175 lines
7.4 KiB
Python
175 lines
7.4 KiB
Python
#!/usr/bin/env python3
|
|
"""Adopt reviewed legacy deployment edits into a local Compose override.
|
|
|
|
Only deployment configuration is accepted. Business code and arbitrary untracked
|
|
files remain untouched. Backups contain private settings and use mode 0700/0600.
|
|
"""
|
|
import copy
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
import shutil
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
import time
|
|
|
|
try:
|
|
import yaml
|
|
except ImportError:
|
|
sys.exit('❌ 迁移旧部署配置需要 Python PyYAML；尚未修改配置或容器')
|
|
|
|
root = Path(sys.argv[1]).resolve()
|
|
os.chdir(root)
|
|
|
|
|
|
def git(*args):
|
|
return subprocess.check_output(['git', *args], text=True)
|
|
|
|
|
|
upstream = git('rev-parse', '--abbrev-ref', '@{upstream}').strip()
|
|
subprocess.run(['git', 'fetch', '--quiet', upstream.split('/')[0]], check=True)
|
|
subprocess.run(['git', 'merge-base', '--is-ancestor', 'HEAD', upstream], check=True)
|
|
changed = set(git('diff', 'HEAD', '--name-only').splitlines())
|
|
if changed - {'docker-compose.yml'}:
|
|
sys.exit('❌ 存在部署配置以外的本地代码修改；尚未修改配置或容器')
|
|
tracked = set(git('ls-tree', '-r', '--name-only', upstream).splitlines())
|
|
untracked = set(git('ls-files', '--others', '--exclude-standard').splitlines())
|
|
collisions = tracked & untracked
|
|
allowed = {'scripts/init-security-env.sh'}
|
|
if any(p not in allowed and not (Path(p).parent == Path('.') and p.endswith('.conf')) for p in collisions):
|
|
sys.exit('❌ 存在新版仓库会覆盖的其他本地文件；尚未修改配置或容器')
|
|
if not changed and not collisions:
|
|
sys.exit(0)
|
|
for name in changed | collisions:
|
|
if not (root / name).is_file() or (root / name).is_symlink():
|
|
sys.exit('❌ 配置文件类型不受支持；尚未修改配置或容器')
|
|
|
|
|
|
MISSING = object()
|
|
|
|
|
|
def clone(value):
|
|
return MISSING if value is MISSING else copy.deepcopy(value)
|
|
|
|
|
|
def volume_target(value):
|
|
# Ignore colons inside ${VARIABLE:-default} when identifying the mount target.
|
|
depth = 0
|
|
separators = []
|
|
for i, char in enumerate(value):
|
|
if char == '{': depth += 1
|
|
elif char == '}': depth -= 1
|
|
elif char == ':' and depth == 0: separators.append(i)
|
|
if not separators: return value
|
|
end = separators[1] if len(separators) > 1 else len(value)
|
|
return value[separators[0] + 1:end]
|
|
|
|
|
|
def canonical(value, key=''):
|
|
if isinstance(value, dict):
|
|
return {k: canonical(v, k) for k, v in value.items()}
|
|
if isinstance(value, list):
|
|
if key in ('environment', 'labels'):
|
|
return dict((v.partition('=')[0], v.partition('=')[2] if '=' in v else None) for v in value)
|
|
if key == 'networks': return {v: {} for v in value}
|
|
if key == 'volumes' and all(isinstance(v, str) for v in value):
|
|
return {volume_target(v): v for v in value}
|
|
return value
|
|
|
|
|
|
preserved = []
|
|
|
|
|
|
def merge(base, local, remote, path=()):
|
|
if local == base: return clone(remote)
|
|
if local == remote: return clone(remote)
|
|
if isinstance(local, dict) and isinstance(remote, dict) and (isinstance(base, dict) or base is MISSING):
|
|
old = base if isinstance(base, dict) else {}
|
|
result = {}
|
|
for key in sorted(set(old) | set(local) | set(remote)):
|
|
value = merge(old.get(key, MISSING), local.get(key, MISSING), remote.get(key, MISSING), path + (key,))
|
|
if value is not MISSING: result[key] = value
|
|
return result
|
|
if local is MISSING and base is MISSING: return clone(remote)
|
|
if local is MISSING: return MISSING
|
|
if remote is MISSING and base is not MISSING:
|
|
sys.exit('❌ 新版删除了仍被本地修改的字段，无法安全合并；尚未修改配置或容器')
|
|
preserved.append('.'.join(path))
|
|
return clone(local)
|
|
|
|
|
|
def delta(remote, merged):
|
|
if remote == merged: return MISSING
|
|
if isinstance(remote, dict) and isinstance(merged, dict):
|
|
result = {}
|
|
for key in merged:
|
|
value = delta(remote.get(key, MISSING), merged[key])
