awatch-rus/AWatch-rus
1
0
Fork 0
Code Issues Pull Requests Actions 100 Packages Projects Releases Wiki Activity

fix(detmir): stabilize grafana freshness guard

Browse Source
This commit is contained in:
igor04091968
2026-06-03 07:06:39 +03:00
parent dbef90a09e
commit dd3163624b
12 changed files with 275 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
adk-rust/crates/detmir-grafana-check/src/main.rs
+1
View File
@@ -19,6 +19,7 @@ const REQUIRED_MEASUREMENTS: &[&str] = &[
"aw_rdp_worktime_daily",
"aw_rdp_worktime_summary_daily",
"aw_true_active_app_daily",
"aw_worktime_exporter_heartbeat",
];
#[derive(Debug, Parser)]
adk-rust/crates/quality-gate/src/main.rs
+130 -6
View File
@@ -34,12 +34,12 @@ fn run() -> Result<()> {
}
fn quality_gate(root: &Path) -> Result<()> {
println!("[1/5] Bash syntax check");
println!("[1/6] Bash syntax check");
for file in collect_by_extension(root, &["aw-server", "proxmox", "scripts"], "sh")? {
run_status(Command::new("bash").arg("-n").arg(&file), false)?;
}
println!("[2/5] Shellcheck (if available)");
println!("[2/6] Shellcheck (if available)");
if command_exists("shellcheck") {
let mut files = collect_by_extension(root, &["aw-server", "proxmox"], "sh")?;
files.push(root.join("scripts/aw-webui-browser-smoke.sh"));
@@ -53,7 +53,7 @@ fn quality_gate(root: &Path) -> Result<()> {
println!("shellcheck not found, skipping.");
}
println!("[3/5] Node syntax check (if node available)");
println!("[3/6] Node syntax check (if node available)");
if command_exists("node") {
run_status(
Command::new("node")
@@ -66,7 +66,7 @@ fn quality_gate(root: &Path) -> Result<()> {
println!("node not found, skipping.");
}
println!("[4/5] PowerShell parse check (if pwsh available)");
println!("[4/6] PowerShell parse check (if pwsh available)");
if command_exists("pwsh") {
let ps = r#"
$ErrorActionPreference = "Stop"
@@ -107,7 +107,7 @@ foreach ($path in @("windows/ActivityWatch.Windows.Common.psm1", "windows/Activi
println!("pwsh not found, skipping.");
}
println!("[5/5] Ansible syntax check (if ansible-playbook available)");
println!("[5/6] Ansible syntax check (if ansible-playbook available)");
if command_exists("ansible-playbook") {
for playbook in collect_top_level_yml(&root.join("ansible"))? {
run_status(
@@ -124,6 +124,9 @@ foreach ($path in @("windows/ActivityWatch.Windows.Common.psm1", "windows/Activi
println!("ansible-playbook not found, skipping.");
}
println!("[6/6] DetMir Python runtime retirement guard");
python_runtime_guard(root)?;
println!("quality-gate: OK");
Ok(())
}
@@ -200,13 +203,107 @@ fn collect_top_level_yml(dir: &Path) -> Result<Vec<PathBuf>> {
Ok(out)
}
fn python_runtime_guard(root: &Path) -> Result<()> {
let mut violations = Vec::new();
for rel in tracked_files(root)? {
if is_allowed_python_runtime_path(&rel) {
continue;
}
if rel.ends_with(".py") && is_detmir_retired_runtime_path(&rel) {
violations.push(rel);
}
}
if !violations.is_empty() {
violations.sort();
bail!(
"Python runtime regression in Rust-retired DetMir paths:\n{}",
violations.join("\n")
);
}
Ok(())
}
fn tracked_files(root: &Path) -> Result<Vec<String>> {
if command_exists("git") {
let output = Command::new("git")
.arg("ls-files")
.current_dir(root)
.output()
.context("run git ls-files")?;
if output.status.success() {
return Ok(String::from_utf8_lossy(&output.stdout)
.lines()
.map(str::trim)
.filter(|line| !line.is_empty())
.map(ToOwned::to_owned)
.collect());
}
}
let mut out = Vec::new();
collect_tracked_fallback(root, root, &mut out)?;
out.sort();
Ok(out)
}
fn collect_tracked_fallback(root: &Path, path: &Path, out: &mut Vec<String>) -> Result<()> {
for entry in fs::read_dir(path).with_context(|| format!("read dir {}", path.display()))? {
let entry = entry.with_context(|| format!("read dir entry {}", path.display()))?;
let entry_path = entry.path();
let file_type = entry
.file_type()
.with_context(|| format!("read file type {}", entry_path.display()))?;
let name = entry.file_name();
let name = name.to_string_lossy();
if file_type.is_dir() {
if matches!(
name.as_ref(),
".git" | "target" | "node_modules" | ".venv" | ".ops" | ".playwright-cli"
) {
continue;
}
collect_tracked_fallback(root, &entry_path, out)?;
} else if file_type.is_file() {
let rel = entry_path
.strip_prefix(root)
.with_context(|| format!("strip root from {}", entry_path.display()))?
