36d562c15c
Adds the tf verb-group and the resolver substrate beneath it, continuing the v0.1 infra-loop build. - substrate: findInfraRoot (walk up to terragrunt.hcl + stacks/), stack→dir resolver, and repo/remote/git-crypt detection (preferRemote forgejo>origin, hasGitCryptAttr, gitCryptFlags) — the last is for `work` next. - tf plan/validate/fmt/force-unlock/apply, resolving the stack from cwd and delegating to scripts/tg (which owns state decrypt/encrypt, the Vault lock, and the ingress auth-comment check) rather than calling terragrunt directly. - tf apply is presence-coupled: claims stack:<name>, ALWAYS releases on exit (normal, error, or SIGINT/SIGTERM via sync.Once + signal handler) — fixing the documented ~200-claim leak — and prints an out-of-band reminder since CI applies canonically on push. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
63 lines
1.6 KiB
Go
63 lines
1.6 KiB
Go
package main
|
|
|
|
import (
|
|
"os/exec"
|
|
"strings"
|
|
)
|
|
|
|
// preferRemote picks the canonical remote: forgejo if present, else origin,
|
|
// else the first listed. (For infra, origin and forgejo both point at Forgejo.)
|
|
func preferRemote(remotes []string) string {
|
|
has := map[string]bool{}
|
|
for _, r := range remotes {
|
|
has[r] = true
|
|
}
|
|
switch {
|
|
case has["forgejo"]:
|
|
return "forgejo"
|
|
case has["origin"]:
|
|
return "origin"
|
|
case len(remotes) > 0:
|
|
return remotes[0]
|
|
default:
|
|
return ""
|
|
}
|
|
}
|
|
|
|
// hasGitCryptAttr reports whether .gitattributes content enables git-crypt.
|
|
func hasGitCryptAttr(gitattributes string) bool {
|
|
return strings.Contains(gitattributes, "filter=git-crypt")
|
|
}
|
|
|
|
// gitCryptFlags are the per-command flags that disable smudge/clean so git
|
|
// operations in a git-crypt repo don't try to decrypt (NEVER persisted to config).
|
|
func gitCryptFlags() []string {
|
|
return []string{
|
|
"-c", "filter.git-crypt.smudge=cat",
|
|
"-c", "filter.git-crypt.clean=cat",
|
|
"-c", "filter.git-crypt.required=false",
|
|
}
|
|
}
|
|
|
|
// gitOutput runs `git -C dir <args>` and returns trimmed stdout.
|
|
func gitOutput(dir string, args ...string) (string, error) {
|
|
cmd := exec.Command("git", append([]string{"-C", dir}, args...)...)
|
|
out, err := cmd.Output()
|
|
return strings.TrimSpace(string(out)), err
|
|
}
|
|
|
|
func gitRepoRoot(dir string) (string, error) {
|
|
return gitOutput(dir, "rev-parse", "--show-toplevel")
|
|
}
|
|
|
|
// gitRemotes lists configured remote names for the repo at dir.
|
|
func gitRemotes(dir string) ([]string, error) {
|
|
out, err := gitOutput(dir, "remote")
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if out == "" {
|
|
return nil, nil
|
|
}
|
|
return strings.Split(out, "\n"), nil
|
|
}
|