Prepare GovOPlaN self-hosted release workflow

2026-07-10 21:57:22 +02:00
parent 8dd5123aab
commit 94236a7d7e
51 changed files with 3576 additions and 803 deletions
--- a/scripts/check_dependency_boundaries.py
+++ b/scripts/check_dependency_boundaries.py
@@ -2,6 +2,8 @@
 from __future__ import annotations

 import ast
+import json
+import re
 from dataclasses import dataclass
 from pathlib import Path

@@ -36,6 +38,23 @@ PREFIXES = {
 }
 FEATURE_OWNERS = ("files", "mail", "campaign")
 PLATFORM_OWNERS = ("admin", "tenancy", "organizations", "identity", "policy", "audit", "dashboard")
+WEBUI_REPOS = {
+    "core": ROOT / "webui",
+    "files": ROOT.parent / "govoplan-files" / "webui",
+    "mail": ROOT.parent / "govoplan-mail" / "webui",
+    "campaign": ROOT.parent / "govoplan-campaign" / "webui",
+}
+WEBUI_PACKAGES = {
+    "core": "@govoplan/core-webui",
+    "files": "@govoplan/files-webui",
+    "mail": "@govoplan/mail-webui",
+    "campaign": "@govoplan/campaign-webui",
+}
+WEBUI_IMPORT_RE = re.compile(
+    r"(?:from\s+|import\s*\(\s*|require\s*\(\s*|export\s+[^;]*?\s+from\s+)"
+    r"[\"'](?P<package>@govoplan/[a-z0-9_-]+-webui)(?:/[A-Za-z0-9_./-]+)?[\"']"
+    r"|import\s+[\"'](?P<side_effect_package>@govoplan/[a-z0-9_-]+-webui)(?:/[A-Za-z0-9_./-]+)?[\"']"
+)


@dataclass(frozen=True)
@@ -54,6 +73,7 @@ ALLOWLIST_KEYS = {(item.owner, item.relative_path, item.imported_owner) for item