.to_string_lossy()
.replace('\\', "/");
out.push(rel);
}
}
Ok(())
}
fn is_allowed_python_runtime_path(rel: &str) -> bool {
rel.starts_with("aw-server/dlp-content-analysis/")
|| rel.starts_with("clickhouse-1c/ai/")
|| rel.starts_with("clickhouse-1c/etl/")
|| rel == "detmir-mcp/main.py"
|| rel.starts_with("grafana-1c/")
|| rel.starts_with("pfsense/")
|| rel == "proxmox/tsj_guardian_bot.py"
|| rel == "proxmox/test_tsj_guardian_bot.py"
}
fn is_detmir_retired_runtime_path(rel: &str) -> bool {
rel.starts_with("aw-server/")
|| rel.starts_with("proxmox/")
|| rel.starts_with("scripts/")
|| rel.starts_with("ansible/")
}
#[cfg(test)]
mod tests {
use std::fs;
use tempfile::tempdir;
use super::{collect_by_extension, collect_top_level_yml};
use super::{
collect_by_extension, collect_top_level_yml, is_allowed_python_runtime_path,
is_detmir_retired_runtime_path,
};
#[test]
fn collects_recursive_shell_files_sorted() {
@@ -233,4 +330,31 @@ mod tests {
assert_eq!(files.len(), 1);
assert_eq!(files[0].file_name().unwrap(), "a.yml");
}
#[test]
fn allows_agreed_python_runtime_exceptions() {
assert!(is_allowed_python_runtime_path(
"aw-server/dlp-content-analysis/content_analyzer.py"
));
assert!(is_allowed_python_runtime_path(
"proxmox/tsj_guardian_bot.py"
));
assert!(is_allowed_python_runtime_path("clickhouse-1c/etl/load.py"));
assert!(is_allowed_python_runtime_path("detmir-mcp/main.py"));
assert!(is_allowed_python_runtime_path(
"pfsense/pfsense-aw-poller.py"
));
}
#[test]
fn flags_retired_detmir_python_runtime_paths() {
assert!(is_detmir_retired_runtime_path(
"aw-server/dlp-policy-engine/server.py"
));
assert!(is_detmir_retired_runtime_path("scripts/dlp-admin-cli.py"));
assert!(!is_allowed_python_runtime_path(
"aw-server/dlp-policy-engine/server.py"
));
assert!(!is_allowed_python_runtime_path("scripts/dlp-admin-cli.py"));
}
}
adk-rust/crates/worktime-influx-exporter/src/main.rs
+23
View File
@@ -889,6 +889,14 @@ fn run(cli: &Cli) -> Result<RunSummary> {
for day in &config.days {
lines.extend(build_lines_for_day(&client, &config, host, day)?);
}
if let Some(line) = line(
"aw_worktime_exporter_heartbeat",
vec![("host", host.to_string())],
vec![("run", FieldValue::Int(1))],
timestamp_ns(utc_now()),
) {
lines.push(line);
}
}
let written = if cli.dry_run {
0
@@ -981,6 +989,21 @@ mod tests {
assert_eq!(out, "m,host=A\\ B\\,C\\=D text=\"a\\\"b\" 10");
}
#[test]
fn heartbeat_line_uses_current_exporter_timestamp() {
let out = line(
"aw_worktime_exporter_heartbeat",
vec![("host", "SHARKON2025".to_string())],
vec![("run", FieldValue::Int(1))],
42,
)
.unwrap();
assert_eq!(
out,
"aw_worktime_exporter_heartbeat,host=SHARKON2025 run=1i 42"
);
}
#[test]
fn aggregates_daily_and_hourly_active_samples() {
let config = test_config();
ansible/deploy_grafana_check.yml
+47 -1
View File
@@ -12,6 +12,8 @@
grafana_check_user: "{{ detmir_grafana_check_user | default(lookup('env', 'DETMIR_GRAFANA_USER') | default(lookup('env', 'GRAFANA_USER'), true), true) }}"
grafana_check_password: "{{ detmir_grafana_check_password | default(lookup('env', 'DETMIR_GRAFANA_PASSWORD') | default(lookup('env', 'GRAFANA_PASSWORD'), true), true) }}"
grafana_check_dashboard_uid: "{{ detmir_grafana_check_dashboard_uid | default('detmir-aw-main') }}"
grafana_check_dashboard_file_src: "{{ aw_repo_root }}/grafana/detmir-aw-main-dashboard.json"
grafana_check_dashboard_file_dest: /etc/grafana/provisioning/dashboards/aw/detmir-aw-main.json
grafana_check_host: "{{ detmir_grafana_check_host | default('SHARKON2025') }}"
grafana_check_max_freshness_minutes: "{{ detmir_grafana_check_max_freshness_minutes | default(360) }}"
grafana_check_on_calendar: "{{ detmir_grafana_check_on_calendar | default('*:0/15') }}"
@@ -37,6 +39,18 @@
msg: "Missing {{ aw_rust_release_dir }}/detmir-grafana-check. Build with cargo build --release -p detmir-grafana-check."
