Environments: the token names the environment once approved; a Deployments page b644e1757711

-- Environments (oxygenflow#59): the environment a job deploys to, from

-- its pipeline, so a repository's Deployments page can say what each one

-- runs.

ALTER TABLE flow_jobs ADD COLUMN environment TEXT NOT NULL DEFAULT '';

CREATE INDEX flow_jobs_environment ON flow_jobs(environment) WHERE environment != '';

{% extends "base.html" %}

{% import "repo_tabs.html" as m %}

{% block title %}Deployments · {{ repo.owner }}/{{ repo.name }}{% endblock %}

{% block tabs %}{% call m::tabs(repo, "flow") %}{% endblock %}

{% block content %}

<div class="head"><h1>Deployments <small>what each environment runs</small></h1></div>

{% if current.is_empty() %}

<p class="empty">Nothing deployed yet. A job deploys to an environment with <code>environment "prod"</code> in <a href="{{ repo.url }}/file/{{ repo.default_bookmark }}/.flow/pipeline.kdl">.flow/pipeline.kdl</a>; its identity tokens name the environment once the job is approved.</p>

{% else %}

<section class="panel">

  <table class="plain-table">

    <thead><tr><th>Environment</th><th>State</th><th>Run</th><th>Job</th><th>Approved by</th><th>When</th></tr></thead>

    <tbody>{% for d in current %}<tr><td><strong>{{ d.environment }}</strong></td><td><a href="{{ repo.url }}/tree/{{ d.state }}"><code>{{ d.state|short }}</code></a>{% if !d.bookmark.is_empty() %} <span class="lbl lbl-bm">{{ d.bookmark }}</span>{% endif %}</td><td><a href="{{ repo.url }}/flow/{{ d.run_number }}">#{{ d.run_number }}</a></td><td>{{ d.job }}</td><td>{% if d.approved_by.is_empty() %}<span class="mute">not gated</span>{% else %}{{ d.approved_by }}{% endif %}</td><td><time title="{{ d.finished_ms|when_i }}">{{ d.finished_ms|ago_i }}</time></td></tr>{% endfor %}</tbody>

  </table>

</section>

<section class="panel">

  <h2>History</h2>

  <ul class="plain small">{% for d in history %}<li><strong>{{ d.environment }}</strong> ← <a href="{{ repo.url }}/flow/{{ d.run_number }}">run #{{ d.run_number }}</a> {{ d.job }} at <code>{{ d.state|short }}</code>{% if !d.approved_by.is_empty() %}, approved by {{ d.approved_by }}{% endif %}, started by {{ d.actor }} · <time title="{{ d.finished_ms|when_i }}">{{ d.finished_ms|ago_i }}</time></li>{% endfor %}</ul>

</section>

{% endif %}

{% endblock %}

        .route("/repos/{owner}/{name}/deployments", get(list_deployments))

/// `GET /repos/{o}/{n}/deployments`: deployments, newest first

/// (oxygenflow#59).

async fn list_deployments(

    State(app): State<Shared>,

    headers: HeaderMap,

    Path((owner, name)): Path<(String, String)>,

) -> Result<Json<Vec<serde_json::Value>>, ApiError> {

    let c = caller(&app, &headers).await?;

    let (_, row, _) = reach(&app, &c, &owner, &name, Access::Read).await?;

    let list = db::flow::deployments(&app.db, row.id, 100).await?;

    Ok(Json(

        list.into_iter()

            .map(|d| {

                serde_json::json!({ "environment": d.environment, "job": d.job, "run": d.run_number, "state": d.state,

                    "bookmark": d.bookmark, "actor": d.actor, "approved_by": d.approved_by, "finished_ms": d.finished_ms })

            })

            .collect(),

    ))

}

    /// The environment it deploys to, or empty (oxygenflow#59).

    pub environment: String,

            "INSERT INTO flow_jobs (run_id, name, depth, depends, spec, sandbox, runtime, status, need_disk_mib, approval, environment) \

             VALUES (?, ?, ?, ?, ?, ?, ?, 'queued', ?, ?, ?)",

        .bind(environment_of(&j.spec))

/// The environment a compiled job deploys to, or empty (oxygenflow#59).

fn environment_of(spec: &str) -> String {

    serde_json::from_str::<serde_json::Value>(spec).ok().and_then(|v| v["environment"].as_str().map(String::from)).unwrap_or_default()

}

    .fetch_all(pool)

    .await

}

/// One deployment: a job for an environment that passed.