|
|
if value is not MISSING: result[key] = value
|
|
# Removal cannot be safely represented by an ordinary Compose override.
|
|
if set(remote) - set(merged):
|
|
sys.exit('❌ 本地配置删除了新版字段，无法安全合并；尚未修改配置或容器')
|
|
return result
|
|
return copy.deepcopy(merged)
|
|
|
|
|
|
def serialize(value, key=''):
|
|
if isinstance(value, dict):
|
|
if key == 'volumes': return list(value.values())
|
|
return {k: serialize(v, k) for k, v in value.items()}
|
|
return value
|
|
|
|
|
|
base = canonical(yaml.safe_load(git('show', 'HEAD:docker-compose.yml')))
|
|
local = canonical(yaml.safe_load((root / 'docker-compose.yml').read_text()))
|
|
remote_text = git('show', upstream + ':docker-compose.yml')
|
|
remote = canonical(yaml.safe_load(remote_text))
|
|
merged = merge(base, local, remote)
|
|
override = delta(remote, merged)
|
|
with tempfile.NamedTemporaryFile(mode='w', dir=root, prefix='.update-compose-', suffix='.json', delete=False) as candidate:
|
|
json.dump(serialize(merged), candidate)
|
|
candidate_path = Path(candidate.name)
|
|
try:
|
|
candidate_path.chmod(0o600)
|
|
compose = ['docker', 'compose'] if shutil.which('docker') else ['docker-compose']
|
|
validation = subprocess.run(compose + ['--env-file', '.env', '-f', str(candidate_path), 'config', '--quiet'], capture_output=True, text=True)
|
|
if validation.returncode:
|
|
sys.exit('❌ 合并后的部署配置未通过校验；尚未修改配置或容器')
|
|
finally:
|
|
candidate_path.unlink()
|
|
backup_root = root / 'data/deployment-backups'
|
|
backup_root.mkdir(parents=True, exist_ok=True, mode=0o700)
|
|
backup = Path(tempfile.mkdtemp(prefix='legacy-update-' + time.strftime('%Y%m%d-%H%M%S') + '-', dir=backup_root))
|
|
backup.chmod(0o700)
|
|
for name in changed | collisions | {'.env'}:
|
|
destination = backup / name
|
|
destination.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
|
|
shutil.copy2(root / name, destination)
|
|
destination.chmod(0o600)
|
|
config_dir = root / 'data/deployment-config'
|
|
config_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
|
|
override_path = config_dir / 'legacy-compose.json'
|
|
if override is not MISSING and override:
|
|
if override_path.exists():
|
|
sys.exit('❌ 已存在旧配置迁移结果；请检查备份后再重试，尚未修改仓库')
|
|
override_path.write_text(json.dumps(serialize(override), indent=2) + '\n')
|
|
override_path.chmod(0o600)
|
|
env_path = root / '.env'
|
|
lines = env_path.read_text().splitlines()
|
|
existing = next((line.partition('=')[2].strip().strip('"').strip("'") for line in lines if line.startswith('COMPOSE_FILE=')), '')
|
|
files = existing.split(os.pathsep) if existing else ['docker-compose.yml']
|
|
relative = str(override_path.relative_to(root))
|
|
if relative not in files: files.append(relative)
|
|
lines = [line for line in lines if not line.startswith('COMPOSE_FILE=')]
|
|
lines.append('COMPOSE_FILE=' + os.pathsep.join(files))
|
|
env_path.write_text('\n'.join(lines) + '\n')
|
|
env_path.chmod(0o600)
|
|
for name in collisions:
|
|
(root / name).unlink()
|
|
if changed:
|
|
subprocess.run(['git', 'restore', '--source=HEAD', '--staged', '--worktree', '--', 'docker-compose.yml'], check=True)
|
|
(backup / 'migration.json').write_text(json.dumps({'from': git('rev-parse', 'HEAD').strip(), 'to': git('rev-parse', upstream).strip(), 'preservedFields': preserved, 'files': sorted(changed | collisions)}, indent=2))
|
|
(backup / 'migration.json').chmod(0o600)
|
|
print('✅ 已备份旧配置并迁移本地差异；新版部署字段由仓库继续管理')
|
|
print(' 备份目录: ' + str(backup))
|