omi/.github/scripts/check-gcp-backend-production-boundary.py at main · ghzhost/omi · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
#!/usr/bin/env python3
"""Keep production deploys rollback-first and Cloud Run-only."""

from __future__ import annotations

import sys
import re
from pathlib import Path

ROOT = Path(__file__).resolve().parents[2]
if str(ROOT / ".github" / "scripts") not in sys.path:
    sys.path.insert(0, str(ROOT / ".github" / "scripts"))

from workflow_composite_contract import backend_deploy_contract_text

WORKFLOW = Path(".github/workflows/gcp_backend.yml")
DEPLOY_BACKEND_STACK_ACTION = Path(".github/actions/deploy-backend-stack/action.yml")
PROD_ALL_REJECTION = 'if [[ "$DEPLOY_ENVIRONMENT" == "prod" && "$DEPLOY_TARGETS" == "all" ]]; then'
DEV_CANDIDATE_GATE = "if: ${{ github.event.inputs.environment == 'development' }}"
PROD_SMOKE = "Smoke promoted production serving API"
SERVING_VERIFY = "Verify serving backend release vector"
ROLLBACK_CONDITION = "steps.smoke-promoted-production-serving-api.outcome == 'failure'"
PROD_FORBIDDEN = (
    "probe-transcription-candidate-from-cloud-run.sh",
    "FIREBASE_PROBE_TOKEN",
    "identity_audience=",
)


def validate(root: Path) -> list[str]:
    path = root / WORKFLOW
    workflow_text = path.read_text(encoding="utf-8") if path.exists() else ""
    text = backend_deploy_contract_text(workflow_text, root, DEPLOY_BACKEND_STACK_ACTION)
    errors: list[str] = []
    if "default: 'cloud-run-only'" not in text:
        errors.append("gcp_backend.yml must default deploy_targets to cloud-run-only")
    if PROD_ALL_REJECTION not in text:
        errors.append("gcp_backend.yml must reject environment=prod, deploy_targets=all before side effects")
    if (
        text.count(DEV_CANDIDATE_GATE) < 1
        and "inputs.environment == 'development'" not in text
    ):
        errors.append("gcp_backend.yml must retain the development tagged-candidate gate")
    resolver_step = re.search(
        r"- name: Resolve transcription candidate URL(?P<body>.*?)(?=\n\s*- name:|\Z)", text, re.DOTALL
    )
    if resolver_step is None or "resolve_cloud_run_tagged_url.py" not in resolver_step.group('body') or (
        "inputs.deploy_profile == 'manual' && inputs.environment == 'development'" not in resolver_step.group('body')
    ):
        errors.append("gcp_backend.yml must use the tagged candidate resolver only for development")
    for forbidden in PROD_FORBIDDEN:
        if forbidden in text:
            errors.append(f"gcp_backend.yml must not retain production candidate dependency {forbidden!r}")
    try:
        serving_verify = text.index(SERVING_VERIFY)
        prod_smoke = text.index(PROD_SMOKE)
    except ValueError:
        errors.append("gcp_backend.yml must smoke the promoted production serving API")
    else:
        if prod_smoke <= serving_verify:
            errors.append("production serving smoke must follow exact serving release-vector verification")
    for required in (
        "https://api.omi.me/v2/desktop/beta/candidates/reserve",
        '--data \'{"tag":"v0.0.0+1-macos"}\'',
        "schema-valid inert tag reaches the authorization wall",
        "--candidate-api-url https://api.omi.me",
        "umask 077",
        "firebase-production-serving-token",
        "trap 'rm -f \"$token_file\"' EXIT",
        ROLLBACK_CONDITION,
    ):
        if required not in text:
            errors.append(f"gcp_backend.yml is missing production serving-smoke guard {required!r}")
    if "--data '{}')" in text:
        errors.append("gcp_backend.yml must not use an invalid empty reservation body for the 401 smoke")
    smoke_text = text[text.find(PROD_SMOKE) :] if PROD_SMOKE in text else ""
    if "$GITHUB_OUTPUT" in smoke_text and "firebase-production-serving-token" in smoke_text:
        errors.append("production smoke token must not be written to GITHUB_OUTPUT")
    return errors


if __name__ == "__main__":
    raise SystemExit(1 if validate(Path(".")) else 0)