green

#!/usr/bin/env bb
;; doks launcher — one managed Kubernetes cluster (DigitalOcean DOKS or Vultr
;; VKE) through the colors-compute library, with an optional deployment-owned
;; DigitalOcean container registry integrated with the cluster.
;;
;; Desired state lives in colors.yml, found by walking up from the working
;; directory. Secrets and tokens are never written there: every credential key
;; is supplied at runtime through a COLORS_PAR_* environment variable, which is
;; overlaid onto the matching flat key.
;;
;; COLORS_PAR_PROFILE is the exception — doks refuses to run when it is set.
;; The profile names this project's work directory, OpenTofu state keys and
;; cloud resources, and overriding it from the environment can only point doks
;; at another project's state.
;;
;; This file is both the skill payload and the repository entry point — ./green
;; in the project root is a symlink to it. It deliberately holds no logic of its
;; own: validation, the graph and the steps all live in the `doks` library,
;; where the test suite reaches them. A copied payload is the one place in this
;; project where code cannot be tested, so nothing that can live elsewhere
;; should live here. scripts/launcher.sh covers what remains.

(require '[babashka.fs :as fs]
         '[clojure.java.io :as io]
         '[clojure.string :as str])

(def script-dir
  (let [file (if (= "NO_SOURCE_PATH" *file*)
               (fs/path (fs/cwd) "green")
               (fs/path *file*))]
    (str (fs/parent (fs/canonicalize file)))))

;; ---------------------------------------------------------------------------
;; Dependency bootstrap
;;
;; Nothing in this stack is published to Clojars, so a standalone copy of this
;; launcher resolves `doks` as an immutable git dependency and lets tools.deps
;; pull `green` and `colors-compute` transitively from doks's own deps.edn. When
;; the classpath already provides doks — running inside the project, where
;; bb.edn supplies a local root — bootstrap is skipped. DOKS_LIB_ROOT,
;; GREEN_LIB_ROOT and COLORS_COMPUTE_LIB_ROOT override immutable dependencies
;; with working trees.

(def ^:private launcher-contract
  "Minimum io.github.getcolors.doks contract this launcher requires. Guarded at
  run time so a stale pin fails loudly instead of rendering documents from an
  older commit."
  1)

;; Managed by `bb pin` — do not edit by hand.
;;
;; nil before this repository has been pushed and stamped: a launcher that
;; cannot resolve its own library says so rather than inventing a SHA or
;; silently falling back to whatever is lying around. `bb pin` refuses to stamp
;; a dirty or unpushed HEAD for the same reason.
(def ^:private doks-sha "8120674e81d88827c4e8b6eaa899b0c5fbaf829c")

(def ^:private doks-git-url "https://github.com/getcolors/doks.git")
(def ^:private green-git-url "https://github.com/getcolors/green.git")
(def ^:private compute-git-url "https://github.com/getcolors/colors-compute.git")

(defn- lib-coord
  [env-var url sha deps-root]
  (if-let [root (System/getenv env-var)]
    {:local/root (if deps-root (str (io/file root deps-root)) root)}
    (when sha
      (cond-> {:git/url url :git/sha sha}
        deps-root (assoc :deps/root deps-root)))))

(def ^:private resolved?
  (some? (io/resource "io/github/getcolors/doks/tools.clj")))

(def ^:private bootstrap-error
  (when (and (System/getProperty "babashka.version") (not resolved?))
    (let [doks (lib-coord "DOKS_LIB_ROOT" doks-git-url doks-sha nil)
          green (lib-coord "GREEN_LIB_ROOT" green-git-url nil nil)
          compute (lib-coord "COLORS_COMPUTE_LIB_ROOT" compute-git-url nil "green")]
      (if-not doks
        (str "this launcher carries no doks pin.\n"
             "It has not been stamped by `bb pin`, which cannot run until the "
             "doks repository has been pushed.\n"
             "Point it at a checkout meanwhile: DOKS_LIB_ROOT=/path/to/doks")
        (do ((requiring-resolve 'babashka.deps/add-deps)
             {:deps (cond-> {'io.github.getcolors/doks doks}
                      green (assoc 'io.github.getcolors/green green)
                      compute (assoc 'io.github.getcolors/colors-compute compute))})
            nil)))))

