feat: port utils actions (extract-traefik-certs, generate-happ-subscriptions, lint-docker-compose)

actions/utils/lint-docker-compose.py

@@ -0,0 +1,62 @@
+# actions/utils/lint-docker-compose.py
+"""Port of utils/lint-docker-compose (dclint via docker) + stdlib anchor-IP validation:
+every ipv4_address in compositions/*/docker-compose.yml must be unique and inside the
+node's /24 (SP3 §6.2). No new deps — ipaddress + re are stdlib."""
+import ipaddress, os, re, shutil
+from engine.descriptor import Meta, Flag
+
+METADATA = Meta(summary="Lint docker-compose files (dclint via docker); validate anchor IPs in the node /24.",
+                args=[Flag("--hook", "Only process staged compose files (pre-commit).")])
+
+def run(ctx, args):
+    log, s = ctx.log, ctx.sys
+    repo = ctx.paths.repo_root
+    rc_ip = _validate_anchor_ips(ctx)
+    if not shutil.which("docker"):
+        log.error("docker is not installed or not in PATH."); return rc_ip or 1
+
+    files_string, targets = "", ["."]
+    if args.hook:
+        cp = s.run(["git", "-C", repo, "diff", "--cached", "--name-only", "--diff-filter=ACM",
+                    "--", "*docker-compose.yml", "*docker-compose.yaml",
+                    "docker-compose*.yml", "docker-compose*.yaml"], check=False, capture=True)
+        files_string = (cp.stdout or "").strip()
+        if not files_string:
+            log.info("No staged docker-compose files to lint."); return rc_ip
+        targets = [f"/workdir/{f}" for f in files_string.splitlines()]
+
+    log.info("Running dclint --fix (via docker)...")
+    r = s.run(["docker", "run", "--rm", "-v", f"{repo}:/workdir", "-w", "/workdir", "node:lts-alpine",
+               "npx", "--yes", "dclint", "-e", "@tier1", "-e", "@tier2", "-e", "@tier3", "-e", ".env",
+               "-r", "--fix", *targets], check=False)
+    if r.returncode != 0:
+        log.error(f"dclint issues (exit {r.returncode})."); return r.returncode or rc_ip
+    if args.hook and files_string:
+        for f in files_string.splitlines():
+            s.run(["git", "-C", repo, "add", f], check=False)
+    log.success("Lint completed.")
+    return rc_ip
+
+def _validate_anchor_ips(ctx) -> int:
+    comp = ctx.paths.compositions
+    if not os.path.isdir(comp):
+        return 0
+    try:
+        subnet = ipaddress.ip_network(ctx.node.subnet) if ctx.node else None
+    except Exception:
+        subnet = None
+    seen, rc = {}, 0
+    for proj in sorted(os.listdir(comp)):
+        f = os.path.join(comp, proj, "docker-compose.yml")
+        if not os.path.isfile(f):
+            continue
+        for m in re.finditer(r"ipv4_address:\s*([0-9.]+)", open(f).read()):
+            ip = m.group(1)
+            if ip in seen:
+                ctx.log.error(f"Duplicate anchor IP {ip} in {proj} and {seen[ip]}"); rc = 1
+            seen[ip] = proj
+            if subnet is not None and ipaddress.ip_address(ip) not in subnet:
+                ctx.log.error(f"Anchor IP {ip} ({proj}) not in node subnet {subnet}"); rc = 1
+    if rc == 0:
+        ctx.log.info("Anchor IP validation passed.")
+    return rc