@dataclass(frozen=True)
 class Violation:
+    kind: str
    owner: str
    path: Path
    lineno: int
@@ -102,17 +122,97 @@ def _violations() -> list[Violation]:
                    continue
                if owner == "core" and imported_owner in FEATURE_OWNERS:
                    if not _allowed(owner, path, imported_owner):
-                        violations.append(Violation(owner, path, lineno, imported, imported_owner))
+                        violations.append(Violation("python", owner, path, lineno, imported, imported_owner))
                elif owner == "access" and imported_owner in FEATURE_OWNERS:
-                    violations.append(Violation(owner, path, lineno, imported, imported_owner))
+                    violations.append(Violation("python", owner, path, lineno, imported, imported_owner))
                elif owner in PLATFORM_OWNERS and imported_owner == "access":
                    if not _allowed(owner, path, imported_owner):
-                        violations.append(Violation(owner, path, lineno, imported, imported_owner))
+                        violations.append(Violation("python", owner, path, lineno, imported, imported_owner))
                elif owner in FEATURE_OWNERS and imported_owner in FEATURE_OWNERS:
                    if not _allowed(owner, path, imported_owner):
-                        violations.append(Violation(owner, path, lineno, imported, imported_owner))
+                        violations.append(Violation("python", owner, path, lineno, imported, imported_owner))
                elif owner in FEATURE_OWNERS and imported_owner == "access":
-                    violations.append(Violation(owner, path, lineno, imported, imported_owner))
+                    violations.append(Violation("python", owner, path, lineno, imported, imported_owner))
+    violations.extend(_webui_violations())
+    return violations
+
+
+def _webui_package_owner(package_name: str) -> str | None:
+    for owner, package in WEBUI_PACKAGES.items():
+        if package_name == package:
+            return owner
+    return None
+
+
+def _webui_source_files(root: Path) -> list[Path]:
+    source_root = root / "src"
+    if not source_root.exists():
+        return []
+    return [
+        path
+        for path in source_root.rglob("*")
+        if path.suffix in {".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"}
+        and "node_modules" not in path.parts
+        and "dist" not in path.parts
+    ]
+
+
+def _webui_dependency_fields(payload: object) -> dict[str, object]:
+    if not isinstance(payload, dict):
+        return {}
+    result: dict[str, object] = {}
+    for key in ("dependencies", "devDependencies", "peerDependencies", "optionalDependencies"):
+        value = payload.get(key)
+        if isinstance(value, dict):
+            result.update(value)
+    return result
+
+
+def _webui_package_json_violations(owner: str, root: Path) -> list[Violation]:
+    violations: list[Violation] = []
+    package_paths = [root / "package.json"]
+    if root.name == "webui":
+        package_paths.append(root.parent / "package.json")
+    for package_path in tuple(dict.fromkeys(package_paths)):
+        if not package_path.exists():
+            continue
+        try:
+            payload = json.loads(package_path.read_text(encoding="utf-8"))
+        except json.JSONDecodeError as exc:
+            return [Violation("webui-package", owner, package_path, exc.lineno, "invalid package.json", owner)]
+        for package_name in _webui_dependency_fields(payload):
+            imported_owner = _webui_package_owner(str(package_name))
+            if imported_owner is None or imported_owner == owner:
+                continue
+            if owner in FEATURE_OWNERS and imported_owner in FEATURE_OWNERS:
+                violations.append(Violation("webui-package", owner, package_path, 1, str(package_name), imported_owner))
+    return violations
+
+
+def _webui_source_violations(owner: str, root: Path) -> list[Violation]:
+    violations: list[Violation] = []
+    for path in _webui_source_files(root):
+        text = path.read_text(encoding="utf-8")
+        for match in WEBUI_IMPORT_RE.finditer(text):
+            package_name = match.group("package") or match.group("side_effect_package")
+            imported_owner = _webui_package_owner(package_name)
+            if imported_owner is None or imported_owner == owner:
+                continue
+            lineno = text.count("\n", 0, match.start()) + 1
+            if owner == "core" and imported_owner in FEATURE_OWNERS:
+                violations.append(Violation("webui-source", owner, path, lineno, package_name, imported_owner))
+            elif owner in FEATURE_OWNERS and imported_owner in FEATURE_OWNERS:
+                violations.append(Violation("webui-source", owner, path, lineno, package_name, imported_owner))
+    return violations
+
+
+def _webui_violations() -> list[Violation]:
+    violations: list[Violation] = []
+    for owner, root in WEBUI_REPOS.items():
+        if not root.exists():
+            continue
+        violations.extend(_webui_package_json_violations(owner, root))
+        violations.extend(_webui_source_violations(owner, root))
    return violations


@@ -125,7 +225,7 @@ def main() -> int:
    print("Dependency boundary violations:")
    for item in violations:
        print(
-            f"- {item.path}:{item.lineno}: {item.owner} imports {item.imported} "
+            f"- {item.path}:{item.lineno}: {item.owner} {item.kind} imports {item.imported} "
            f"({item.imported_owner}); use kernel capability/API/event contracts instead"
        )
    print("\nIf this is unavoidable transitional debt, add a reasoned ALLOWLIST entry.")
--- a/scripts/generate-release-catalog.py
+++ b/scripts/generate-release-catalog.py
@@ -9,11 +9,17 @@ from dataclasses import dataclass
 from datetime import UTC, datetime, timedelta
 import json
 from pathlib import Path
+import sys
 from typing import Any

 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey

+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+from govoplan_core.core.modules import ModuleManifest  # noqa: E402
+from govoplan_core.server.registry import available_module_manifests  # noqa: E402
+

 GITEA_BASE = "git+ssh://git@git.add-ideas.de/add-ideas"

@@ -27,6 +33,8 @@ class CatalogModule:
    description: str
    tags: tuple[str, ...]
    webui_package: str | None = None
+    provides_interfaces: tuple[dict[str, object], ...] = ()
+    requires_interfaces: tuple[dict[str, object], ...] = ()


