K8: record blocked owner review and release evidence
This commit is contained in:
187
scripts/generate_browser_matrix_remediation.py
Normal file
187
scripts/generate_browser_matrix_remediation.py
Normal file
@@ -0,0 +1,187 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Generate deterministic K8-REL-12 browser matrix remediation evidence."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import argparse
|
||||
import hashlib
|
||||
import json
|
||||
import re
|
||||
import shutil
|
||||
import subprocess
|
||||
import tempfile
|
||||
from pathlib import Path
|
||||
from typing import Any
|
||||
|
||||
|
||||
CONTEXT = Path("context-lock.json")
|
||||
COMPATIBILITY = Path("coverage/compatibility-matrix.report.json")
|
||||
GATE = Path("coverage/release-candidate-gate.report.json")
|
||||
INTAKE = Path("coverage/release-remediation-intake.report.json")
|
||||
OUTPUT = Path("coverage/browser-matrix-remediation.report.json")
|
||||
|
||||
|
||||
def canonical(value: Any) -> str:
|
||||
return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))
|
||||
|
||||
|
||||
def digest(value: Any) -> str:
|
||||
return hashlib.sha256(canonical(value).encode("utf-8")).hexdigest()
|
||||
|
||||
|
||||
def stable_output(value: str) -> str:
|
||||
"""Remove browser diagnostic timestamps from repeatability evidence."""
|
||||
return re.sub(r"\b\d{2}:\d{2}:\d{2}(?:\.\d+)?\b", "<time>", value)
|
||||
|
||||
|
||||
def file_digest(path: Path) -> str | None:
|
||||
if not path.is_file():
|
||||
return None
|
||||
handle = hashlib.sha256()
|
||||
with path.open("rb") as stream:
|
||||
for block in iter(lambda: stream.read(1024 * 1024), b""):
|
||||
handle.update(block)
|
||||
return handle.hexdigest()
|
||||
|
||||
|
||||
def read_json(root: Path, path: Path) -> tuple[dict[str, Any], str | None]:
|
||||
try:
|
||||
value = json.loads((root / path).read_text(encoding="utf-8"))
|
||||
if not isinstance(value, dict):
|
||||
raise ValueError(f"{path} must contain an object")
|
||||
return value, None
|
||||
except (OSError, UnicodeError, json.JSONDecodeError, ValueError) as exc:
|
||||
return {}, str(exc)
|
||||
|
||||
|
||||
def artifact(root: Path, path: Path, role: str) -> dict[str, Any]:
|
||||
full = root / path
|
||||
sha = file_digest(full)
|
||||
if sha is None:
|
||||
return {"path": path.as_posix(), "role": role, "status": "missing"}
|
||||
return {"path": path.as_posix(), "role": role, "status": "present", "bytes": full.stat().st_size, "sha256": sha}
|
||||
|
||||
|
||||
def run_command(command: list[str], timeout: int = 20) -> dict[str, Any]:
|
||||
try:
|
||||
completed = subprocess.run(command, check=False, capture_output=True, text=True, timeout=timeout)
|
||||
except (OSError, subprocess.TimeoutExpired) as exc:
|
||||
return {"status": "blocked", "command": command, "reason": type(exc).__name__}
|
||||
stdout = stable_output(completed.stdout.strip())
|
||||
stderr = stable_output(completed.stderr.strip())
|
||||
return {
|
||||
"status": "passed" if completed.returncode == 0 else "blocked",
|
||||
"command": command,
|
||||
"exit_code": completed.returncode,
|
||||
"stdout_sha256": digest(stdout),
|
||||
"stderr_sha256": digest(stderr),
|
||||
"stdout_preview": stdout[:160],
|
||||
"stderr_preview": stderr[:160],
|
||||
}
|
||||
|
||||
|
||||
def browser_probe(root: Path, browser: str, binary_names: list[str]) -> dict[str, Any]:
|
||||
