5 Commits

Author	SHA1	Message	Date
Jordan Ritter	8714ab569b	chore(showcase): apply oxfmt formatting across showcase scripts and shells ... oxfmt --write normalized formatting on showcase scripts, the four shells, and the new oxlint rule; required for the repo-root oxfmt --check CI gate.	2026-05-29 11:45:16 -07:00
Jordan Ritter	09b9f8910b	chore(showcase): pre-push cleanup -- comment rot, log levels, env coalesce, test hardening ... Non-functional cleanup pass on the showcase deploy-pipeline integration branch. All changes are scoped to comment rot, log severity for already- demoted runtime-config fields, length-aware env-name coalescing (a deliberately-empty primary no longer masks a populated alternate), and test-quality tightening. No production behavior change beyond the specific items below. Changes by area: - shell/shell-dashboard/shell-docs runtime-config.ts: factor the `process.env[primary] ?? process.env[alt]` chain into a shared length-aware `readEnvPair` helper. The prior `??` form treated `PRIMARY=""` as set, masking a populated alternate; the helper now treats empty-string as unset and falls through to the alternate. - shell-docs runtime-config.ts: demote the two recoverable URL fields (`intelligenceSignupUrl`, `posthogHost`) from console.info to console.warn. The `FATAL-CONFIG:` Sentry-alert prefix is preserved only on the true sentinels; the demoted fields now clear prod log- aggregation thresholds without raising ops alerts. - All three shells' runtime-config.ts: prefix log lines with the shell name (e.g. `[shell-docs runtime-config]`) so the shared log stream identifies which shell emitted the line. - shell-docs runtime-config-serialize.ts: rewrite the U+2028 / U+2029 RegExp arguments using six-character ASCII backslash-u escape sequences (was: literal codepoints in the string arg). The literal codepoints are line terminators that a formatter or editor could silently strip, breaking the security-critical XSS escape. The ASCII form is robust to any such pass. - shell-docs use-google-analytics.test.ts: de-tautologize the hook- order test. It now asserts `usePathname(` and `useEffect(` both exist in the source, so deleting all hooks would fail the test rather than trivially satisfying the early-return path. - shell-dashboard baseline-types.test.ts: update the partner-count expectation from 25 to 26 -- the 26th entry (Cloudflare) is a legitimate integration that landed independently; the test was stale and had nothing to do with this branch. - scripts/resolve-verify-matrix.ts: drop the `FIX 7 --` plan- internal prefix from a comment; keep the explanation. - shell-docs/.env.example: correct the `NEXT_PUBLIC_SHELL_URL` fallback claim (sentinel, not canonical prod host) and document the remaining 7 consumed env vars with their FATAL/warn/silent semantics so the example matches runtime-config.ts. Skipped: - C-SENTINEL-DEDUP (`http://ops.invalid` shared constant across shell-dashboard's next.config.ts and runtime-config.ts): both files are at different module levels (root vs src/lib) and the string appears once in each; extracting to a shared module would widen the diff into a refactor for marginal benefit. Skipped per the spec's "if it widens diff awkwardly, skip" guidance. - C-SSRTEST: already exhaustively covered. Each of the three shells has an SSR placeholder test that exercises every URL field via `new URL()` parseability and (for shell-docs) the analytics-key empty-string semantics. Treated as a no-op. Validation: shell + shell-dashboard + shell-docs runtime-config / serialize / GA tests green; bin/showcase Ruby suite green (87 runs); showcase/scripts resolve-verify-matrix + aggregate-build-results + lint-rule-no-public-env green (79 runs).	2026-05-29 11:45:15 -07:00
