tonin 0.12.0

Opinionated Rust microservice framework. Kubernetes-native, mesh-secured, MCP-by-default.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150

use std::path::PathBuf;

use anyhow::Result;
use clap::Args;
use tonin_plugin::lock::{EnvLock, GitLockStore, LockStore, ServiceLock};

#[derive(Args)]
pub struct ReleaseArgs {
    /// Service name (e.g. "users-service").
    #[arg(long)]
    pub service: String,

    /// New version string (e.g. "1.4.0").
    #[arg(long)]
    pub version: String,

    /// Image reference with digest (e.g. "ghcr.io/org/svc@sha256:...").
    /// Mutable tags (without @sha256:) are rejected.
    #[arg(long, required_unless_present = "digest")]
    pub image: Option<String>,

    /// Git SHA of the commit that produced this release.
    #[arg(long)]
    pub git_sha: Option<String>,

    /// Image digest (e.g. "sha256:...").
    #[arg(long, required_unless_present = "image")]
    pub digest: Option<String>,

    /// Environment lock to update (default: staging).
    #[arg(long, default_value = "staging")]
    pub env: String,

    /// Workspace root containing environments/.
    #[arg(long)]
    pub workspace: Option<PathBuf>,
}

pub fn run(args: ReleaseArgs) -> Result<()> {
    let digest_val = args.digest.as_deref().unwrap_or("");
    let full_digest = if digest_val.is_empty() {
        "".to_string()
    } else if digest_val.starts_with("sha256:") {
        digest_val.to_string()
    } else {
        format!("sha256:{}", digest_val)
    };

    let image_ref = match &args.image {
        Some(img) => {
            anyhow::ensure!(
                img.contains("@sha256:"),
                "image must be pinned by digest (contain '@sha256:'), got: {}",
                img
            );
            img.clone()
        }
        None => {
            anyhow::ensure!(
                !full_digest.is_empty(),
                "either --image or --digest must be provided"
            );
            format!("ghcr.io/agnitiv/{}@{}", args.service, full_digest)
        }
    };

    let git_sha_ref = args.git_sha.clone().unwrap_or_else(|| "HEAD".to_string());

    let root = args
        .workspace
        .unwrap_or_else(|| std::env::current_dir().unwrap());
    let store = GitLockStore::new(&root);

    let mut lock = store.read(&args.env).unwrap_or_else(|_| EnvLock {
        schema: "v1".into(),
        env: args.env.clone(),
        services: Default::default(),
    });

    let prev = lock.services.get(&args.service).map(|s| s.version.clone());
    lock.services.insert(
        args.service.clone(),
        ServiceLock {
            version: args.version.clone(),
            image: image_ref,
            git_sha: git_sha_ref,
        },
    );
    store.write(&lock)?;

    match prev {
        Some(v) => println!(
            "✓ environments/{}/lock.toml: {} {} → {}",
            args.env, args.service, v, args.version
        ),
        None => println!(
            "✓ environments/{}/lock.toml: {} (new) → {}",
            args.env, args.service, args.version
        ),
    }
    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn release_creates_lock_entry_with_digest() {
        let tmp = tempfile::tempdir().unwrap();
        let store = GitLockStore::new(tmp.path());

        run(ReleaseArgs {
            service: "agnitiv-api".into(),
            version: "0.4.0".into(),
            image: None,
            git_sha: None,
            digest: Some("abc123456789".into()),
            env: "staging".into(),
            workspace: Some(tmp.path().to_path_buf()),
        })
        .unwrap();

        let lock = store.read("staging").unwrap();
        assert_eq!(lock.services["agnitiv-api"].version, "0.4.0");
        assert_eq!(
            lock.services["agnitiv-api"].image,
            "ghcr.io/agnitiv/agnitiv-api@sha256:abc123456789"
        );
        assert_eq!(lock.services["agnitiv-api"].git_sha, "HEAD");
    }

    #[test]
    fn release_rejects_mutable_tag() {
        let tmp = tempfile::tempdir().unwrap();

        let result = run(ReleaseArgs {
            service: "agnitiv-api".into(),
            version: "0.4.0".into(),
            image: Some("ghcr.io/agnitiv/agnitiv-api:0.4.0".into()),
            git_sha: Some("deadbeef".into()),
            digest: None,
            env: "staging".into(),
            workspace: Some(tmp.path().to_path_buf()),
        });

        assert!(result.is_err());
        assert!(result.unwrap_err().to_string().contains("digest"));
    }
}