8eb4e498fc
UNVERIFIED: written, not yet run end to end; the handoff stopped it here. The rebuild runs in the working tree, so it can read what no commit carries: an untracked locale a glob picks up, a VITE_* key from an untracked root .env that the code reads (apiBaseUrl.js reads VITE_API_BASE_URL), a build env var such as DOXA_QA. Bytes built from those prove nothing about freshness, and the landing precondition caches a PASS per tree id. Build env vars are now scrubbed from each rebuild; vite.config.js writes down every file a build read when DOXA_BUILD_INPUTS is set (only this gate sets it); a bundle whose rebuild read an untracked file or such a key is NOT MEASURED (exit 75), naming the files. Measured before the stop: an untracked .env.local with an unreferenced VITE_ key leaves all-people-groups byte-identical (cf536c63), so only keys the code reads are held against a bundle.
170 lines
12 KiB
JavaScript
170 lines
12 KiB
JavaScript
#!/usr/bin/env node
|
|
/**
|
|
* check-composite-freshness.mjs — catch a COMPOSITE that shipped a STALE copy of a child.
|
|
*
|
|
* THE BUG THIS EXISTS TO PREVENT (real, 2026-09-21)
|
|
* A fix landed in `people-groups-grid`; that ONE bundle was rebuilt, verified locally AND
|
|
* live in a fresh context, and published. All true — and insufficient. `big-picture` (cap-4,
|
|
* tab-1 of the cap-5 SPA) and `dashboard-plus-grid` NEST that grid and COMPILE IT IN, so both
|
|
* kept shipping the PRE-FIX code. The surface that was proved is not the surface anyone opens.
|
|
* ★ A COMPOSITE IS A COPY TAKEN AT ITS OWN BUILD TIME, NOT A POINTER TO ITS CHILD.
|
|
*
|
|
* ★ WHY IT NOW REBUILDS AND COMPARES BYTES, NOT MTIMES (2026-09-25). The first version compared
|
|
* the newest child SOURCE mtime with the parent BUNDLE mtime. File times are not build facts:
|
|
* a git merge or checkout rewrites sources with checkout-time mtimes, so rega's publish of
|
|
* beb13da3 stopped on "doxa-maps-spa / plugin-studio / stack-demo STALE vs gospel-resources /
|
|
* research-dashboard" although a rebuild reproduced the committed bytes exactly — and two of
|
|
* those parents mount their children BY TAG at runtime, so they compile none of the child in
|
|
* and CANNOT be stale with respect to it. It was also gameable the other way: checking out the
|
|
* parents makes their mtimes new and the gate passes on stale code.
|
|
* The question is "does the committed bundle equal what its source builds TODAY?", so that is
|
|
* what is asked: each composite is rebuilt into a temp dir (vite.config.js DOXA_OUT_ROOT — never
|
|
* public/) and its sha256 compared with the committed bundle. Builds are deterministic (two runs
|
|
* → identical bytes, verified), so a difference is real: the committed parent predates a source
|
|
* change it compiles in — its own, or a child's. A child it only mounts by tag cannot move it.
|
|
*
|
|
* HOW IT WORKS
|
|
* 1. every plugin-designs/<b>/<b>.meta.json with `composes: [...]` is a composite parent (entries
|
|
* are still resolved and an unresolvable one is REPORTED — an unresolved edge is an unchecked
|
|
* edge);
|
|
* 2. BUNDLE=<parent> DOXA_OUT_ROOT=<tmp> vite build, then sha256(tmp) vs sha256(public/…/<b>.js);
|
|
* 3. differ ⇒ STALE (FAIL); no committed bundle ⇒ reported, not built ⇒ FAIL.
|
|
* Usage: node internal/check-composite-freshness.mjs [--only a,b] (~5-15 s per composite)
|
|
*
|
|
* NEGATIVE-TESTED 2026-09-25: an edit to people-groups-grid.vue with no rebuild fails the
|
|
* composites that compile it in; `touch` on every child source (no content change) still PASSES on
|
|
* a fresh tree — the mtime false alarm is gone.
