Jon Chery
bee9d02f01
---ci---
project: acdl
phase: 40
milestone: v1.9
status: execute
---/ci---
Phase 40 — contract-interpolation (REQ-103, REQ-104, D-081):
Interpolation:
- core/contract_resolver.py: _expand_vars(value, context) recursively
expands ${env.<field>} + ${contract.<field>} tokens (dotted paths
supported, e.g. ${env.state_backend.bucket}). Unknown tokens raise
ValueError (fail loud). Expansion is post-schema-validation,
pre-IR-resolution.
- resolve() accepts environment_override (D-088) — overrides the
contract's environment field BEFORE schema validation so interpolation
context is consistent.
- env context loaded via _load_env (self-contained, works as script +
package import); 'environment' alias for env 'name' so
${env.environment} resolves.
Environment schema + bindings:
- schemas/environment.schema.json (draft 2020-12): name, account_id,
region, state_backend, network, runner_role_arn, autonomy, confidence_threshold.
- core/environments/qa.json, prod.json, dr.json placeholder bindings
(attested, thresholds 0.75/0.90/0.95, placeholder account_id with
stderr warning at load).
- core/environment_check.py: load(env_name) helper + placeholder warning.
Sample contracts:
- contracts/static-assets.yaml + microservice.yaml use
acdl-${env.environment}-${contract.module}-${env.account_id}-${env.region}
naming pattern (region + account id + environment).
Tests: +35 (test_environment_schema.py, test_interpolation.py,
test_sample_contracts_interpolate.py). 406 passed; run_ci.sh green;
run_platform.sh --check-only green. Existing fixture-based tests
preserved (instance.json static fixtures unaffected).
121 lines
4.2 KiB
Python
121 lines
4.2 KiB
Python
#!/usr/bin/env python3
|
|
"""Environment onboarding check.
|
|
|
|
Reads a contract's `environment` field and looks up the matching
|
|
`core/environments/<name>.json`. If no matching file exists, prints a
|
|
friendly onboarding prompt and exits non-zero, halting the pipeline before
|
|
any work is done.
|
|
|
|
Usage:
|
|
python3 core/environment_check.py <contract.yaml>
|
|
python3 core/environment_check.py --env dev
|
|
"""
|
|
import json
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
try:
|
|
import yaml
|
|
except ImportError:
|
|
sys.stderr.write("PyYAML is required (pip install pyyaml)\n")
|
|
sys.exit(2)
|
|
|
|
|
|
def _environments_dir(root=None):
|
|
if root is None:
|
|
root = Path(__file__).resolve().parent.parent
|
|
return Path(root) / "core" / "environments"
|
|
|
|
|
|
def _contract_environment(contract_path):
|
|
with open(contract_path) as f:
|
|
contract = yaml.safe_load(f)
|
|
return contract.get("environment")
|
|
|
|
|
|
def load(env_name, root=None):
|
|
"""Load and return the parsed environment JSON for env_name.
|
|
|
|
Returns the env dict, or raises FileNotFoundError if no <env_name>.json
|
|
exists. Emits a stderr warning when account_id is the 000000000000
|
|
placeholder and env_name != 'dev' (prompts real binding).
|
|
"""
|
|
env_file = _environments_dir(root) / f"{env_name}.json"
|
|
if not env_file.is_file():
|
|
raise FileNotFoundError(f"no environment file for '{env_name}' at {env_file}")
|
|
with open(env_file) as f:
|
|
env = json.load(f)
|
|
if env.get("account_id") == "000000000000" and env_name != "dev":
|
|
sys.stderr.write(
|
|
f"WARNING: environment '{env_name}' has the placeholder account_id "
|
|
f"000000000000 — replace it with the real {env_name} account id "
|
|
f"before deploying (onboarding scaffold).\n"
|
|
)
|
|
return env
|
|
|
|
|
|
def _onboarding_message(env_name):
|
|
return (
|
|
"=== ACDL Environment Onboarding ===\n"
|
|
f"No environment named '{env_name}' is bound to this repository.\n\n"
|
|
"ACDL environments are platform-managed. The platform provisions on\n"
|
|
"your behalf:\n"
|
|
" - an AWS account (or a scoped partition of one)\n"
|
|
" - a network (VPC + subnets)\n"
|
|
" - a state backend (an S3 bucket + DynamoDB lock table)\n"
|
|
" - an IAM role surfaced to your repo via attribute-based\n"
|
|
" authorization (ABAC)\n\n"
|
|
"You do not provide an AWS account, VPC, subnet, or state bucket.\n\n"
|
|
"To request an environment:\n"
|
|
" 1. Contact the platform team with your repo name + the\n"
|
|
" environment name you need (e.g. 'dev').\n"
|
|
" 2. The platform team provisions the account/network/state/role\n"
|
|
" and binds the environment to your repo.\n"
|
|
" 3. Your next pipeline run will proceed normally.\n\n"
|
|
"Expected turnaround: contact the platform team for current SLA.\n"
|
|
"===================================\n"
|
|
)
|
|
|
|
|
|
def check(contract_path=None, env_name=None, root=None):
|
|
"""Return (ok: bool, message: str).
|
|
|
|
If env_name is None it is read from the contract at contract_path.
|
|
ok is True when an environment definition exists; False otherwise.
|
|
On False, message is the friendly onboarding prompt.
|
|
"""
|
|
if env_name is None:
|
|
if contract_path is None:
|
|
return (False, "no contract or environment name supplied")
|
|
env_name = _contract_environment(contract_path)
|
|
if env_name is None:
|
|
return (False, "contract has no 'environment' field")
|
|
|
|
env_file = _environments_dir(root) / f"{env_name}.json"
|
|
if env_file.is_file():
|
|
return (True, f"environment '{env_name}' is bound ({env_file})")
|
|
return (False, _onboarding_message(env_name))
|
|
|
|
|
|
def main(argv):
|
|
contract_path = None
|
|
env_name = None
|
|
for arg in argv[1:]:
|
|
if arg.startswith("--env="):
|
|
env_name = arg.split("=", 1)[1]
|
|
elif arg.startswith("--"):
|
|
sys.stderr.write(f"unknown flag: {arg}\n")
|
|
return 2
|
|
else:
|
|
contract_path = arg
|
|
|
|
ok, message = check(contract_path=contract_path, env_name=env_name)
|
|
if ok:
|
|
print(message)
|
|
return 0
|
|
sys.stdout.write(message)
|
|
return 1
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main(sys.argv)) |