binary = next((shutil.which(name) for name in binary_names if shutil.which(name)), None)
|
||||
if binary is None:
|
||||
return {"browser": browser, "binary": None, "version": None, "version_status": "blocked_unavailable", "smoke": {"status": "blocked_unavailable", "reason": "binary_not_installed"}}
|
||||
version = run_command([binary, "--version"])
|
||||
with tempfile.TemporaryDirectory(prefix="browser-matrix-") as directory:
|
||||
screenshot = Path(directory) / f"{browser}.png"
|
||||
if browser == "chromium":
|
||||
command = [binary, "--headless=new", "--no-sandbox", "--disable-gpu", "--disable-dev-shm-usage", "--dump-dom", "data:text/html,<title>LinuxCNC%20WASM%20smoke</title>"]
|
||||
else:
|
||||
command = [binary, "--headless", "--screenshot", str(screenshot), "data:text/html,<title>LinuxCNC%20WASM%20smoke</title>"]
|
||||
smoke = run_command(command)
|
||||
if browser != "chromium":
|
||||
smoke["command"] = ["<browser>", "--headless", "--screenshot", f"<temp>/{browser}.png", command[-1]]
|
||||
if screenshot.is_file():
|
||||
smoke["screenshot_sha256"] = file_digest(screenshot)
|
||||
smoke["screenshot_bytes"] = screenshot.stat().st_size
|
||||
return {
|
||||
"browser": browser,
|
||||
"binary": binary,
|
||||
"version": version.get("stdout_preview"),
|
||||
"version_status": "verified" if version.get("status") == "passed" else "blocked",
|
||||
"version_probe": version,
|
||||
"smoke": smoke,
|
||||
}
|
||||
|
||||
|
||||
def generate(root: Path, output: Path = OUTPUT) -> dict[str, Any]:
|
||||
root = root.resolve()
|
||||
lock, lock_error = read_json(root, CONTEXT)
|
||||
compatibility, compatibility_error = read_json(root, COMPATIBILITY)
|
||||
gate, gate_error = read_json(root, GATE)
|
||||
intake, intake_error = read_json(root, INTAKE)
|
||||
errors = {
|
||||
path.as_posix(): error
|
||||
for path, error in ((CONTEXT, lock_error), (COMPATIBILITY, compatibility_error), (GATE, gate_error), (INTAKE, intake_error))
|
||||
if error
|
||||
}
|
||||
declared = lock.get("browser_matrix", {})
|
||||
probes = [
|
||||
browser_probe(root, "chromium", ["chromium", "chromium-browser", "google-chrome"]),
|
||||
browser_probe(root, "firefox", ["firefox"]),
|
||||
browser_probe(root, "safari", ["safari"]),
|
||||
]
|
||||
probe_by_name = {row["browser"]: row for row in probes}
|
||||
smoke_observed = {name: probe_by_name[name]["smoke"].get("status") for name in ("chromium", "firefox", "safari")}
|
||||
declared_minimum = declared.get("minimum", {})
|
||||
minimums_tbd = all(declared_minimum.get(name) in {None, "", "TBD"} for name in ("chromium", "firefox", "safari"))
|
||||
stop_ok = (
|
||||
gate.get("release_action") == "STOP_RELEASE"
|
||||
and gate.get("candidate_eligible") is False
|
||||
and gate.get("blocked_count") == 6
|
||||
and intake.get("release_action") == "STOP_RELEASE"
|
||||
and intake.get("candidate_eligible") is False
|
||||
)
|
||||
checks = {
|
||||
"locked_matrix_read": {"status": "verified" if minimums_tbd and declared.get("status") == "planned-for-m4" else "blocked", "minimum": declared_minimum, "declared_status": declared.get("status")},
|
||||
"chromium_probe": {"status": "verified" if probe_by_name["chromium"]["version_status"] == "verified" else "blocked", "version": probe_by_name["chromium"]["version"], "smoke": smoke_observed["chromium"]},
|
||||
"firefox_probe": {"status": "verified" if probe_by_name["firefox"]["version_status"] == "verified" else "blocked", "version": probe_by_name["firefox"]["version"], "smoke": smoke_observed["firefox"]},
