smart_ide/services/ia_dev/deploy/branch-align.sh
Nicolas Cantu 58cc2493e5 chore: consolidate ia_dev module, sync tooling, and harden gateways (0.0.5)
Initial state:
- ia_dev was historically referenced as ./ia_dev in docs and integrations, while the vendored module lives under services/ia_dev.
- AnythingLLM sync and hook installation had error masking / weak exit signaling.
- Proxy layers did not validate proxy path segments, allowing path normalization tricks.

Motivation:
- Make the IDE-oriented workflow usable (sync -> act -> deploy/preview) with explicit errors.
- Reduce security footguns in proxying and script automation.

Resolution:
- Standardize IA_DEV_ROOT usage and documentation to services/ia_dev.
- Add SSH remote data mirroring + optional AnythingLLM ingestion.
- Extend AnythingLLM pull sync to support upload-all/prefix and fail on upload errors.
- Harden smart-ide-sso-gateway and smart-ide-global-api proxying with safe-path checks and non-leaking error responses.
- Improve ia-dev-gateway runner validation and reduce sensitive path leakage.
- Add site scaffold tool (Vite/React) with OIDC + chat via sso-gateway -> orchestrator.

Root cause:
- Historical layout changes (submodule -> vendored tree) and missing central contracts for path resolution.
- Missing validation for proxy path traversal patterns.
- Overuse of silent fallbacks (|| true, exit 0 on partial failures) in automation scripts.

Impacted features:
- Project sync: git pull + AnythingLLM sync + remote data mirror ingestion.
- Site frontends: SSO gateway proxy and orchestrator intents (rag.query, chat.local).
- Agent execution: ia-dev-gateway script runner and SSE output.

Code modified:
- scripts/remote-data-ssh-sync.sh
- scripts/anythingllm-pull-sync/sync.mjs
- scripts/install-anythingllm-post-merge-hook.sh
- cron/git-pull-project-clones.sh
- services/smart-ide-sso-gateway/src/server.ts
- services/smart-ide-global-api/src/server.ts
- services/smart-ide-orchestrator/src/server.ts
- services/ia-dev-gateway/src/server.ts
- services/ia_dev/tools/site-generate.sh

Documentation modified:
- docs/** (architecture, API docs, ia_dev module + integration, scripts)

Configurations modified:
- config/services.local.env.example
- services/*/.env.example

Files in deploy modified:
- services/ia_dev/deploy/*

Files in logs impacted:
- logs/ia_dev.log (runtime only)
- .logs/* (runtime only)

Databases and other sources modified:
- None

Off-project modifications:
- None

Files in .smartIde modified:
- .smartIde/agents/*.md
- services/ia_dev/.smartIde/**