;; Nothing is required at the top level, deliberately. A bootstrap that resolved
;; nothing leaves green.cli off the classpath too, and a bare `require` here
;; would abort with "could not locate green/cli.clj" — burying the message that
;; actually says what to do. Load defensively instead and let contract-error
;; report.
(def ^:private load-error
  (or bootstrap-error
      (try
        (require 'green.cli 'io.github.getcolors.doks.workflow)
        nil
        (catch Throwable t (or (ex-message t) (str (class t)))))))

(defn- doks-contract
  []
  (or (some-> (requiring-resolve 'io.github.getcolors.doks.utils/contract) deref)
      0))

(defn- contract-error
  "An outcome map when the resolved `doks` predates this launcher."
  []
  (let [resolved (if load-error 0 (doks-contract))]
    (when (< resolved launcher-contract)
      {:green/exit 2
       :green/err (str "this launcher requires doks contract " launcher-contract
                       " but resolved " resolved "\n"
                       (if doks-sha
                         ;; `take` rather than `subs`: doks-sha is nil until
                         ;; `bb pin` stamps it, and a launcher that threw while
                         ;; explaining why it could not start would be worse
                         ;; than useless.
                         (str "the pinned commit " (apply str (take 7 doks-sha))
                              " predates this launcher; update the skill or repin")
                         "no doks library could be resolved")
                       (when load-error (str "\n" load-error)))})))

;; ---------------------------------------------------------------------------
;; Desired-state file resolution

(defn- find-up
  "The nearest `name` at or above `dir`, or nil at the filesystem root."
  [name dir]
  (loop [dir (.getAbsoluteFile (io/file dir))]
    (when dir
      (let [candidate (io/file dir name)]
        (if (.exists candidate)
          (str candidate)
          (recur (.getParentFile dir)))))))

(defn- default-file
  "The nearest colors.yml at or above the working directory, falling back to one
  beside this launcher. Walking up means green can be run from any subdirectory
  of a project and still find the one desired state."
  []
  (or (find-up "colors.yml" ".")
      (let [beside-script (io/file script-dir "colors.yml")]
        (when (.exists beside-script) (str beside-script)))
      "colors.yml"))

(defn- file-arg?
  [arg]
  (or (= "-f" arg)
      (= "--file" arg)
      (str/starts-with? (str arg) "--file=")))

(defn default-args
  [args]
  (let [args (vec args)]
    (cond-> args
      (not-any? file-arg? args) (conj "-f" (default-file)))))

;; ---------------------------------------------------------------------------
;; CLI

(def commands #{"build" "create" "check" "kubeconfig" "registry" "delete"})

(def usage
  (str "Usage: green <build|create|check|kubeconfig|registry|delete> "
       "[-f|--file colors.yml] [--dry-run]\n"
       "\n"
       "  build       render the work directory only — contact nothing\n"
       "  create      converge the managed cluster and, if configured, the registry\n"
       "  check       verify every node is Ready and the registry is integrated\n"
       "  kubeconfig  re-materialize the private kubeconfig from state\n"
       "  registry    write a short-lived docker push config for the registry\n"
       "  delete      guarded: unlink the registry, destroy the cluster, then the registry"))

(defn run
  "REPL-friendly entry point that returns the final outcome map."
  [& args]
  (let [args (vec args)
        command (first args)]
    (cond
      (contains? #{"help" "--help" "-h"} command)
      {:green/exit 0 :green/err usage}

      (contains? commands command)
      ;; Resolved rather than aliased: neither namespace is known to have loaded
      ;; until contract-error has passed.
      (or (contract-error)
          ((requiring-resolve 'green.cli/run-cli)
           @(requiring-resolve 'io.github.getcolors.doks.workflow/workflow)
           (default-args args)
           @(requiring-resolve 'io.github.getcolors.doks.workflow/cli-options)))

      :else {:green/exit 2 :green/err usage})))

(defn -main
  [& args]
  (let [{:green/keys [exit err trace]} (apply run args)]
    (when err
      (binding [*out* (if (zero? (or exit 0)) *out* *err*)]
        (println err)
        (when trace (println trace))))
    (System/exit (or exit 0))))

(defn- launched-as-script?
  []
  (when-let [bb-file (System/getProperty "babashka.file")]
    (= (str (fs/canonicalize bb-file))
       (str (fs/canonicalize *file*)))))

(when (launched-as-script?)
  (apply -main *command-line-args*))