39 lines
2.9 KiB
Text
39 lines
2.9 KiB
Text
# Catalog component contract — content-addressed distribution (ADR-046)
|
|
#
|
|
# Producer: publish the contract schema as a content-addressed OCI Domain
|
|
# artifact — an immutable referrers anchor (once per id) plus one referrer per
|
|
# version carrying its org.opencontainers.image.version annotation.
|
|
# Consumer: resolve a catalog's requires.contract to an immutable digest pinned
|
|
# in catalog.lock.ncl, and validate manifests against the pulled contract.
|
|
#
|
|
# Registry credentials resolve from the active workspace's .ontoref manifest +
|
|
# SOPS via the same machinery as `prvng integration` (ADR-042). Run producer
|
|
# recipes from a workspace whose scope includes domains/<participant>/.
|
|
|
|
_contract_cli := "core/nulib/platform/oci/contract_cli.nu"
|
|
_nulib := justfile_directory() / "core" / "nulib"
|
|
|
|
# Publish the referrers anchor for a contract id (run once) — prints subject digest
|
|
[doc("Publish the referrers anchor for a contract id; prints the subject digest for requires.contract.subject")]
|
|
contract-publish-anchor id participant="provisioning" registry="":
|
|
PROVISIONING="{{justfile_directory()}}" NU_LIB_DIRS="{{_nulib}}" nu "{{_contract_cli}}" publish-anchor "{{id}}" --participant "{{participant}}" --registry "{{registry}}"
|
|
|
|
# Attach a contract version as a referrer to the anchor
|
|
[doc("Attach a contract version as a referrer — args: contract_file id version subject")]
|
|
contract-publish-version contract_file id version subject participant="provisioning" registry="":
|
|
PROVISIONING="{{justfile_directory()}}" NU_LIB_DIRS="{{_nulib}}" nu "{{_contract_cli}}" publish-version "{{contract_file}}" "{{id}}" "{{version}}" "{{subject}}" --participant "{{participant}}" --registry "{{registry}}"
|
|
|
|
# Select the push registry from a pluggable source — apply with: eval "$(just contract-use-registry ...)"
|
|
[doc("Resolve push registry from a source (sops|api|literal|env) and emit export lines to eval")]
|
|
contract-use-registry kind value="" endpoint_key="endpoint" user_key="username" pass_key="password" vault_id="":
|
|
@PROVISIONING="{{justfile_directory()}}" NU_LIB_DIRS="{{_nulib}}" nu "{{_contract_cli}}" select-registry --kind "{{kind}}" --value "{{value}}" --endpoint-key "{{endpoint_key}}" --user-key "{{user_key}}" --pass-key "{{pass_key}}" --vault-id "{{vault_id}}"
|
|
|
|
# Resolve a catalog's requires.contract to a digest and pin catalog.lock.ncl
|
|
[doc("Resolve requires.contract to an immutable digest and write catalog.lock.ncl")]
|
|
contract-resolve catalog_root manifest:
|
|
PROVISIONING="{{justfile_directory()}}" NU_LIB_DIRS="{{_nulib}}" nu "{{_contract_cli}}" resolve "{{catalog_root}}" "{{manifest}}"
|
|
|
|
# Validate a manifest against its declared contract (resolve + typecheck) — CI gate
|
|
[doc("CI gate: resolve a manifest's contract and typecheck the manifest against it")]
|
|
contract-validate manifest catalog_root="":
|
|
PROVISIONING="{{justfile_directory()}}" NU_LIB_DIRS="{{_nulib}}" nu "{{_contract_cli}}" validate "{{manifest}}" --catalog-root "{{catalog_root}}"
|