when: not (grafana_check_binary.stat.exists | default(false))
- name: Check local DetMir Grafana dashboard JSON
ansible.builtin.stat:
path: "{{ grafana_check_dashboard_file_src }}"
delegate_to: localhost
become: false
register: grafana_check_dashboard
- name: Fail when DetMir Grafana dashboard JSON is absent
ansible.builtin.fail:
msg: "Missing {{ grafana_check_dashboard_file_src }}."
when: not (grafana_check_dashboard.stat.exists | default(false))
- name: Copy detmir-grafana-check binary to Proxmox staging
ansible.builtin.copy:
src: "{{ aw_rust_release_dir }}/detmir-grafana-check"
@@ -67,6 +81,38 @@
- /usr/local/bin/detmir-grafana-check
changed_when: true
- name: Copy DetMir Grafana dashboard JSON to Proxmox staging
ansible.builtin.copy:
src: "{{ grafana_check_dashboard_file_src }}"
dest: /tmp/detmir-aw-main-dashboard.json
owner: root
group: root
mode: "0644"
- name: Ensure Grafana provisioning dashboard directory exists in CT
ansible.builtin.command:
argv:
- pct
- exec
- "{{ grafana_check_ct_id }}"
- --
- install
- "-d"
- "-m"
- "0755"
- "{{ grafana_check_dashboard_file_dest | dirname }}"
changed_when: true
- name: Install DetMir Grafana dashboard JSON into CT provisioning
ansible.builtin.command:
argv:
- pct
- push
- "{{ grafana_check_ct_id }}"
- /tmp/detmir-aw-main-dashboard.json
- "{{ grafana_check_dashboard_file_dest }}"
changed_when: true
- name: Create Grafana check runtime in CT
ansible.builtin.command:
argv:
@@ -89,7 +135,7 @@
DETMIR_GRAFANA_USER={{ grafana_check_user }}
DETMIR_GRAFANA_PASSWORD={{ grafana_check_password }}
DETMIR_GRAFANA_DASHBOARD_UID={{ grafana_check_dashboard_uid }}
DETMIR_GRAFANA_DASHBOARD_FILE=/etc/grafana/provisioning/dashboards/aw/detmir-aw-main.json
DETMIR_GRAFANA_DASHBOARD_FILE={{ grafana_check_dashboard_file_dest }}
DETMIR_GRAFANA_HOST={{ grafana_check_host }}
DETMIR_GRAFANA_MAX_FRESHNESS_MINUTES={{ grafana_check_max_freshness_minutes }}
DETMIR_GRAFANA_OUTPUT_JSON=/var/lib/detmir-grafana-check/latest.json
aw-server/hayabusa/aw-hayabusa.sh
+1 -1
View File
@@ -120,7 +120,7 @@ extract_zip_normalized() {
while IFS= read -r entry; do
normalized="${entry//\\//}"
case "${normalized}" in
""|.|/*|*"/../"*|../*|*".."|*"/..")
""|.|/*|*"/../"*|../*|*"..")
fail "unsafe zip entry: ${entry}"
;;
esac
docs/DETMIR_PYTHON_RETIREMENT_RU.md
+11
View File
@@ -27,6 +27,17 @@
## Проверка
Основной guard встроен в `quality-gate`:
```bash
scripts/quality-gate.sh
```
Он проверяет tracked-файлы и блокирует возврат `.py` entrypoints в Rust-retired
runtime paths (`aw-server`, `proxmox`, `scripts`, `ansible`) за исключением
согласованных зон: Telegram bot, OCR/content-analysis, 1C/AI/ETL, MCP,
pfSense/no-touch и Grafana-1C.