#[derive(Clone, Debug, FromRow)]

pub struct Deployment {

    pub environment: String,

    pub job: String,

    pub run_number: i64,

    pub state: String,

    pub bookmark: String,

    pub actor: String,

    pub approved_by: String,

    pub finished_ms: i64,

}

/// A repository's deployments, newest first (oxygenflow#59).

pub async fn deployments(pool: &Pool, repo_id: i64, limit: i64) -> sqlx::Result<Vec<Deployment>> {

    sqlx::query_as(

        "SELECT j.environment, j.name AS job, r.number AS run_number, r.state, r.bookmark, r.actor, j.approved_by, \

         COALESCE(j.finished_ms, 0) AS finished_ms FROM flow_jobs j JOIN flow_runs r ON r.id = j.run_id \

         WHERE r.repo_id = ? AND j.environment != '' AND j.status = 'passed' ORDER BY j.finished_ms DESC LIMIT ?",

    )

    .bind(repo_id)

    .bind(limit)

    // An environment goes in its tokens only once the job was approved

    // (oxygenflow#59): the approval is the environment's protection.

    let environment = claim.job.environment.clone().filter(|_| job.approval == "approved");

    if let (Some(e), None, false) = (&claim.job.environment, &environment, claim.job.identities.is_empty()) {

        left_out.push(format!(

            "environment {e}: not in the job's identity tokens, because the job was not approved (give it an approval block)"

        ));

    }

                environment: environment.as_deref(),

    /// The environment the job deploys to, only once it was approved

    /// (oxygenflow#59).

    pub environment: Option<&'a str>,

                "repository_visibility", "bookmark", "run_number", "job", "state", "runner", "actor", "environment"],

        let mut payload = serde_json::json!({

        if let Some(e) = c.environment {

            payload["environment"] = serde_json::Value::from(e);

        }

            environment: Some("prod"),

        assert_eq!(got["environment"], "prod");

        let plain = issuer.mint(&JobClaims { environment: None, ..claims });

        assert!(again.verify(&plain, "sts.amazonaws.com", 1_800_000_500_000).unwrap().get("environment").is_none(), "only when approved");

#[derive(Template)]

#[template(path = "deployments.html")]

pub struct DeploymentsPage {

    shell: Shell,

    repo: RepoShell,

    /// Each environment's newest deployment, by name.

    current: Vec<fdb::Deployment>,

    /// Every recent deployment, newest first.

    history: Vec<fdb::Deployment>,

}

/// `GET /{owner}/{name}/deployments`: what each environment runs

/// (oxygenflow#59).

pub async fn deployments(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, name)): Path<(String, String)>,

) -> Result<Page<DeploymentsPage>, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/{name}/deployments"), &viewer);

    let (_repo, row, role) = lookup(&app, &shell, &viewer, &owner, &name).await?;

    let history = fdb::deployments(&app.db, row.id, 50).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    let mut current: Vec<fdb::Deployment> = Vec::new();

    for d in &history {

        if !current.iter().any(|c| c.environment == d.environment) {

            current.push(d.clone());

        }

    }

    current.sort_by(|a, b| a.environment.cmp(&b.environment));

    Ok(Page(DeploymentsPage { shell, repo: RepoShell::new(&app, &row, "flow").with_role(role), current, history }))

}

        .route("/{owner}/{name}/deployments", get(flow::deployments))

            "schema-version 1\nsandbox \"alpine\" {{\n    rootfs \"cas://blob/{ROOTFS}\"\n}}\njob \"plan\" {{\n    sandbox \"alpine\"\n    exec \"plan\"\n}}\njob \"apply\" {{\n    sandbox \"alpine\"\n    depends-on \"plan\"\n    approval {{\n        by \"maintain\"\n        others-only #true\n    }}\n    environment \"prod\"\n    identity \"https://sts.example\" {{\n        mount-path \"/run/secrets/cloud\"\n    }}\n    exec \"apply\"\n}}\n"

    // Approved, its identity token names the environment (oxygenflow#59).

    let token =

        j["secrets"].as_array().unwrap().iter().find(|s| s["path"] == "/run/secrets/cloud").unwrap()["value"].as_str().unwrap().to_string();

    let claims = h.app.oidc().await.unwrap().verify(&token, "https://sts.example", db::now_ms()).expect("a valid token");

    assert_eq!(claims["environment"], "prod");

    let (_, page) = call(&h.app, "GET", "/andy/gated/deployments", None, None).await;

    assert!(page.contains("<strong>prod</strong>") && page.contains(">#1</a>") && page.contains("<td>carol</td>"), "the Deployments page");

    let (_, list) = call(&h.app, "GET", "/api/v1/repos/andy/gated/deployments", Some("site"), None).await;

    let list: serde_json::Value = serde_json::from_str(&list).unwrap();

    assert_eq!((list[0]["environment"].as_str(), list[0]["approved_by"].as_str()), (Some("prod"), Some("carol")));

<div class="head"><h1>Flow <small>pipeline runs · <a href="{{ repo.url }}/deployments">deployments</a></small></h1>