Jordan Ritter	41fae67618	fix(showcase): tighten verify-matrix drift guard + fail-loud boundaries; fix stale comment + flaky test ... Closing hardening pass on the showcase deploy-gate's verify-matrix resolver. The 7-agent review confirmed the gate is correct; this commit fixes the residual rough edges. - showcase_deploy.yml: correct the false §3 ok-non-empty comment. The empty-intersection case can coexist with redeploy_red=false (every redeploy succeeded, just none probe-eligible) — that's a correctly-green run, not a red one. - showcase_deploy.yml: tighten the summary.json shape guard to catch PARTIAL drift (TOTAL>0 && WITH_STATUS<TOTAL). The previous all-or- nothing TOTAL>0 && WITH_STATUS==0 check silently dropped drifted rows on a mixed summary. Validated locally on mixed/normal/empty/ total-drift jq samples. - resolve-verify-matrix.ts: add asSupportedEventName narrowing helper + use it in the CLI. Replaces the unchecked `as` cast — type system and runtime now tell one story. Resolver's internal eventName guard becomes defense-in-depth for direct (test) callers. - resolve-verify-matrix.ts: make the workflow_run boundary total — summaryPresent MUST be exactly "true"/"false". Any other value (including "" from a step-id-rename wiring break) throws now instead of silently emitting has_services=false. - resolve-verify-matrix.ts: drop the try/catch around fileURLToPath(import.meta.url) in `invokedDirectly`. The catch used to swallow ESM-interop failures and silently no-op the CLI (exit 0, no GITHUB_OUTPUT write → verify skipped = false-green). - resolve-verify-matrix.ts: reword parseSsotServices JSDoc to distinguish schema-drift from truncation (the two are different failure modes, not one conflated story). - showcase_build.yml: comment addendum on the redeploy-summary upload — swapping the guard to `if: always()` would red the legitimate services=='' path (no summary written), trading the already-closed false-green for a false-red on every non-buildable push. - resolve-verify-matrix.cli.test.ts: switch to spawnSync so stderr is captured on both zero and non-zero exit (execFileSync only exposes stderr on throw). Hard-code two stable probe-eligible names ("aimock", "harness") for the sorted-CSV test rather than picking probe[0]/probe[1] off the live SSOT — the prior test was tautological (already-sorted in, sorted out) and would silently pass if the resolver did nothing. - resolve-verify-matrix.cli.test.ts: add CLI coverage for the dropped-token ::warning:: path (FIX 3 — the entire drift-detection contract had zero CLI coverage), the unexpected-EVENT_NAME error (FIX 5), and the workflow_run-summary_present total boundary (FIX 7, both "" and "True" inputs). - resolve-verify-matrix.test.ts: add unit coverage for the new workflow_run summaryPresent boundary (empty + "True" + the workflow_dispatch ignores-summaryPresent regression). Red-green: 6 tests RED before code changes (FIX 3 warning, FIX 5 unknown EVENT_NAME, FIX 7 unit + CLI ×2 for "" and "True"); 79 tests GREEN after. Validation: 4 vitest files / 79 tests passing; 87/87 ruby specs passing; actionlint findings unchanged vs integration baseline (8 → 8, identical diff); yaml.safe_load OK on both workflows.	2026-05-29 11:45:15 -07:00
Jordan Ritter	aafafa53bd	fix(showcase): validate verify-matrix boundaries (SSOT + summary shape), fail loud, test CLI contract ... A 7-agent review of the verify-matrix resolver and its surrounding workflow plumbing found three boundary surfaces that could silently produce a GREEN deploy on a broken release, plus an untested CLI contract that CI compares against the literal strings 'true' / 'false'. FIX 1 — Validate the SSOT shape in loadSsotServices(). The prior `JSON.parse(...) as {services: SsotService[]}` was an unchecked cast: a truncated/drifted SSOT (emitter crashed mid-write, or schema renamed) parses fine but silently shrinks/empties the probe-eligible set → some redeployed services go unverified, or verify is skipped on a real redeploy. Extract a pure exported parseSsotServices(raw, path) that requires the shape we depend on (non-empty services array; each entry has a non-empty string name, an optional string|null dispatchName, and a probe object with a boolean staging). Throw `::error::SSOT <path> malformed: <detail>` on any violation. Also re-check existsSync(SSOT_JSON) after the regenerate-if-missing execFileSync — a regen that exits 0 without writing must not proceed to a useless JSON.parse crash. Drop the defensive `probe?.staging` once shape is guaranteed. FIX 2 — Validate summary.json shape in the redeploy-gate bash. The bullseye false-green surface: if redeploy-env.ts's schema ever drifts (e.g. `status` → `state`, `ok` → `success`), every `jq select(.status==...)