 CATALOG_MODULES = (
@@ -225,22 +233,32 @@ def _catalog_payload(
    repository_base: str,
    public_base_url: str,
 ) -> dict[str, Any]:
+    manifests = _discovered_catalog_manifests()
    modules: list[dict[str, Any]] = []
    for module in CATALOG_MODULES:
+        manifest = manifests.get(module.module_id)
+        module_version = manifest.version if manifest is not None else version
+        module_tag = f"v{module_version.removeprefix('v')}"
        entry: dict[str, Any] = {
            "module_id": module.module_id,
            "name": module.name,
            "description": module.description,
-            "version": version,
+            "version": module_version,
            "action": "install",
            "python_package": module.python_package,
-            "python_ref": f"{module.python_package} @ {repository_base}/{module.repo}.git@{tag}",
+            "python_ref": f"{module.python_package} @ {repository_base}/{module.repo}.git@{module_tag}",
            "license_features": [f"module.{module.module_id}"],
            "tags": list(module.tags),
        }
        if module.webui_package:
            entry["webui_package"] = module.webui_package
-            entry["webui_ref"] = f"{repository_base}/{module.repo}.git#{tag}"
+            entry["webui_ref"] = f"{repository_base}/{module.repo}.git#{module_tag}"
+        manifest_interfaces = _manifest_interface_metadata(manifest)
+        entry.update(manifest_interfaces)
+        if module.provides_interfaces:
+            entry["provides_interfaces"] = [dict(item) for item in module.provides_interfaces]
+        if module.requires_interfaces:
+            entry["requires_interfaces"] = [dict(item) for item in module.requires_interfaces]
        modules.append(entry)

    return {
@@ -267,6 +285,38 @@ def _catalog_payload(
    }


+def _discovered_catalog_manifests() -> dict[str, ModuleManifest]:
+    try:
+        return available_module_manifests(ignore_load_errors=True)
+    except Exception:
+        return {}
+
+
+def _manifest_interface_metadata(manifest: ModuleManifest | None) -> dict[str, object]:
+    if manifest is None:
+        return {}
+    payload: dict[str, object] = {}
+    if manifest.provides_interfaces:
+        payload["provides_interfaces"] = [
+            {"name": item.name, "version": item.version}
+            for item in manifest.provides_interfaces
+        ]
+    if manifest.requires_interfaces:
+        requirements: list[dict[str, object]] = []
+        for item in manifest.requires_interfaces:
+            requirement: dict[str, object] = {
+                "name": item.name,
+                "optional": item.optional,
+            }
+            if item.version_min is not None:
+                requirement["version_min"] = item.version_min
+            if item.version_max_exclusive is not None:
+                requirement["version_max_exclusive"] = item.version_max_exclusive
+            requirements.append(requirement)
+        payload["requires_interfaces"] = requirements
+    return payload
+
+
 def _parse_signing_key(value: str) -> tuple[str, Ed25519PrivateKey]:
    key_id, separator, path_text = value.partition("=")
    if not separator or not key_id.strip() or not path_text.strip():
--- a/scripts/launch-production-like-dev.sh
+++ b/scripts/launch-production-like-dev.sh
@@ -45,7 +45,8 @@ set -a
 set +a

 export APP_ENV="${APP_ENV:-staging}"
-export ENABLED_MODULES="${ENABLED_MODULES:-tenancy,access,admin,policy,audit,campaigns,files,mail,calendar,docs,ops}"
+export GOVOPLAN_INSTALL_PROFILE="${GOVOPLAN_INSTALL_PROFILE:-production-like}"
+export ENABLED_MODULES="${ENABLED_MODULES:-tenancy,organizations,identity,access,admin,dashboard,policy,audit,campaigns,files,mail,calendar,docs,ops}"
 export DATABASE_URL="${DATABASE_URL:-${GOVOPLAN_PRODUCTION_LIKE_DATABASE_URL:-postgresql+psycopg://govoplan:govoplan-dev@127.0.0.1:55433/govoplan}}"
 export GOVOPLAN_DATABASE_URL_PGTOOLS="${GOVOPLAN_DATABASE_URL_PGTOOLS:-${GOVOPLAN_PRODUCTION_LIKE_DATABASE_URL_PGTOOLS:-postgresql://govoplan:govoplan-dev@127.0.0.1:55433/govoplan}}"
 export REDIS_URL="${REDIS_URL:-${GOVOPLAN_PRODUCTION_LIKE_REDIS_URL:-redis://127.0.0.1:56379/0}}"
@@ -66,6 +67,8 @@ PY
  export MASTER_KEY_B64
 fi