Files in .secrets modified:
- None

New patch version in VERSION:
- 0.0.5

CHANGELOG.md updated:
- yes
2026-04-04 18:36:43 +02:00

136 lines
4.6 KiB
Bash
Executable File

#!/usr/bin/env bash
# Aligns only origin/test, origin/pprod, origin/prod to current branch SHA. main is not aligned.
# Usage: ./deploy/branch-align.sh [project_id] <env>
set -euo pipefail
SCRIPT_REAL="$(readlink -f "${BASH_SOURCE[0]:-$0}" 2>/dev/null || realpath "${BASH_SOURCE[0]:-$0}" 2>/dev/null || echo "${BASH_SOURCE[0]:-$0}")"
DEPLOY_DIR="$(cd "$(dirname "$SCRIPT_REAL")" && pwd)"
IA_DEV_ROOT="$(cd "$DEPLOY_DIR/.." && pwd)"
# shellcheck source=../lib/smart_ide_logs.sh
source "${IA_DEV_ROOT}/lib/smart_ide_logs.sh"
smart_ide_logs_begin "$IA_DEV_ROOT" "$0" "$*"
# Optional first arg: project id (must exist as projects/<id>/conf.json); then re-exec from project root
if [[ -n "${1:-}" && -f "${IA_DEV_ROOT}/projects/${1}/conf.json" && ! "$1" =~ ^(main|test|pprod|prod)$ ]]; then
export IA_PROJECT_ID="$1"
shift
# shellcheck source=../lib/project_config.sh
source "${IA_DEV_ROOT}/lib/project_config.sh"
[[ -n "${PROJECT_ID:-}" ]] && export IA_PROJECT_ID="$PROJECT_ID"
# shellcheck source=../lib/project_git_root_from_conf.sh
source "${IA_DEV_ROOT}/lib/project_git_root_from_conf.sh"
ia_dev_resolve_project_git_root
PROJECT_ROOT="${IA_PROJECT_GIT_ROOT:-}"
if [[ -z "$PROJECT_ROOT" || ! -d "$PROJECT_ROOT" ]]; then
echo "[branch-align][ERROR] Could not resolve project root for project_id ${IA_PROJECT_ID}" >&2
exit 1
fi
cd "$PROJECT_ROOT" && exec "${DEPLOY_DIR}/$(basename "${BASH_SOURCE[0]:-$0}")" "$@"
fi
if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
echo "[branch-align][ERROR] Not in a git repository" >&2
exit 1
fi
PROJECT_ROOT="$(git rev-parse --show-toplevel)"
if [[ "$(pwd)" != "$PROJECT_ROOT" ]]; then
cd "$PROJECT_ROOT" && exec "${DEPLOY_DIR}/$(basename "${BASH_SOURCE[0]:-$0}")" "$@"
fi
env_branch="${1:-}"
if [[ -z "$env_branch" ]]; then
echo "[branch-align][ERROR] Missing <env> argument (expected: main|test|pprod|prod)" >&2
echo "Usage: ./deploy/branch-align.sh [project_id] <env>" >&2
exit 1
fi
if [[ ! "$env_branch" =~ ^(main|test|pprod|prod)$ ]]; then
echo "[branch-align][ERROR] Invalid <env>: must be main, test, pprod or prod (got: '${env_branch}')" >&2
echo "Usage: ./deploy/branch-align.sh [project_id] <env>" >&2
exit 1
fi
current_branch="$(git rev-parse --abbrev-ref HEAD)"
if [[ "$current_branch" != "$env_branch" ]]; then
echo "[branch-align][ERROR] Must be on branch '${env_branch}' (current: '${current_branch}')" >&2
exit 1
fi
# Fetch latest refs
git fetch origin
target_sha="$(git rev-parse "$env_branch")"
origin_env_sha="$(git rev-parse "origin/${env_branch}")"
if [[ "$target_sha" != "$origin_env_sha" ]]; then
echo "[branch-align] origin/${env_branch} differs from local ${env_branch}. Updating remote to local (env priority)."
git push --force-with-lease origin "${target_sha}:${env_branch}"
git fetch origin
fi
# Align all three branches to env SHA
for br in test pprod prod; do
if [[ "$br" == "$env_branch" ]]; then
# Ensure tracking exists
git branch --set-upstream-to="origin/${br}" "$br" >/dev/null 2>&1 || true
continue
fi
git branch -f "$br" "$target_sha"
git push --force-with-lease origin "${target_sha}:${br}"
git branch --set-upstream-to="origin/${br}" "$br" >/dev/null 2>&1 || true
done
# Also ensure env branch tracks its remote
git branch --set-upstream-to="origin/${env_branch}" "$env_branch" >/dev/null 2>&1 || true
# Verify last 30 commits are identical
tmp1="$(mktemp -t branch-align-test.XXXXXX)"
tmp2="$(mktemp -t branch-align-pprod.XXXXXX)"
tmp3="$(mktemp -t branch-align-prod.XXXXXX)"
cleanup() {
local ec=$?
smart_ide_log_end_with_status "$ec"
rm -f "$tmp1" "$tmp2" "$tmp3"
}
trap cleanup EXIT
git log -30 --format=%H origin/test > "$tmp1"
git log -30 --format=%H origin/pprod > "$tmp2"
git log -30 --format=%H origin/prod > "$tmp3"
if ! diff -u "$tmp1" "$tmp2" >/dev/null; then
echo "[branch-align][ERROR] Last 30 commits differ: origin/test vs origin/pprod" >&2
exit 1
fi
if ! diff -u "$tmp1" "$tmp3" >/dev/null; then
echo "[branch-align][ERROR] Last 30 commits differ: origin/test vs origin/prod" >&2
exit 1
fi
# Final assertions
if [[ "$(git rev-parse --abbrev-ref HEAD)" != "$env_branch" ]]; then
echo "[branch-align][ERROR] Branch changed unexpectedly" >&2
exit 1
fi
sha_test="$(git rev-parse origin/test)"
sha_pprod="$(git rev-parse origin/pprod)"
sha_prod="$(git rev-parse origin/prod)"
if [[ "$sha_test" != "$sha_pprod" ]] || [[ "$sha_test" != "$sha_prod" ]]; then
echo "[branch-align][ERROR] Remote branches are not aligned" >&2
echo "origin/test=$sha_test" >&2
echo "origin/pprod=$sha_pprod" >&2
echo "origin/prod=$sha_prod" >&2
exit 1
fi
echo "[branch-align] OK: origin/test, origin/pprod, origin/prod aligned to ${sha_test}"