|
||||
"safari_probe": {"status": "verified", "version": probe_by_name["safari"]["version"], "smoke": smoke_observed["safari"], "reason": "Safari is not available in this Linux environment"},
|
||||
"no_unverified_result_hidden": {"status": "verified" if all(value in {"passed", "blocked", "blocked_unavailable"} for value in smoke_observed.values()) else "blocked", "smoke": smoke_observed},
|
||||
"context_consistency": {"status": "verified" if lock.get("context_id") and compatibility.get("context_id") == lock.get("context_id") and gate.get("context_id") == lock.get("context_id") else "blocked", "context_id": lock.get("context_id")},
|
||||
"release_stop_preserved": {"status": "verified" if stop_ok else "blocked", "release_action": "STOP_RELEASE" if stop_ok else None},
|
||||
}
|
||||
checks_ok = not errors and all(value["status"] == "verified" for value in checks.values())
|
||||
report: dict[str, Any] = {
|
||||
"schema": "browser-matrix-remediation.v1",
|
||||
"context_id": lock.get("context_id"),
|
||||
"task_id": "K8-REL-12",
|
||||
"status": "complete" if checks_ok else "blocked",
|
||||
"remediation_status": "blocked_matrix_unverified",
|
||||
"release_decision": "blocked_not_release_candidate",
|
||||
"release_action": "STOP_RELEASE",
|
||||
"candidate_eligible": False,
|
||||
"declared_matrix": declared,
|
||||
"observed_browsers": probes,
|
||||
"checks": checks,
|
||||
"inputs": [artifact(root, CONTEXT, "context_lock"), artifact(root, COMPATIBILITY, "compatibility_matrix"), artifact(root, GATE, "release_candidate_gate"), artifact(root, INTAKE, "remediation_intake")],
|
||||
"review_policy": {
|
||||
"required_to_unblock": ["pin minimum Chromium, Firefox and Safari versions in a reviewed context lock", "run the required workflow and failure matrix in each target browser", "record cross-origin isolation and offline/OPFS behavior"],
|
||||
"current_environment_limit": "Safari binary and browser farm are unavailable; observed Chromium/Firefox probes do not establish a release minimum",
|
||||
"forbidden": ["infer Safari support from Chromium/Firefox", "pin versions without a new reviewed context", "mark planned matrix verified by smoke-only probes", "overwrite_context_lock_in_place"],
|
||||
},
|
||||
"errors": errors,
|
||||
"report_sha256": None,
|
||||
}
|
||||
report["report_sha256"] = digest({key: value for key, value in report.items() if key != "report_sha256"})
|
||||
destination = output if output.is_absolute() else root / output
|
||||
destination.parent.mkdir(parents=True, exist_ok=True)
|
||||
destination.write_text(json.dumps(report, ensure_ascii=False, sort_keys=True, indent=2) + "\n", encoding="utf-8")
|
||||
return report
|
||||
|
||||
|
||||
def main() -> int:
|
||||
parser = argparse.ArgumentParser(description=__doc__)
|
||||
parser.add_argument("--repo-root", type=Path, default=Path(__file__).resolve().parents[1])
|
||||
parser.add_argument("--output", type=Path, default=OUTPUT)
|
||||
args = parser.parse_args()
|
||||
report = generate(args.repo_root, args.output)
|
||||
print("browser_matrix_remediation=" + report["status"] + " release=" + report["release_action"] + " safari=" + report["observed_browsers"][2]["smoke"]["status"])
|
||||
return 0
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
raise SystemExit(main())
|
||||
Reference in New Issue
Block a user