will deploy in the wrong order.
|
|
LATEST_TAG=$(printf '%s' "$TAGS_JSON" | tr ',' '\n' \
|
|
| sed -n "s/.*\"\(${TAG_PREFIX}[^\"]*\)\".*/\1/p" | sort -V | tail -n1)
|
|
[ -n "$LATEST_TAG" ] || { log "no ${TAG_PREFIX}* tags published yet"; exit 0; }
|
|
|
|
REMOTE_DIGEST=$(curl -sSI --max-time 30 "${AUTH_ARGS[@]}" "${MANIFEST_ACCEPT[@]}" \
|
|
"https://$REGISTRY/v2/$IMAGE_REPO/manifests/$LATEST_TAG" \
|
|
| tr -d '\r' | sed -n 's/^[Dd]ocker-[Cc]ontent-[Dd]igest:[[:space:]]*//p' | tail -n1)
|
|
[ -n "$REMOTE_DIGEST" ] || die "no digest for $IMAGE_NAME:$LATEST_TAG"
|
|
|
|
# ---------------------------------------------------------------- compare
|
|
#
|
|
# Compare digests, not tags. A tag can be moved; a digest is the content. This
|
|
# also means a re-pushed tag redeploys, which is what you want the one time it
|
|
# matters.
|
|
RUNNING_DIGEST=""
|
|
RUNNING_CID=$(docker compose -p pig ps -q app 2>/dev/null | head -n1 || true)
|
|
if [ -n "$RUNNING_CID" ]; then
|
|
RUNNING_IMAGE=$(docker inspect -f '{{.Image}}' "$RUNNING_CID" 2>/dev/null || true)
|
|
if [ -n "$RUNNING_IMAGE" ]; then
|
|
RUNNING_DIGEST=$(docker image inspect "$RUNNING_IMAGE" \
|
|
--format '{{range .RepoDigests}}{{println .}}{{end}}' 2>/dev/null \
|
|
| sed -n "s|^$IMAGE_NAME@||p" | head -n1 || true)
|
|
fi
|
|
fi
|
|
|
|
if [ "$RUNNING_DIGEST" = "$REMOTE_DIGEST" ]; then
|
|
log "up to date at $LATEST_TAG ($REMOTE_DIGEST)"
|
|
exit 0
|
|
fi
|
|
|
|
if [ -f "$FAILED_MARKER" ] && [ "$(cat "$FAILED_MARKER")" = "$REMOTE_DIGEST" ]; then
|
|
log "$LATEST_TAG ($REMOTE_DIGEST) already failed to deploy; not retrying."
|
|
log "Remove $FAILED_MARKER to try again, or publish a new release tag."
|
|
exit 0
|
|
fi
|
|
|
|
log "deploying $LATEST_TAG"
|
|
log " running: ${RUNNING_DIGEST:-<none>}"
|
|
log " wanted: $REMOTE_DIGEST"
|
|
|
|
# ---------------------------------------------------------------- deploy
|
|
#
|
|
# Log in as root, which is the identity `sudo docker` in deploy.sh runs as, so
|
|
# the pull there finds this credential. Deliberately not logged out afterwards:
|
|
# a human re-running deploy.sh by hand needs the same pull to work, and the
|
|
# token is read-only.
|
|
printf '%s' "$REGISTRY_TOKEN" | docker login "$REGISTRY" -u "$REGISTRY_USER" --password-stdin > /dev/null \
|
|
|| die "docker login to $REGISTRY failed"
|
|
|
|
git fetch --tags --force --prune origin
|
|
# Detached, at the exact tag. The image, the compose file and the migration set
|
|
# must all come from one commit; a tree left on main while running a tagged
|
|
# image is how a migration gets applied that the image knows nothing about.
|
|
git checkout --detach --force "refs/tags/$LATEST_TAG" \
|
|
|| die "cannot check out refs/tags/$LATEST_TAG"
|
|
|
|
mkdir -p "$STATE_DIR"
|
|
if PIG_IMAGE="$IMAGE_NAME:$LATEST_TAG" bash scripts/deploy.sh; then
|
|
rm -f "$FAILED_MARKER"
|
|
printf '%s %s\n' "$LATEST_TAG" "$REMOTE_DIGEST" > "$STATE_DIR/current-release"
|
|
log "deployed $LATEST_TAG"
|
|
else
|
|
STATUS=$?
|
|
printf '%s' "$REMOTE_DIGEST" > "$FAILED_MARKER"
|
|
log "deploy of $LATEST_TAG FAILED (exit $STATUS)."
|
|
# What is serving right now depends on WHICH gate failed, and this line is
|
|
# what the on-call reads at 04:00. It used to claim a rollback unconditionally
|
|
# — including in the one case where the broken release is still up, which is
|
|
# precisely the case that needs hands. deploy.sh exits 3 for that.
|
|
if [ "$STATUS" -eq 3 ]; then
|
|
log "THE FAILING RELEASE IS STILL LIVE — deploy.sh did not roll back (it"
|
|
log "either judged the fault external to the release, had no previous image,"
|
|
log "or the restored image did not come up). Check the site NOW."
|
|
else
|
|
log "deploy.sh rolls the app back on a failed health, auth or public-marker"
|
|
log "gate, so the previous release should still be serving — verify that first."
|
|
fi
|
|
exit "$STATUS"
|
|
fi
|