```bash
rg -n '\.py\b|python3' ansible aw-server scripts adk-rust \
--glob '!adk-rust/target/**'
grafana/detmir-aw-main-dashboard.json
+1 -1
View File
@@ -45,7 +45,7 @@
"id": 5,
"targets": [
{
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -24h)\n |> filter(fn: (r) => (r._measurement == \"aw_rdp_worktime_hourly\" or r._measurement == \"aw_rdp_worktime_daily\" or r._measurement == \"aw_true_active_app_daily\") and (r._field == \"active_seconds\" or r._field == \"proved_work_seconds\"))\n |> last()\n |> group()\n |> sort(columns: [\"_time\"], desc: true)\n |> limit(n: 1)\n |> map(fn: (r) => ({ r with _value: (float(v: uint(v: now()) - uint(v: r._time)) / 1000000000.0) / 60.0 }))\n |> set(key: \"_field\", value: \"Свежесть\")\n |> keep(columns: [\"_value\", \"_field\"])\n |> yield(name: \"freshness_minutes\")\n",
"query": "from(bucket: \"aw_metrics\")\n |> range(start: -24h)\n |> filter(fn: (r) => r._measurement == \"aw_worktime_exporter_heartbeat\" and r._field == \"run\")\n |> last()\n |> group()\n |> sort(columns: [\"_time\"], desc: true)\n |> limit(n: 1)\n |> map(fn: (r) => ({ r with _value: (float(v: uint(v: now()) - uint(v: r._time)) / 1000000000.0) / 60.0 }))\n |> set(key: \"_field\", value: \"Свежесть\")\n |> keep(columns: [\"_value\", \"_field\"])\n |> yield(name: \"freshness_minutes\")\n",
"refId": "A"
}
],
install-kit-awindows-20260427-211240.tar.gz
BIN
View File
Binary file not shown.
install-kit-awindows-20260427-211240.zip
BIN
View File
Binary file not shown.
install-kit-awindows-20260427-211240/MANIFEST.txt
+1 -1
View File
@@ -35,7 +35,7 @@ aedffecfa24834968742cb2477faef80bf794345275a9679ac12c5a1f609acc2 install-kit-aw
4e5b23300ba5c9878b2c8ce6eea65043b7a4c5cb2d14619243cfca6d202aec9f install-kit-awindows-20260427-211240/scripts/aw-webui-browser-smoke.mjs
62980eeebe01d7da243be8535a48f5d41d4eead83cf94015df807111c3d920ab install-kit-awindows-20260427-211240/scripts/aw-webui-browser-smoke.sh
6770275fac17607770653a522a64cf5ab31a7a11993b68e7e80a2858c3b8930e install-kit-awindows-20260427-211240/scripts/check_install_kit_vs_repo.sh
fe8d2b846a64f1357dda48b4c817c7919a3c7398921ddca2adf9a99711ac2613 install-kit-awindows-20260427-211240/scripts/quality-gate.sh
4e5bc6ce977e9f5b9e87c393061d5ecac0f90d5e1314e3325093692e5d19965e install-kit-awindows-20260427-211240/scripts/quality-gate.sh
db1a9b0ccd21aec78d8e2aa08dfa28368e5ba6209c57361e6824e85c1af9f6ca install-kit-awindows-20260427-211240/scripts/rebuild_install_kit.sh
38ad2e112796c2fa9bdc1cc2403c679bb896f90ae2b51d6ccc9a9ec103b4dea6 install-kit-awindows-20260427-211240/scripts/validate_install_kit.sh
0b49e6db51d5abcecaeee0b85f186efd4f10d3360cf04e8aea2e4c7d4465dbda install-kit-awindows-20260427-211240/scripts/verify_innosetup_installer.sh
install-kit-awindows-20260427-211240/scripts/quality-gate.sh
+30 -5
View File
@@ -23,10 +23,10 @@ for candidate in "${rust_candidates[@]}"; do
fi
done
echo "[1/5] Bash syntax check"
echo "[1/6] Bash syntax check"
find aw-server proxmox scripts -type f -name "*.sh" -print0 | xargs -0 -r -n1 bash -n
echo "[2/5] Shellcheck (if available)"
echo "[2/6] Shellcheck (if available)"
if command -v shellcheck >/dev/null 2>&1; then
{
find aw-server proxmox -type f -name "*.sh"
@@ -36,14 +36,14 @@ else
echo "shellcheck not found, skipping."
fi
echo "[3/5] Node syntax check (if node available)"
echo "[3/6] Node syntax check (if node available)"
if command -v node >/dev/null 2>&1; then
node --check scripts/aw-webui-browser-smoke.mjs >/dev/null
else
echo "node not found, skipping."
