busya
bcc69f4bbe
Add versioned metric graph authority, owned browser evidence, paginated and all-tab traversal, deterministic sampling policies, and analyst-facing run inspection. Provision the DEV/PREPROD/PROD Superset, Gitea and million-row ClickHouse lab; retain reproducible lifecycle evidence and explicit incomplete-traversal limits.
46 lines
2.7 KiB
Python
46 lines
2.7 KiB
Python
#!/usr/bin/env python3
|
|
#region FullFlow.GitBootstrap [C:4] [TYPE Module] [SEMANTICS gitea,fixture,publication,secrets]
|
|
# @PURPOSE Create a real local Git publication repository and save its PAT in isolated credentials.
|
|
# @PRE Gitea admin exists; the fixture env is mode 0600; localhost:18300 is the isolated Gitea.
|
|
# @POST baseline-catalogs repository exists and deployment publication coordinates are saved.
|
|
# @INVARIANT Credentials and tokens are never printed; existing credentials are reused unless rotation is explicit.
|
|
import base64
|
|
import json
|
|
import os
|
|
import secrets
|
|
from pathlib import Path
|
|
import sys
|
|
import urllib.error
|
|
import urllib.request
|
|
|
|
path = Path(sys.argv[1] if len(sys.argv) > 1 else '/tmp/ss-tools-full-flow.env')
|
|
if path.stat().st_mode & 0o077:
|
|
raise SystemExit('Fixture env must have mode 0600')
|
|
values = dict(line.split('=', 1) for line in path.read_text().splitlines() if '=' in line)
|
|
authorization = 'Basic ' + base64.b64encode(f'admin:{values["FIXTURE_PASSWORD"]}'.encode()).decode()
|
|
|
|
# #region FullFlow.GitBootstrap.ApiRequest [C:2] [TYPE Function]
|
|
# @BRIEF Call the isolated Gitea API with privately loaded fixture credentials.
|
|
# @INVARIANT Credentials and response tokens are not printed.
|
|
def call(route, payload=None):
|
|
request = urllib.request.Request('http://127.0.0.1:18300/api/v1' + route, data=json.dumps(payload).encode() if payload is not None else None, headers={'Authorization':authorization,'Content-Type':'application/json'})
|
|
with urllib.request.urlopen(request, timeout=30) as response:
|
|
return json.load(response)
|
|
# #endregion FullFlow.GitBootstrap.ApiRequest
|
|
|
|
try:
|
|
call('/repos/admin/baseline-catalogs')
|
|
except urllib.error.HTTPError as error:
|
|
if error.code != 404:
|
|
raise
|
|
call('/user/repos', {'name':'baseline-catalogs','private':True,'auto_init':True,'default_branch':'main','description':'Isolated actual baseline publication evidence'})
|
|
if not values.get('PUBLISHED_CATALOG_GITEA_TOKEN') or '--rotate-token' in sys.argv[2:]:
|
|
token = call('/users/admin/tokens', {'name':f'full-flow-publication-{secrets.token_hex(6)}','scopes':['write:repository','write:user']})['sha1']
|
|
values.update(PUBLISHED_CATALOG_GITEA_URL='http://gitea:3000', PUBLISHED_CATALOG_GITEA_TOKEN=token, PUBLISHED_CATALOG_REPO='admin/baseline-catalogs', PUBLISHED_CATALOG_REF='main')
|
|
temporary = path.with_name(path.name + '.new')
|
|
with os.fdopen(os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600), 'w') as file:
|
|
file.write(''.join(f'{key}={value}\n' for key, value in values.items()))
|
|
os.replace(temporary, path)
|
|
print('Local Git publication repository ready; credentials saved privately. Recreate backend to apply publication coordinates.')
|
|
#endregion FullFlow.GitBootstrap
|