Class: Ace::Git::Worktree::Molecules::ToolchainTruster

Inherits:
Object
  • Object
show all
Defined in:
lib/ace/git/worktree/molecules/toolchain_truster.rb

Overview

Toolchain truster molecule

Discovers tracked mise configuration files and executes/verifies toolchain trust. Fails closed on required policy when trust fails or cannot be verified.

Instance Method Summary collapse

Constructor Details

#initialize(project_root: Dir.pwd, policy: "required") ⇒ ToolchainTruster

Returns a new instance of ToolchainTruster.



15
16
17
18
 
# File 'lib/ace/git/worktree/molecules/toolchain_truster.rb', line 15

def initialize(project_root: Dir.pwd, policy: "required")
  @project_root = project_root
  @policy = (policy.to_s.strip == "advisory") ? "advisory" : "required"
end

Instance Method Details

#discover_tracked_configs ⇒ Array<String>

Discover tracked mise configuration files in the project

Returns:

  • (Array<String>) —

    List of repository-relative paths to tracked mise configs



23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/ace/git/worktree/molecules/toolchain_truster.rb', line 23

def discover_tracked_configs
  result = Atoms::GitCommand.execute("-C", @project_root, "ls-files")
  return [] unless result[:success]

  tracked_files = result[:output].lines.map(&:strip).reject(&:empty?)
  tracked_files.select do |file|
    basename = File.basename(file)
    basename == ".mise.toml" ||
      basename == "mise.toml" ||
      file == ".mise/config.toml" ||
      file == ".config/mise/config.toml" ||
      basename.end_with?(".mise.toml") ||
      (basename.start_with?(".mise") && basename.end_with?(".toml"))
  end.uniq
end

#verify_and_trust(target_dir = nil) ⇒ Hash

Run toolchain trust verification for tracked configuration files

Parameters:

  • target_dir (String, nil) (defaults to: nil) —

    Target directory (e.g. worktree path) to run trust in

Returns:

  • (Hash) —

    Phase result with :phase, :policy, :tracked_files, :status, :evidence



43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
 
# File 'lib/ace/git/worktree/molecules/toolchain_truster.rb', line 43

def verify_and_trust(target_dir = nil)
  dir = target_dir || @project_root
  tracked = discover_tracked_configs

  if tracked.empty?
    return {
      phase: "toolchain_trust",
      policy: @policy,
      tracked_files: [],
      status: "not_applicable",
      evidence: "No tracked mise configuration files found"
    }
  end

  # Check if mise binary is available
  stdout, stderr, status = Open3.capture3("which", "mise")
  unless status.success?
    failed_status = (@policy == "required") ? "required_failed" : "advisory_failed"
    return {
      phase: "toolchain_trust",
      policy: @policy,
      tracked_files: tracked,
      status: failed_status,
      evidence: "mise CLI is not available in PATH"
    }
  end

  file_evidences = {}
  all_succeeded = true

  tracked.each do |rel_path|
    abs_path = File.expand_path(rel_path, dir)
    target_file = File.exist?(abs_path) ? abs_path : File.expand_path(rel_path, @project_root)

    unless File.exist?(target_file)
      file_evidences[rel_path] = "File missing or deleted"
      all_succeeded = false
      next
    end

    stdout_t, stderr_t, status_t = Open3.capture3("mise", "trust", target_file, chdir: dir)
    if status_t.success?
      file_evidences[rel_path] = "trusted"
    else
      all_succeeded = false
      file_evidences[rel_path] = "mise trust failed: #{stderr_t.strip.empty? ? stdout_t.strip : stderr_t.strip}"
    end
  end

  final_status = if all_succeeded
    "succeeded"
  elsif @policy == "required"
    "required_failed"
  else
    "advisory_failed"
  end

  {
    phase: "toolchain_trust",
    policy: @policy,
    tracked_files: tracked,
    status: final_status,
    evidence: file_evidences
  }
end