swf-monitor/scripts/teamcomms-guarded-deploy.py

0001 #!/usr/bin/env python3
0002 """Opt-in, root-owned TeamComms claim guard for the existing deployment script."""
0003 import argparse
0004 import os
0005 from pathlib import Path
0006 from uuid import UUID
0007
0008 CONFIG = Path('/etc/swf-teamcomms')
0009 LIVE = Path('/opt/swf-monitor/current')
0010 CHECKOUT = Path('/data/wenauseic/github/swf-monitor')
0011
0012
0013 def main():
0014     parser = argparse.ArgumentParser(description=__doc__)
0015     parser.add_argument('--claim-id', required=True, type=UUID)
0016     parser.add_argument('--generation', required=True, type=int)
0017     parser.add_argument('--check', action='store_true', help='Validate guarded admission and report the committed checkout; no deployment')
0018     parser.add_argument('kind', choices=['branch', 'tag'], nargs='?')
0019     parser.add_argument('reference', nargs='?')
0020     args = parser.parse_args()
0021     if os.geteuid() != 0:
0022         parser.error('Run this wrapper itself with sudo so the guard can stop the entire privileged process group')
0023     if args.generation < 1 or (not args.check and (not args.kind or not args.reference)) or (args.check and (args.kind or args.reference)):
0024         parser.error('Choose --check or exactly one branch/tag reference, with a positive generation')
0025     # Resolve current once: cutover must not change the Python/script mid-run.
0026     release = LIVE.resolve(strict=True)
0027     from teamcomms.connectors.guard import load_guard
0028     guard = load_guard(CONFIG / 'guard.json')
0029     command = [str(release / '.venv/bin/python'), '-m', 'teamcomms.connectors.cli',
0030                '--config', str(CONFIG / 'connector.json'), 'guard', '--guard-config', str(CONFIG / 'guard.json'),
0031                '--claim-id', str(args.claim_id), '--generation', str(args.generation)]
0032     for resource in guard.resource_ids:
0033         command.extend(['--resource', str(resource)])
0034     if args.check:
0035         target = ['/usr/bin/git', '-c', 'safe.directory=' + str(CHECKOUT), '-C', str(CHECKOUT), 'show', '-s', '--format=%H %s', 'HEAD']
0036     else:
0037         # This committed release script retains its standard drift/frozen-tree checks.
0038         target = ['/bin/bash', str(release / 'deploy-swf-monitor.sh'), args.kind, args.reference]
0039     os.execv(command[0], command + ['--'] + target)
0040
0041
0042 if __name__ == '__main__':
0043     main()