+"$PYTHON" -m govoplan_core.commands.config validate --profile production-like
+
 compose() {
  "$DOCKER" compose --env-file "$PROFILE_ENV" -f "$PROFILE_ROOT/docker-compose.yml" "$@"
 }
--- a/scripts/production-like-dev.sh
+++ b/scripts/production-like-dev.sh
@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+PROFILE_ROOT="$ROOT/dev/production-like"
+PROFILE_ENV="${GOVOPLAN_PRODUCTION_LIKE_ENV:-$PROFILE_ROOT/.env}"
+if [ ! -f "$PROFILE_ENV" ]; then
+  PROFILE_ENV="$PROFILE_ROOT/.env.example"
+fi
+
+PYTHON="${PYTHON:-$ROOT/.venv/bin/python}"
+DOCKER="${DOCKER:-docker}"
+
+usage() {
+  cat <<'EOF'
+Usage: scripts/production-like-dev.sh <command> [--yes]
+
+Commands:
+  start            Start the production-like API, worker, WebUI, PostgreSQL, and Redis profile.
+  stop             Stop PostgreSQL and Redis profile containers.
+  status           Show profile container status and validate the effective environment.
+  seed             Run migrations and seed development data against the profile database.
+  reset --yes      Stop containers, remove profile volumes, and remove runtime/production-like data.
+  validate-config  Validate the profile environment only.
+
+The start command delegates to scripts/launch-production-like-dev.sh. Stop/reset
+operate on Docker dependencies; API/WebUI/worker processes started by the
+launcher are stopped with Ctrl+C in that launcher terminal.
+EOF
+}
+
+fail() {
+  printf 'production-like-dev: %s\n' "$*" >&2
+  exit 1
+}
+
+command="${1:-}"
+if [ -z "$command" ] || [ "$command" = "-h" ] || [ "$command" = "--help" ]; then
+  usage
+  exit 0
+fi
+shift || true
+
+yes=0
+for arg in "$@"; do
+  case "$arg" in
+    --yes) yes=1 ;;
+    *) fail "unknown argument: $arg" ;;
+  esac
+done
+
+[ -f "$PROFILE_ENV" ] || fail "profile env file not found: $PROFILE_ENV"
+[ -x "$PYTHON" ] || fail "Python virtualenv not found at $PYTHON. Run: cd $ROOT && ./.venv/bin/python -m pip install -r requirements-dev.txt"
+
+set -a
+# shellcheck disable=SC1090
+. "$PROFILE_ENV"
+set +a
+
+export APP_ENV="${APP_ENV:-staging}"
+export GOVOPLAN_INSTALL_PROFILE="${GOVOPLAN_INSTALL_PROFILE:-production-like}"
+export DATABASE_URL="${DATABASE_URL:-${GOVOPLAN_PRODUCTION_LIKE_DATABASE_URL:-postgresql+psycopg://govoplan:govoplan-dev@127.0.0.1:55433/govoplan}}"
+export GOVOPLAN_DATABASE_URL_PGTOOLS="${GOVOPLAN_DATABASE_URL_PGTOOLS:-${GOVOPLAN_PRODUCTION_LIKE_DATABASE_URL_PGTOOLS:-postgresql://govoplan:govoplan-dev@127.0.0.1:55433/govoplan}}"
+export REDIS_URL="${REDIS_URL:-${GOVOPLAN_PRODUCTION_LIKE_REDIS_URL:-redis://127.0.0.1:56379/0}}"
+export CELERY_ENABLED="${CELERY_ENABLED:-true}"
+export ENABLED_MODULES="${ENABLED_MODULES:-tenancy,organizations,identity,access,admin,dashboard,policy,audit,campaigns,files,mail,calendar,docs,ops}"
+export FILE_STORAGE_BACKEND="${FILE_STORAGE_BACKEND:-local}"
+export FILE_STORAGE_LOCAL_ROOT="${FILE_STORAGE_LOCAL_ROOT:-$ROOT/runtime/production-like/files}"
+export DEV_AUTO_MIGRATE_ENABLED="${DEV_AUTO_MIGRATE_ENABLED:-false}"
+export DEV_BOOTSTRAP_ENABLED="${DEV_BOOTSTRAP_ENABLED:-true}"
+export CORS_ORIGINS="${CORS_ORIGINS:-http://127.0.0.1:5173,http://localhost:5173}"
+
+if [ -z "${MASTER_KEY_B64:-}" ]; then
+  MASTER_KEY_B64="$("$PYTHON" -m govoplan_core.commands.config env-template --profile production-like --generate-secrets | sed -n 's/^MASTER_KEY_B64=//p' | head -n 1)"
+  export MASTER_KEY_B64
+fi
+
+compose() {
+  "$DOCKER" compose --env-file "$PROFILE_ENV" -f "$PROFILE_ROOT/docker-compose.yml" "$@"
+}
+
+validate_config() {
+  "$PYTHON" -m govoplan_core.commands.config validate --profile production-like
+}
+
+case "$command" in
+  start)
+    exec "$ROOT/scripts/launch-production-like-dev.sh"
+    ;;
+  stop)
+    compose down
+    ;;
+  status)
+    compose ps
+    validate_config
+    ;;
+  seed)
+    validate_config
+    "$PYTHON" -m govoplan_core.commands.init_db --database-url "$DATABASE_URL" --with-dev-data
+    ;;
+  reset)
+    [ "$yes" = "1" ] || fail "reset is destructive; rerun with --yes"
+    compose down -v
+    rm -rf "$ROOT/runtime/production-like"
+    ;;
+  validate-config)
+    validate_config
+    ;;
+  *)
+    usage >&2
+    fail "unknown command: $command"
+    ;;
+esac
--- a/scripts/push-release-tag.sh
+++ b/scripts/push-release-tag.sh
@@ -58,6 +58,7 @@ Repos:
  govoplan-tenancy
  govoplan-organizations
  govoplan-identity
+  govoplan-idm
  govoplan-policy
  govoplan-audit
  govoplan-dashboard
@@ -70,7 +71,7 @@ Repos:

