feat: Add safe ci-deploy-plan workflow

Author: josh-tracey

.github/workflows/sailr-ci.yml

@@ -22,6 +22,7 @@ jobs:
           - ci
           - ci-build-plan
           - ci-generate
+          - ci-deploy-plan
 
     steps:
       - uses: actions/checkout@v4

sailr.workflow.toml

@@ -46,3 +46,16 @@ namespace = "default"
 approval = "prompt"
 apply = true
 report = "text"
+
+[workflow.ci-deploy-plan]
+environment = "local"
+mode = "deploy"
+interactive = false
+build = "plan"
+generate = "run"
+deploy = "plan"
+deploy_context = "none"
+namespace = "default"
+approval = "none"
+apply = false
+report = "both"

src/default_config.toml

@@ -20,3 +20,15 @@ namespace = "default"
 approval = "prompt"
 apply = true
 report = "text"
+[workflow.ci-deploy-plan]
+environment = "local"
+mode = "deploy"
+interactive = false
+build = "plan"
+generate = "run"
+deploy = "plan"
+deploy_context = "none"
+namespace = "default"
+approval = "none"
+apply = false
+report = "both"

src/workflow/plan.rs

@@ -1,6 +1,7 @@
 use crate::builder::SailrBuildPlan;
 use crate::workflow::profile::NormalizedWorkflowProfile;
 use crate::workflow::runner::RunnerContext;
+use serde::Serialize;
 
 #[derive(Debug, Clone)]
 pub struct WorkflowPlan {
@@ -48,3 +49,126 @@ pub struct WorkflowEffects {
     pub mutates_cluster: bool,
     pub prompts_user: bool,
 }
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+pub enum DeploymentPlanMode {
+    Static,
+    LiveDiff,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct WorkflowDeploymentPlan {
+    pub environment: String,
+    pub context: String,
+    pub namespace: String,
+    pub mode: DeploymentPlanMode,
+    pub resources: Vec<DeploymentResourcePlan>,
+    pub summary: DeploymentPlanSummary,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct DeploymentResourcePlan {
+    pub kind: String,
+    pub name: String,
+    pub namespace: Option<String>,
+    pub source_path: String,
+    pub action: DeploymentPlanAction,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum DeploymentPlanAction {
+    WouldApply,
+    WouldCreate,
+    WouldUpdate,
+    Unknown,
+}
+
+impl std::fmt::Display for DeploymentPlanAction {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::WouldApply => write!(f, "would apply"),
+            Self::WouldCreate => write!(f, "would create"),
+            Self::WouldUpdate => write!(f, "would update"),
+            Self::Unknown => write!(f, "unknown"),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct DeploymentPlanSummary {
+    pub total_resources: usize,
+    pub would_apply: usize,
+    pub requires_cluster: bool,
+    pub mutates_cluster: bool,
+}
+
+pub fn generate_static_deployment_plan(
+    environment: &str,
+    context: &str,
+    namespace: &str,
+) -> Result<WorkflowDeploymentPlan, String> {
+    use serde_yaml::Value;
+    use std::path::Path;
+    use walkdir::WalkDir;
+
+    let mut resources = Vec::new();
+    let root_path = format!("k8s/generated/{}", environment);
+
+    if Path::new(&root_path).exists() {
+        for entry in WalkDir::new(&root_path).into_iter().filter_map(|e| e.ok()) {
+            if entry.file_type().is_file() {
+                if let Some(ext) = entry.path().extension() {
+                    if ext == "yaml" || ext == "yml" {
+                        if let Ok(contents) = std::fs::read_to_string(entry.path()) {
+                            for document in contents.split("---") {
+                                if document.trim().is_empty() {
+                                    continue;
+                                }
+                                if let Ok(parsed) = serde_yaml::from_str::<Value>(document) {
+                                    if let Some(kind) = parsed.get("kind").and_then(|v| v.as_str())
+                                    {
+                                        let meta = parsed.get("metadata");
+                                        let name = meta
+                                            .and_then(|m| m.get("name"))
+                                            .and_then(|n| n.as_str())
+                                            .unwrap_or("unknown")
+                                            .to_string();
+                                        let ns = meta
+                                            .and_then(|m| m.get("namespace"))
+                                            .and_then(|n| n.as_str())
+                                            .map(|s| s.to_string());
+
+                                        resources.push(DeploymentResourcePlan {
+                                            kind: kind.to_string(),
+                                            name,
+                                            namespace: ns,
+                                            source_path: entry.path().to_string_lossy().to_string(),
+                                            action: DeploymentPlanAction::WouldApply,
+                                        });
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    let summary = DeploymentPlanSummary {
+        total_resources: resources.len(),
+        would_apply: resources.len(),
+        requires_cluster: false,
+        mutates_cluster: false,
+    };
+
+    Ok(WorkflowDeploymentPlan {
+        environment: environment.to_string(),
+        context: context.to_string(),
+        namespace: namespace.to_string(),
+        mode: DeploymentPlanMode::Static,
+        resources,
+        summary,
+    })
+}

