Nguyen Minh Phuc
4a426dbe50
ci / lint (push) Successful in 25s
ci / unit (push) Successful in 59s
ci / types (push) Successful in 1m8s
ci / dockerfile (push) Successful in 13s
ci / chart (push) Successful in 8s
ci / security (push) Successful in 1m2s
ci / integration (push) Successful in 54s
ci / image (api) (push) Successful in 1m6s
ci / image (reconciler) (push) Successful in 3m6s
ci / image (worker) (push) Successful in 2m28s
ci / bump (push) Has been cancelled
trivy took the worker image 39 -> 18 -> 5 findings across two version bumps, and the last 5 (4x golang.org/x/net, 1x Go stdlib) live in kubectl v1.36.2 — the newest kubectl that exists. No release clears them; upstream has not rebuilt against the patched Go yet. Chasing the version further has no end. kubectl was in that image for exactly one call: ensure_namespace before helm. `helm upgrade --install --create-namespace` does the same thing, idempotently, as part of the install it already runs. So the binary goes, and its vendored CVEs go with it. read_secret had no callers. Tradeoff recorded: the namespace no longer gets an svcforge.io/team label, since --create-namespace makes a bare one. Nothing reads that label today.
34 lines
1.0 KiB
Python
34 lines
1.0 KiB
Python
"""What a worker needs to do its job.
|
|
|
|
One frozen bag of collaborators, constructed once in main() and passed down. Handlers
|
|
take `deps` rather than reaching for globals, which is the entire reason the worker tests
|
|
run in milliseconds against a FakeProvisioner instead of needing a cluster.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass
|
|
|
|
from svcforge_core.adapters.clock import Clock
|
|
from svcforge_core.adapters.helm import Provisioner
|
|
from svcforge_core.adapters.notify import Notifier
|
|
from svcforge_core.domain.models import CatalogEntry
|
|
from svcforge_core.repo.db import DictPool
|
|
from svcforge_core.repo.instances import InstanceRepo
|
|
from svcforge_core.repo.tasks import TaskRepo
|
|
from svcforge_core.settings import Settings
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class WorkerDeps:
|
|
"""Everything a handler is allowed to touch."""
|
|
|
|
pool: DictPool
|
|
instances: InstanceRepo
|
|
tasks: TaskRepo
|
|
provisioner: Provisioner
|
|
notifier: Notifier
|
|
clock: Clock
|
|
catalog: dict[str, CatalogEntry]
|
|
settings: Settings
|