|
|
*
|
|
* ★ INPUTS NO COMMIT HAS (2026-09-29). The rebuild runs in THIS working tree, so it can read what no
|
|
* commit will ever carry: an untracked or gitignored file a glob picks up (a locale JSON under
|
|
* library/i18n/locales/, a ./*.vue, a colors/*.js), a VITE_* key from an untracked root .env* that the code reads (Vite compiles it
|
|
* in: apiBaseUrl.js reads VITE_API_BASE_URL), a build env var (DOXA_QA, DX_SHIP_ONE_LOCALE, NODE_ENV).
|
|
* Bytes built from those are reproducible from no commit, so they say nothing about freshness, matching
|
|
* or not — and landing-preconditions caches a PASS per tree id, which is sound only if the verdict is a
|
|
* function of the tree. So build env vars are SCRUBBED from every rebuild; the build writes down every
|
|
* file it read (vite.config.js, DOXA_BUILD_INPUTS); and a bundle whose rebuild read an untracked file, or
|
|
* such a .env key, is NOT MEASURED (exit 75) with the files named. Tracked files are read as they are on
|
|
* disk, as before (a landing is refused anyway unless the tree is clean).
|
|
*/
|
|
import { readFileSync, existsSync, readdirSync, mkdtempSync, rmSync, realpathSync } from 'node:fs'
|
|
import { isWebBuilt } from './plugin-targets.mjs'
|
|
import { createHash } from 'node:crypto'
|
|
import { spawnSync } from 'node:child_process'
|
|
import { tmpdir } from 'node:os'
|
|
import { resolve, dirname, join, relative, sep } from 'node:path'
|
|
import { fileURLToPath } from 'node:url'
|
|
import { TREE_NAME, GATED_PROFILES } from './_tree-name.mjs'
|
|
|
|
const ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
|
|
const DESIGNS = join(ROOT, 'plugin-designs')
|
|
const TREE = join(ROOT, 'public', TREE_NAME)
|
|
const argv = process.argv.slice(2)
|
|
const oi = argv.indexOf('--only')
|
|
const ONLY = oi >= 0 && argv[oi + 1] ? new Set(argv[oi + 1].split(',')) : null
|
|
// NOT ONLY COMPOSITES (rega, 2026-09-25): a library change merged into main reached prayer-walk-planner,
|
|
// which composes nothing, so this gate could not see it was stale. --all checks EVERY bundle; --bundles a,b
|
|
// checks those (the landing precondition passes the ones a landing can have changed).
|
|
const ALL = argv.includes('--all')
|
|
const bi = argv.indexOf('--bundles')
|
|
const EXTRA = bi >= 0 && argv[bi + 1] ? new Set(argv[bi + 1].split(',').filter(Boolean)) : new Set()
|
|
|
|
if (!existsSync(join(TREE, 'manifest.json'))) {
|
|
console.log(`COMPOSITE-FRESHNESS: SKIP — no built tree (public/${TREE_NAME}/manifest.json).`)
|
|
process.exit(0)
|
|
}
|
|
const manifest = JSON.parse(readFileSync(join(TREE, 'manifest.json'), 'utf8'))
|
|
// tag -> owning bundle, so a composes entry naming an ELEMENT still resolves.
|
|
const byTag = new Map()
|
|
for (const b of manifest.bundles || []) for (const t of b.elements || []) byTag.set(t, b.bundle)
|
|
// A plugin that is not built into the web tree (plugin-targets.mjs: targets without "web") has no committed
|
|
// bundle by design, so it is not held to one.
|
|
// A GATED bundle (gatedProfiles) builds outside public/ on purpose (vite.config.js), so it has no committed
|
|
// bytes to be fresh against. Holding it to them is what rebuilt key-cities into public/ on every landing.
