mirror of
https://github.com/kuhyx/utils.git
synced 2026-11-10 19:27:16 +01:00
Krzysztof kuhy Rudnicki
2a2f18ca56
"Are we on the newest version?" was not mechanically answerable across these repos: constraint styles had drifted per-ecosystem and a caret range is "newest-compatible" by definition, which gives a checker nothing to compare. This gate makes it answerable and then enforces the answer. Checks two things at once -- that every dependency carries an exact pin, and that the pin equals its registry's latest STABLE release -- across pub.dev, PyPI, npm, crates.io, the Go proxy, kuhyx/utils git tags, and the Flutter / Node / Python toolchains. Three deliberate design points: * Pre-releases are rejected per-ecosystem, because every ecosystem leaks them differently and each leak fails GREEN. npm lets a maintainer point `dist-tags.latest` at an rc; crates.io's `max_version` includes them; PyPI's legacy `info.version` includes yanked releases. Unit-tested with fixtures, since an end-to-end run cannot surface a wrong "up to date". * Offline, the gate serves an expired cache entry and PASSES with a DEGRADED banner (exit 3 only under --strict, which is CI). `--no-verify` is banned here, so a hook that hard-failed offline would leave no way to commit at all. * The allowlist has two entry classes. `blocked_by: transitive:<pkg>@<ver>` is a predicate that clears itself when upstream moves and must NOT carry a date; everything else is discretionary and requires `expires`, capped at 90 days. Exact pins plus latest-everywhere is provably unsatisfiable when a dependency internally constrains a shared transitive, and expiring the predicate class on a calendar would turn the gate red for a reason no commit could fix. An entry with nothing left to excuse is itself an error. One hook id, one shim, one shared implementation -- always delegating, so it cannot fork the way the 250-line cap forked into four ids, two of which were independent reimplementations. 256 tests, 100% branch coverage on every module of the gate. Also adds the workflow that runs them, which incidentally gives md_naming's 71 tests their first CI run. Not yet installed in any repo: a repo that gets the gate before its deps are bumped is instantly and permanently red, so the gate and the upgrade land together, per repo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CRykabMwPgDzFHcARoqpaK
80 lines
2.6 KiB
Python
80 lines
2.6 KiB
Python
"""The only module that touches the network.
|
|
|
|
Two things matter here. First, a single 2s per-host reachability probe
|
|
short-circuits every later request, so an offline run fails in seconds instead
|
|
of timing out once per package across ~900 lookups. Second, failures are
|
|
returned, never raised: the gate must degrade to a cached answer rather than
|
|
crash a pre-commit hook the user is forbidden from bypassing.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import socket
|
|
from typing import Any
|
|
from urllib.error import HTTPError, URLError
|
|
from urllib.parse import urlsplit
|
|
from urllib.request import Request, urlopen
|
|
|
|
from dep_freshness._tables import HTTP_TIMEOUT, PROBE_TIMEOUT, USER_AGENT
|
|
|
|
|
|
class Offline(Exception):
|
|
"""The host is unreachable; callers should fall back to the cache."""
|
|
|
|
|
|
_reachable: dict[str, bool] = {}
|
|
_forced_offline = False
|
|
|
|
|
|
def force_offline(value: bool = True) -> None:
|
|
"""Make every request raise `Offline` without touching the network."""
|
|
global _forced_offline
|
|
_forced_offline = value
|
|
|
|
|
|
def reset_probes() -> None:
|
|
"""Forget cached reachability verdicts (tests, and `--refresh`)."""
|
|
_reachable.clear()
|
|
|
|
|
|
def host_reachable(url: str) -> bool:
|
|
"""One cheap TCP probe per host, memoised for the run."""
|
|
if _forced_offline:
|
|
return False
|
|
parts = urlsplit(url)
|
|
host = parts.hostname or ""
|
|
if host in _reachable:
|
|
return _reachable[host]
|
|
port = parts.port or (443 if parts.scheme == "https" else 80)
|
|
try:
|
|
with socket.create_connection((host, port), timeout=PROBE_TIMEOUT):
|
|
_reachable[host] = True
|
|
except OSError:
|
|
_reachable[host] = False
|
|
return _reachable[host]
|
|
|
|
|
|
def get_json(url: str, accept: str | None = None) -> Any:
|
|
"""Fetch and decode JSON, or raise `Offline` / return None on 404.
|
|
|
|
`Offline` means "ask the cache"; None means "the registry answered and
|
|
this package genuinely is not there", which is a real finding rather than
|
|
a degraded run and must not be papered over with a stale cache entry.
|
|
"""
|
|
if not host_reachable(url):
|
|
raise Offline(url)
|
|
headers = {"User-Agent": USER_AGENT}
|
|
if accept:
|
|
headers["Accept"] = accept
|
|
request = Request(url, headers=headers)
|
|
try:
|
|
with urlopen(request, timeout=HTTP_TIMEOUT) as response:
|
|
return json.loads(response.read().decode("utf-8"))
|
|
except HTTPError as exc:
|
|
if exc.code == 404:
|
|
return None
|
|
raise Offline(f"{url}: HTTP {exc.code}") from exc
|
|
except (URLError, TimeoutError, OSError, ValueError) as exc:
|
|
raise Offline(f"{url}: {exc}") from exc
|