  Roadmap/scaffold module repositories are tag-only until they have package
  metadata: addresses, appointments, cases, connectors, dms, erp,
-  fit-connect, forms, identity-trust, idm, ledger, notifications, payments,
+  fit-connect, forms, identity-trust, ledger, notifications, payments,
  portal, reporting, scheduling, search, tasks, templates, workflow, xoev,
  xrechnung, and xta-osci.

@@ -94,6 +95,7 @@ PACKAGE_MODULE_REPOS=(
  "$PARENT/govoplan-tenancy"
  "$PARENT/govoplan-organizations"
  "$PARENT/govoplan-identity"
+  "$PARENT/govoplan-idm"
  "$PARENT/govoplan-policy"
  "$PARENT/govoplan-audit"
  "$PARENT/govoplan-dashboard"
@@ -113,7 +115,6 @@ TAG_ONLY_MODULE_REPOS=(
  "$PARENT/govoplan-fit-connect"
  "$PARENT/govoplan-forms"
  "$PARENT/govoplan-identity-trust"
-  "$PARENT/govoplan-idm"
  "$PARENT/govoplan-ledger"
  "$PARENT/govoplan-notifications"
  "$PARENT/govoplan-payments"
@@ -301,6 +302,9 @@ update_manifest_version() {
    govoplan-identity)
      manifest_path="$repo/src/govoplan_identity/backend/manifest.py"
      ;;
+    govoplan-idm)
+      manifest_path="$repo/src/govoplan_idm/backend/manifest.py"
+      ;;
    govoplan-policy)
      manifest_path="$repo/src/govoplan_policy/backend/manifest.py"
      ;;