|
|
const bundles = new Set(readdirSync(DESIGNS).filter((d) => existsSync(join(DESIGNS, d, 'index.js')) && isWebBuilt(join(DESIGNS, d))
|
|
&& !GATED_PROFILES.includes(d)))
|
|
// A bare PROFILE name of the same bundle (gospel-resources composes "resources-map", "data-tables" —
|
|
// its own sibling profiles) resolves to that bundle, as the studio resolves it.
|
|
const profilesOf = new Map((manifest.bundles || []).map((b) => [b.bundle, new Set((b.profiles || []).map((p) => p.profile))]))
|
|
const resolveEntry = (e, parent) => { const s = String(e); const head = s.split('/')[0]
|
|
if (bundles.has(head)) return head
|
|
if (parent && profilesOf.get(parent) && profilesOf.get(parent).has(s)) return parent
|
|
return byTag.get(s) || null }
|
|
|
|
const sha = (p) => createHash('sha256').update(readFileSync(p)).digest('hex')
|
|
const SCRUB = /^(VITE_|DOXA_|DX_)|^NODE_ENV$/
|
|
const buildEnv = Object.fromEntries(Object.entries(process.env).filter(([k]) => !SCRUB.test(k)))
|
|
const scrubbed = Object.keys(process.env).filter((k) => SCRUB.test(k)).sort()
|
|
const ls = spawnSync('git', ['ls-files', '-z'], { cwd: ROOT, encoding: 'utf8', maxBuffer: 1 << 27 })
|
|
if (ls.status !== 0) {
|
|
console.log('COMPOSITE-FRESHNESS: ✗ NOT MEASURED — not a git checkout, so what is committed cannot be told from what is not.')
|
|
process.exit(75)
|
|
}
|
|
const tracked = new Set(ls.stdout.split('\0').filter(Boolean))
|
|
const ROOTS = [...new Set([ROOT, realpathSync(ROOT)])].map((r) => r + sep)
|
|
// Vite (mode production) loads these from the root; a VITE_* key in one is compiled in wherever the code reads it.
|
|
const envFiles = ['.env', '.env.local', '.env.production', '.env.production.local']
|
|
.filter((f) => existsSync(join(ROOT, f)) && !tracked.has(f))
|
|
.map((f) => ({ f, keys: [...readFileSync(join(ROOT, f), 'utf8').matchAll(/^\s*(?:export\s+)?(VITE_\w+)\s*=/gm)].map((m) => m[1]) }))
|
|
.filter((e) => e.keys.length)
|
|
const srcOf = new Map()
|
|
const readsKey = (rel, key) => {
|
|
if (!srcOf.has(rel)) { let t = ''; try { t = readFileSync(join(ROOT, rel), 'utf8') } catch { /* gone: reads nothing */ } srcOf.set(rel, t) }
|
|
return new RegExp(`import\\.meta\\.env\\??\\.${key}\\b`).test(srcOf.get(rel))
|
|
}
|
|
/** The files a rebuild read that no commit has, from the list the build wrote (null = it wrote none). */
|
|
function notCommitted(listFile) {
|
|
if (!existsSync(listFile)) return null
|
|
const read = [...new Set(readFileSync(listFile, 'utf8').split('\n').map((id) => id.split('?')[0])
|
|
.map((id) => { const r = ROOTS.find((x) => id.startsWith(x)); return r ? id.slice(r.length) : null })
|
|
.filter((rel) => rel && !rel.split(sep).includes('node_modules')))]
|
|
if (!read.length) return null
|
|
return [...read.filter((rel) => !tracked.has(rel.split(sep).join('/'))),
|
|
...envFiles.flatMap(({ f, keys }) => keys.filter((k) => read.some((rel) => readsKey(rel, k))).map((k) => `${f} (${k})`))]
|
|
}
|
|
const tmp = mkdtempSync(join(tmpdir(), 'composite-freshness-'))
|
|
const failures = [], unresolved = [], fresh = [], unmeasured = []