` yields empty → redeploy_red=false AND ok_services="" → resolver skips verify → GREEN CI on a real unverified redeploy. Add a TOTAL vs WITH_STATUS shape guard right after loading the summary: if TOTAL > 0 && WITH_STATUS == 0, emit ::error::summary.json has $TOTAL entries but none with status ok|error (schema drift?) and exit 1. The legitimate empty-array path (TOTAL=0) is preserved. FIX 3 — Fail loud on unknown eventName in resolveVerifyMatrix. The prior code fell through to the workflow_run intersection branch for ANY unrecognized eventName (typo, unexpected trigger), silently emitting has_services=false → indistinguishable from a legit "summary absent" skip. Add an explicit guard so only workflow_run / workflow_dispatch are accepted; anything else throws ::error::resolve-verify-matrix: unexpected eventName '<value>'. Tighten the eventName parameter type to the literal union. FIX 4 — Trim ok tokens + warn on dropped tokens in okCsvToCanonicalNames. Split, then .map(t => t.trim()).filter(Boolean) so "a, b" (spaces) matches. Collect tokens that match NO SSOT service (by name or dispatchName) and have the CLI wrapper emit ::warning::ok_services tokens dropped (no SSOT match): <list> on stderr when non-empty — surfaces SSOT/build drift. The pure function stays IO-free; logging lives in the wrapper. FIX 5 — CLI wrapper integration test. New resolve-verify-matrix.cli.test.ts spawns `npx tsx showcase/scripts/resolve-verify-matrix.ts` with a temp $GITHUB_OUTPUT file across four scenarios and asserts the temp file contents EXACTLY (the workflow YAML compares has_services against the literal strings 'true'/'false', so the byte-for-byte format is part of the contract). Uses the real railway-envs.generated.json so the loader exercise is real. FIX 6 — Cleanup. Remove the dead `env: DISPATCH_SERVICE: ...` block on the redeploy-gate step (the next step redeclares it — leftover from the extraction). Soften the §3 decision-table all-errors bullet to match resolve-verify-matrix.ts's careful wording, and append that when the success-set is empty (or the intersection collapses to empty), verify is skipped and the gate reds independently. Append to showcase_build.yml's "Upload redeploy summary" path-(A) comment that `if-no-files-found: error` still reds path (A) even if a future change adds `if: always()`. Tests: red→green for FIX 1/3/4/5 verified locally. Resolve-verify-matrix vitest count: 12 → 28. Full requested suite (resolve-verify-matrix + cli + aggregate-build-results + lint-rule-no-public-env): 72 passed. showcase/bin ruby specs: 87 runs / 0 failures / 0 errors / 0 skips. actionlint baseline preserved (8 findings, identical to integration tip).	2026-05-29 11:45:15 -07:00
Jordan Ritter	c579ad753a	fix(showcase): extract+test verify-matrix resolver; skip verify when redeploy success-set empty ... Extract the inline bash+jq decision logic from showcase_deploy.yml's resolve-matrix job into showcase/scripts/resolve-verify-matrix.ts, a pure function with a vitest suite. The bash had produced two confirmed bugs across prior CR rounds, so making it testable is the lasting fix. Issue A (the bug this PR fixes): when summary_present=true but ok_services is empty (every service errored on redeploy), the old bash skipped the intersection and fell through to the full probe-eligible fleet, gratuitously probing every service against stale :latest. The resolver now returns has_services=false in that case — enforce-redeploy -gate independently reds the workflow on redeploy_red=true, so this case is already loud; there is nothing left to verify. Parity preserved for unchanged cases: - workflow_dispatch + 'all'/empty → full probe-eligible set - workflow_dispatch + specific svc → that one (unknown → error exit) - workflow_run + summary_present=false → has_services=false - workflow_run + present + ok non-empty → intersection with probe- eligible (SSOT key OR dispatchName aliases both resolve) Also clarified the Upload-redeploy-summary comment in showcase_build.yml to document both red paths (hard crash → redeploy step exits non-zero; exit-0-but-no-file → if-no-files-found:error reds the step) so no false-green path is possible. Tests: 12-case vitest suite covers each decision-table row plus the Issue A fix (written red-first; failed against a naive full-fleet fallback, passed once the early return was added). CLI parity verified against the real generated SSOT for the three representative env-var combinations (workflow_run + present + ok=[a,c]; workflow_run + present + ok empty; workflow_dispatch + 'all').	2026-05-29 11:45:14 -07:00