src/workflow/planner.rs

@@ -194,53 +194,55 @@ impl WorkflowPlanner {
 
             last_tasks = vec!["workflow:deployment-plan".to_string()];
 
-            if self.profile.approval == crate::workflow::profile::ApprovalMode::Prompt {
-                effects.prompts_user = true;
-                tasks.push(WorkflowTaskPlan {
-                    id: "workflow:approval".to_string(),
-                    label: "Approval".to_string(),
-                    kind: WorkflowTaskKind::Approval,
-                    dependencies: last_tasks.clone(),
-                    effects: WorkflowEffects {
-                        prompts_user: true,
-                        ..Default::default()
-                    },
-                    description: "Ask for local confirmation before applying deployment changes."
-                        .to_string(),
-                });
-
-                for t in &last_tasks {
-                    edges.push(WorkflowEdge {
-                        from: t.clone(),
-                        to: "workflow:approval".to_string(),
+            if self.profile.deploy == crate::workflow::profile::WorkflowStepMode::Run {
+                if self.profile.approval == crate::workflow::profile::ApprovalMode::Prompt {
+                    effects.prompts_user = true;
+                    tasks.push(WorkflowTaskPlan {
+                        id: "workflow:approval".to_string(),
+                        label: "Approval".to_string(),
+                        kind: WorkflowTaskKind::Approval,
+                        dependencies: last_tasks.clone(),
+                        effects: WorkflowEffects {
+                            prompts_user: true,
+                            ..Default::default()
+                        },
+                        description:
+                            "Ask for local confirmation before applying deployment changes."
+                                .to_string(),
                     });
-                }
 
-                last_tasks = vec!["workflow:approval".to_string()];
-            }
+                    for t in &last_tasks {
+                        edges.push(WorkflowEdge {
+                            from: t.clone(),
+                            to: "workflow:approval".to_string(),
+                        });
+                    }
 
-            if self.profile.deploy == crate::workflow::profile::WorkflowStepMode::Run
-                && self.profile.apply
-            {
-                effects.mutates_cluster = true;
-                tasks.push(WorkflowTaskPlan {
-                    id: "workflow:deploy".to_string(),
-                    label: "Deploy".to_string(),
-                    kind: WorkflowTaskKind::Deploy,
-                    dependencies: last_tasks.clone(),
-                    effects: WorkflowEffects {
-                        mutates_cluster: true,
-                        ..Default::default()
-                    },
-                    description: "Apply generated manifests to the configured Kubernetes context."
-                        .to_string(),
-                });
+                    last_tasks = vec!["workflow:approval".to_string()];
+                }
 
-                for t in &last_tasks {
-                    edges.push(WorkflowEdge {
-                        from: t.clone(),
-                        to: "workflow:deploy".to_string(),
+                if self.profile.apply {
+                    effects.mutates_cluster = true;
+                    tasks.push(WorkflowTaskPlan {
+                        id: "workflow:deploy".to_string(),
+                        label: "Deploy".to_string(),
+                        kind: WorkflowTaskKind::Deploy,
+                        dependencies: last_tasks.clone(),
+                        effects: WorkflowEffects {
+                            mutates_cluster: true,
+                            ..Default::default()
+                        },
+                        description:
+                            "Apply generated manifests to the configured Kubernetes context."
+                                .to_string(),
                     });
+
+                    for t in &last_tasks {
+                        edges.push(WorkflowEdge {
+                            from: t.clone(),
+                            to: "workflow:deploy".to_string(),
+                        });
+                    }
                 }
             }
         }
@@ -368,24 +370,48 @@ impl WorkflowPlanner {
                 .clone()
                 .unwrap_or_else(|| "default".to_string());
 