|
|
let composites = 0
|
|
try {
|
|
for (const bundle of [...bundles].sort()) {
|
|
if (ONLY && !ONLY.has(bundle)) continue
|
|
let composes = null
|
|
for (const f of readdirSync(join(DESIGNS, bundle)).filter((f) => f.endsWith('.meta.json'))) {
|
|
try { const c = JSON.parse(readFileSync(join(DESIGNS, bundle, f), 'utf8')).composes; if (Array.isArray(c) && c.length) composes = (composes || []).concat(c) } catch { /* not JSON: not a declaration */ }
|
|
}
|
|
if (!composes && !ALL && !EXTRA.has(bundle)) continue
|
|
for (const e of composes || []) if (!resolveEntry(e, bundle)) unresolved.push(`${bundle} composes "${e}" — resolves to no bundle`)
|
|
composites++
|
|
const committed = join(TREE, bundle, `${bundle}.js`)
|
|
if (!existsSync(committed)) { failures.push(`${bundle}: no committed bundle at public/${TREE_NAME}/${bundle}/${bundle}.js`); continue }
|
|
const out = join(tmp, bundle)
|
|
const inputs = join(tmp, `${bundle}.inputs`)
|
|
const r = spawnSync('bun', ['x', 'vite', 'build'], { cwd: ROOT, env: { ...buildEnv, BUNDLE: bundle, DOXA_OUT_ROOT: out, DOXA_BUILD_INPUTS: inputs }, encoding: 'utf8' })
|
|
const built = join(out, bundle, `${bundle}.js`)
|
|
if (r.status !== 0 || !existsSync(built)) {
|
|
failures.push(`${bundle}: the rebuild FAILED (exit ${r.status}) — ${String(r.stderr || r.stdout).trim().split('\n').slice(-2).join(' / ').slice(0, 200)}`)
|
|
continue
|
|
}
|
|
const foreign = notCommitted(inputs)
|
|
if (foreign === null) { unmeasured.push(`${bundle}: the build did not write down what it read (vite.config.js DOXA_BUILD_INPUTS)`); continue }
|
|
if (foreign.length) { unmeasured.push(`${bundle}: its rebuild read ${foreign.join(', ')} — in no commit, so its bytes prove nothing either way. Move it aside or commit it.`); continue }
|
|
if (sha(built) !== sha(committed)) {
|
|
failures.push(`${bundle} is STALE — the committed bundle is not what its source builds today (committed ${sha(committed).slice(0, 12)}, rebuilt ${sha(built).slice(0, 12)}). Rebuild it: BUNDLE=${bundle} bun x vite build, then bun run fix:sri.`)
|
|
} else fresh.push(bundle)
|
|
}
|
|
} finally { rmSync(tmp, { recursive: true, force: true }) }
|
|
|
|
console.log(`COMPOSITE-FRESHNESS: ${composites} bundle(s) rebuilt into a temp dir and compared byte for byte with the committed bundle.`)
|
|
if (scrubbed.length) console.log(` (build env scrubbed from every rebuild: ${scrubbed.join(', ')})`)
|
|
if (fresh.length) console.log(` ✓ ${fresh.join(', ')}`)
|
|
for (const u of unresolved) console.log(` ! UNRESOLVED ${u}`)
|
|
if (failures.length) {
|
|
console.log(`\nCOMPOSITE-FRESHNESS: FAIL — ${failures.length} composite(s):`)
|
|
for (const f of failures) console.log(` ✗ ${f}`)
|
|
process.exit(1)
|
|
}
|
|
if (unmeasured.length) {
|
|
console.log(`\nCOMPOSITE-FRESHNESS: NOT MEASURED — ${unmeasured.length} bundle(s); not a pass, not a failure:`)
|
|
for (const u of unmeasured) console.log(` ✗ NOT MEASURED ${u}`)
|
|
process.exit(75)
|
|
}
|
|
console.log('COMPOSITE-FRESHNESS: PASS — every committed composite is exactly what its source builds today.')
|