36 lines
2.6 KiB
Text
36 lines
2.6 KiB
Text
|
let d = import "../defaults.ncl" in
|
||
|
|
|
||
|
|
# Verifier for binary neutrality (ADR-001, single-image deploy).
|
||
|
|
# Every per-site identity knob — logo (light/dark/alt), public origin, site name —
|
||
|
|
# must remain RUNTIME-OVERRIDABLE in source (an env var read with a baked default),
|
||
|
|
# so the shared binary carries only DEFAULTS and a consumer overrides them at deploy.
|
||
|
|
# A knob that loses its override would hardcode one site into the binary, breaking
|
||
|
|
# the single-image model. Static source check; runnable as `just validate-neutral-binary`.
|
||
|
|
|
||
|
|
d.make_mode String {
|
||
|
|
id = "validate-neutral-binary",
|
||
|
|
trigger = "Validate the binary is site-neutral: every per-site identity knob (logo, origin, name) stays runtime-overridable in source so the shared image bakes only defaults. ADR-001 single-image deploy.",
|
||
|
|
|
||
|
|
preconditions = [
|
||
|
|
"rg (ripgrep) available on PATH",
|
||
|
|
"code/crates/server/src/theme.rs and shell/seo.rs exist",
|
||
|
|
],
|
||
|
|
|
||
|
|
steps = [
|
||
|
|
{
|
||
|
|
id = "check-knobs-overridable",
|
||
|
|
action = "Per-site identity must come from the consumer's runtime config, never baked/hardcoded. Assert: theme.rs reads the logo from the consumer's site.ncl [logo] (logo_from_site_config / site.ncl present); the home hero template does NOT hardcode a logo path (it uses the site_logo global); SITE_BASE_URL + SITE_NAME remain runtime env in seo.rs. A hardcoded logo or a baked identity is a neutrality violation.",
|
||
|
|
cmd = "cd code && fails=0; have(){ if rg -q \"$1\" \"$2\"; then echo \"PASS $3\"; else echo \"FAIL $3\"; fails=$((fails+1)); fi; }; absent(){ if [ -z \"$(rg -n \"$1\" \"$2\" 2>/dev/null)\" ]; then echo \"PASS $3\"; else echo \"FAIL $3 (hardcoded)\"; fails=$((fails+1)); fi; }; have 'logo_from_site_config|site\\.ncl' crates/server/src/theme.rs 'logo from site.ncl'; absent 'src=\"/images/' crates/pages_htmx/templates/pages/home.j2 'home template no hardcoded image'; have '\\\"SITE_BASE_URL\\\"' crates/server/src/shell/seo.rs 'origin env'; have '\\\"SITE_NAME\\\"' crates/server/src/shell/seo.rs 'name env'; echo \"neutrality violations: $fails\"",
|
||
|
|
actor = 'Both,
|
||
|
|
on_error = { strategy = 'Continue },
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id = "report",
|
||
|
|
action = "ALL PASS ⇒ the binary bakes only defaults; a consumer overrides logo/origin/name at deploy (single-image). ANY FAIL ⇒ a knob lost its env override and the binary would hardcode one site; restore the `std::env::var(...).unwrap_or(baked)` seam before the binary can claim neutrality.",
|
||
|
|
actor = 'Both,
|
||
|
|
depends_on = [{ step = "check-knobs-overridable" }],
|
||
|
|
on_error = { strategy = 'Stop },
|
||
|
|
},
|
||
|
|
],
|
||
|
|
}
|