fi
echo "[4/5] PowerShell parse check (if pwsh available)"
echo "[4/6] PowerShell parse check (if pwsh available)"
if command -v pwsh >/dev/null 2>&1; then
pwsh -NoLogo -NoProfile -Command '
$ErrorActionPreference = "Stop"
@@ -60,7 +60,7 @@ fi
echo "[5/5] Ansible syntax check (if ansible-playbook available)"
echo "[5/6] Ansible syntax check (if ansible-playbook available)"
if command -v ansible-playbook >/dev/null 2>&1; then
for playbook in ansible/*.yml; do
ansible-playbook --syntax-check "$playbook" -i ansible/inventory.example.ini >/dev/null
@@ -69,4 +69,29 @@ else
echo "ansible-playbook not found, skipping."
fi
echo "[6/6] DetMir Python runtime retirement guard"
if command -v git >/dev/null 2>&1; then
mapfile -t tracked_py < <(git ls-files '*.py')
else
mapfile -t tracked_py < <(find aw-server proxmox scripts ansible -type f -name '*.py' 2>/dev/null)
fi
violations=()
for path in "${tracked_py[@]}"; do
case "$path" in
aw-server/dlp-content-analysis/*|clickhouse-1c/ai/*|clickhouse-1c/etl/*|detmir-mcp/main.py|grafana-1c/*|pfsense/*|proxmox/tsj_guardian_bot.py|proxmox/test_tsj_guardian_bot.py)
continue
;;
esac
case "$path" in
aw-server/*|proxmox/*|scripts/*|ansible/*)
violations+=("$path")
;;
esac
done
if (( ${#violations[@]} > 0 )); then
printf 'Python runtime regression in Rust-retired DetMir paths:\\n' >&2
printf '%s\\n' "${violations[@]}" >&2
exit 1
fi
echo "quality-gate: OK"
scripts/quality-gate.sh
+30 -5
View File
@@ -23,10 +23,10 @@ for candidate in "${rust_candidates[@]}"; do
fi
done
echo "[1/5] Bash syntax check"
echo "[1/6] Bash syntax check"
find aw-server proxmox scripts -type f -name "*.sh" -print0 | xargs -0 -r -n1 bash -n
echo "[2/5] Shellcheck (if available)"
echo "[2/6] Shellcheck (if available)"
if command -v shellcheck >/dev/null 2>&1; then
{
find aw-server proxmox -type f -name "*.sh"
@@ -36,14 +36,14 @@ else
echo "shellcheck not found, skipping."
fi
echo "[3/5] Node syntax check (if node available)"
echo "[3/6] Node syntax check (if node available)"
if command -v node >/dev/null 2>&1; then
node --check scripts/aw-webui-browser-smoke.mjs >/dev/null
else
echo "node not found, skipping."
fi
echo "[4/5] PowerShell parse check (if pwsh available)"
echo "[4/6] PowerShell parse check (if pwsh available)"
if command -v pwsh >/dev/null 2>&1; then
pwsh -NoLogo -NoProfile -Command '
$ErrorActionPreference = "Stop"
@@ -60,7 +60,7 @@ fi
echo "[5/5] Ansible syntax check (if ansible-playbook available)"
echo "[5/6] Ansible syntax check (if ansible-playbook available)"
if command -v ansible-playbook >/dev/null 2>&1; then
for playbook in ansible/*.yml; do
ansible-playbook --syntax-check "$playbook" -i ansible/inventory.example.ini >/dev/null
@@ -69,4 +69,29 @@ else
echo "ansible-playbook not found, skipping."
fi
echo "[6/6] DetMir Python runtime retirement guard"
if command -v git >/dev/null 2>&1; then
mapfile -t tracked_py < <(git ls-files '*.py')
else
mapfile -t tracked_py < <(find aw-server proxmox scripts ansible -type f -name '*.py' 2>/dev/null)
fi
violations=()
for path in "${tracked_py[@]}"; do
case "$path" in
aw-server/dlp-content-analysis/*|clickhouse-1c/ai/*|clickhouse-1c/etl/*|detmir-mcp/main.py|grafana-1c/*|pfsense/*|proxmox/tsj_guardian_bot.py|proxmox/test_tsj_guardian_bot.py)
continue
;;
esac
case "$path" in
aw-server/*|proxmox/*|scripts/*|ansible/*)
violations+=("$path")
;;
esac
done
if (( ${#violations[@]} > 0 )); then
printf 'Python runtime regression in Rust-retired DetMir paths:\\n' >&2
printf '%s\\n' "${violations[@]}" >&2
exit 1
fi
echo "quality-gate: OK"