fix(archreview): CI pipeline + codegen freshness guards (IPC-01/09/19/20, TST-03)

- IPC-01: regenerate the stale client descriptor set and add ClientProtoInputTests (semantic, protoc-free) so a missing contract symbol fails the build. - IPC-20: make publish-client-proto-inputs.ps1 -Check source_code_info-normalized so it is protoc-version tolerant. - IPC-19: document + guard the "Generated/ must be committed for net48" rule (docs/Contracts.md, csproj comment, check-codegen.ps1). - IPC-09: harden the per-client generate-proto scripts (PATH resolution + pinned grpcio/protobuf/java version asserts) so regeneration is reproducible. - TST-03: add .gitea/workflows/ci.yml (portable/java/windows/live jobs) running the build, tests, client checks, and the codegen guards. - Also: check-codegen.ps1 Check 3 guards the CLI-02 vendored Rust protos against drift. archreview: IPC-01/09/19/20 Done, TST-03 In review (pipeline authored + validated, not yet run on a Gitea runner). Verified on macOS: NonWindows build clean, ClientProtoInputTests 5/5, -Check exit 0.
2026-07-09 06:17:56 -04:00
parent 219fa6ddb4
commit d5248f61a2
13 changed files with 645 additions and 47 deletions
@@ -0,0 +1,96 @@
+#!/usr/bin/env pwsh
+# Codegen freshness guard for CI (IPC-01, IPC-19, IPC-20, CLI-02).
+#
+# Three checks, all Linux/macOS-runnable (no Server build, no x86 worker):
+#   1. Published client descriptor set matches the current .proto sources (delegates to
+#      publish-client-proto-inputs.ps1 -Check, which normalizes source_code_info so it is
+#      protoc-version tolerant).
+#   2. The committed C# under Contracts/Generated matches a fresh regeneration. Grpc.Tools is
+#      pinned in the contracts csproj, so a clean checkout regenerates byte-identical output; a
+#      non-empty git diff means a .proto was edited without regenerating and committing Generated/
+#      (which breaks the net48 worker build with CS0246 — see docs/Contracts.md).
+#   3. The Rust crate's vendored protos (clients/rust/protos/*.proto — build inputs that make the
+#      crate buildable outside the repo, CLI-02) are byte-identical to the canonical Contracts
+#      protos. A drift means a .proto was edited without refreshing the vendored copies, which would
+#      publish a stale wire contract to crate consumers while the in-repo build stays correct.
+#
+# The x86 Worker + Worker.Tests are Windows-only and are guarded by the Windows CI job, not here.
+
+[CmdletBinding()]
+param()
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = 'Stop'
+
+$repoRoot = Resolve-Path (Join-Path $PSScriptRoot '..')
+$generatedDir = Join-Path $repoRoot 'src/ZB.MOM.WW.MxGateway.Contracts/Generated'
+$contractsProject = Join-Path $repoRoot 'src/ZB.MOM.WW.MxGateway.Contracts/ZB.MOM.WW.MxGateway.Contracts.csproj'
+$failures = New-Object System.Collections.Generic.List[string]
+
+Write-Host '== Check 1/2: client descriptor set freshness =='
+try {
+    & (Join-Path $PSScriptRoot 'publish-client-proto-inputs.ps1') -Check
+    if ($LASTEXITCODE -ne 0) {
+        $failures.Add('Client descriptor set is stale (publish-client-proto-inputs.ps1 -Check failed).')
+    }
+}
+catch {
+    $failures.Add("Descriptor freshness check failed: $($_.Exception.Message)")
+}
+
+Write-Host ''
+Write-Host '== Check 2/2: Contracts/Generated matches a fresh regeneration =='
+try {
+    # Force a full regeneration: Grpc.Tools skips regen when the committed .cs look up to date, so
+    # remove them first (the documented "del Generated/*.cs to force regen" trick).
+    if (Test-Path $generatedDir) {
+        Get-ChildItem -Path $generatedDir -Filter '*.cs' -Recurse -File | Remove-Item -Force
+    }
+
+    & dotnet build $contractsProject -c Release --nologo | Out-Host
+    if ($LASTEXITCODE -ne 0) {
+        $failures.Add('Contracts project failed to build during codegen check.')
+    }
+
+    $diff = (& git -C $repoRoot status --porcelain -- 'src/ZB.MOM.WW.MxGateway.Contracts/Generated').Trim()
+    if (-not [string]::IsNullOrEmpty($diff)) {
+        Write-Host $diff
+        $failures.Add('Contracts/Generated differs from a fresh regeneration. Run `dotnet build` on the contracts project and commit Generated/ (required for the net48 worker build).')
+    }
+}
+catch {
+    $failures.Add("Generated codegen check failed: $($_.Exception.Message)")
+}
+
+Write-Host ''
+Write-Host '== Check 3/3: Rust vendored protos match canonical Contracts protos =='
+try {
+    $canonicalProtoDir = Join-Path $repoRoot 'src/ZB.MOM.WW.MxGateway.Contracts/Protos'
+    $vendoredProtoDir = Join-Path $repoRoot 'clients/rust/protos'
+    foreach ($vendored in Get-ChildItem -Path $vendoredProtoDir -Filter '*.proto' -File) {
+        $canonical = Join-Path $canonicalProtoDir $vendored.Name
+        if (-not (Test-Path $canonical)) {
+            $failures.Add("Vendored Rust proto has no canonical counterpart: $($vendored.Name).")
+            continue
+        }
+        $vendoredHash = (Get-FileHash -Algorithm SHA256 $vendored.FullName).Hash
+        $canonicalHash = (Get-FileHash -Algorithm SHA256 $canonical).Hash
+        if ($vendoredHash -ne $canonicalHash) {
+            $failures.Add("Rust vendored proto drifted from canonical: clients/rust/protos/$($vendored.Name). Refresh it from src/ZB.MOM.WW.MxGateway.Contracts/Protos/$($vendored.Name).")
+        }
+    }
+}
+catch {
+    $failures.Add("Rust vendored proto check failed: $($_.Exception.Message)")
+}
+
+Write-Host ''
+if ($failures.Count -gt 0) {
+    Write-Host 'Codegen freshness check FAILED:' -ForegroundColor Red
+    foreach ($failure in $failures) {
+        Write-Host "  - $failure" -ForegroundColor Red
+    }
+    exit 1
+}
+
+Write-Host 'Codegen freshness check passed.' -ForegroundColor Green