+            let is_static_plan =
+                self.profile.deploy == crate::workflow::profile::WorkflowStepMode::Plan;
+
             task = task.exec_fn(move |_ctx| {
                 let env_name = env_name.clone();
                 let context = context.clone();
                 let namespace = namespace.clone();
                 async move {
                     crate::LOGGER.info("Deployment plan:");
-                    let plan =
-                        crate::plan::generate_deployment_plan(&env_name, &context, &namespace)
-                            .await
-                            .map_err(|e| anyhow::anyhow!("Deployment plan failed: {}", e))?;
-
-                    crate::plan::validate_plan_safety(&plan)
-                        .map_err(|e| anyhow::anyhow!("Deployment plan validation failed: {}", e))?;
-
-                    // Display is a method on DeploymentPlan
-                    // Wait, let's look at src/plan.rs to see how to print the plan.
-                    // Actually, the spec says `plan.display()`, maybe that exists.
-                    // Let's assume there is a way to display.
+
+                    if is_static_plan {
+                        let plan = crate::workflow::plan::generate_static_deployment_plan(
+                            &env_name, &context, &namespace,
+                        )
+                        .map_err(|e| anyhow::anyhow!("Static deployment plan failed: {}", e))?;
+
+                        println!("Sailr deployment plan:");
+                        println!("  environment: {}", plan.environment);
+                        println!("  context: {}", plan.context);
+                        println!("  namespace: {}", plan.namespace);
+                        println!("  mode: static");
+                        println!("  requires cluster: no");
+                        println!("  mutates cluster: no\n");
+                        println!("Resources:");
+                        for res in plan.resources {
+                            println!("  - {} {} \twould apply", res.kind, res.name);
+                        }
+                    } else {
+                        let plan =
+                            crate::plan::generate_deployment_plan(&env_name, &context, &namespace)
+                                .await
+                                .map_err(|e| anyhow::anyhow!("Deployment plan failed: {}", e))?;
+
+                        crate::plan::validate_plan_safety(&plan).map_err(|e| {
+                            anyhow::anyhow!("Deployment plan validation failed: {}", e)
+                        })?;
+
+                        // Display is a method on DeploymentPlan
+                        // Wait, let's look at src/plan.rs to see how to print the plan.
+                        // Actually, the spec says `plan.display()`, maybe that exists.
+                        // Let's assume there is a way to display.
+                    }
 
                     Ok(())
                 }

src/workflow/profile.rs

@@ -165,7 +165,7 @@ impl WorkflowProfile {
                 apply = false;
             }
             WorkflowMode::Go | WorkflowMode::Deploy => {
-                if approval == ApprovalMode::None {
+                if approval == ApprovalMode::None && deploy == WorkflowStepMode::Run {
                     approval = if runner_is_ci {
                         ApprovalMode::External
                     } else {
@@ -761,4 +761,20 @@ mod tests {
         assert_eq!(normalized.deploy_context.as_deref(), Some("minikube"));
         assert_eq!(normalized.namespace.as_deref(), Some("default"));
     }
+    #[test]
+    fn normalize_ci_deploy_plan_profile() {
+        let toml_str = r#"
+            environment = "local"
+            mode = "deploy"
+            interactive = false
+            deploy = "plan"
+            deploy_context = "none"
+            apply = false
+        "#;
+        let profile: WorkflowProfile = toml::from_str(toml_str).unwrap();
+        let normalized = profile.normalize(true);
+        assert_eq!(normalized.deploy, WorkflowStepMode::Plan);
+        assert_eq!(normalized.deploy_context.as_deref(), Some("none"));
+        assert!(!normalized.apply);
+    }
 }