mirror of
https://github.com/Vateron-Media/XC_VM.git
synced 2026-10-30 19:03:25 +01:00
obscuremind
39f698d09e
Sourcery read 'no privileged code on an LB' as 'no code that ever runs as root' and flagged the helper's certbot verb. The verify-lb-archive rule is narrower — it bars MAIN-only admin/reseller/install/cluster-API code, not the constrained edge operations an LB legitimately performs (certbot, cache/cleanup crons). Document, at the SENSITIVE allowlist, why bin/install/xcvm-noderoot is intentionally NOT listed: it is the serve-only root trust-boundary helper, its archive copy (under xc_vm-writable /home/xc_vm) is never run as root, and the copy root runs is installed to /usr/local/sbin only on a serve-only node, over SSH from MAIN's trusted copy (provisionNodeRootHelper, gated on $rServeOnly). No behaviour change; the gate already passes.
tools/ — development, CI & panel-test utilities
Support tooling for the XC_VM panel. Nothing here ships to production — these are
CI gates, static-analysis helpers, and manual test/QA utilities written to
exercise the panel. Some are wired into the Makefile / CI; others are run by
hand during testing. Each is listed below with its purpose and how to run it.
CI gates (run by make gates, enforced in CI)
| Tool | Purpose |
|---|---|
ci/check_procedural_use.php |
Every non-namespaced procedural/view file must use-import the migrated XcVm\ classes it references (PHP use is positional — a short name without an import faults at runtime). |
ci/check-vendor-prod-only.sh |
The committed src/vendor/ must be production-only — no dev package is tracked or listed in installed.json (checked against the git index). |
ci/verify-lb-archive.sh |
The load-balancer archive must exclude privileged code (admin/reseller/player UI, user/device domain, install/root cron jobs). |
Static analysis (PHPStan) support
| Tool | Purpose |
|---|---|
phpstan/phpstan-bootstrap.php |
PHPStan bootstrap — defines the global constants (e.g. MAIN_HOME) the code sets at runtime, so constant-dependent analysis stays accurate. A bootstrapFile in build/phpstan.dist.neon. |
phpstan/constants.stub.php |
Auto-generated stub of the ~131 runtime define() constants PHPStan cannot see via static scanning. A bootstrapFile. Do not hand-edit — regenerate it. |
phpstan/gen-constants-stub.php |
Regenerates constants.stub.php by scanning src/ for define()s. Run via make phpstan-stub when runtime constants change. |
Run the analysis with make phpstan (needs dev tools: make dev-tools).
Tests runner
The committed PHPUnit 10.5 runner now lives with the suite at
tests/phpunit.phar: php tests/phpunit.phar -c tests/phpunit.xml.dist.
Panel test / QA utilities (manual)
Written to test the running panel end-to-end; run by hand as needed.
| Tool | Purpose |
|---|---|
test_player_api.sh |
HTTP smoke-test of every PlayerApiController endpoint — checks status, Content-Type and JSON shape. ./tools/test_player_api.sh <base_url> <username> <password>. (Note: the password is passed as an argv arg, so it is visible in ps/shell history — use on a local/trusted shell.) |
stream-check/ |
Dependency-free stream tool (stream_check.py) — checks MPEG-TS /ts and HLS queue integrity (single URL or whole .m3u playlist → JSON) and renders the JSON as SVG charts. Subcommands: check, playlist, graph. See its README.md and docs/*/development/streaming-subsystem.md. |
test-stream-generator/ |
Generates a synthetic moving test pattern (stopwatch + wall-clock, no input file), served as a HTTP "live" stream to paste into the panel as a source — end-to-end pipeline testing, incl. LLOD (src/Cli/Commands/LlodCommand.php). See its README.md. |
test-install/ |
Docker-based end-to-end install test of the built release archive — unpacks XC_VM.zip, runs the installer with scripted answers, and checks the key installed files. See its README.md. Referenced from docs/*/builds/updates_checklist.md. |
Repo maintenance
| Tool | Purpose |
|---|---|
update_top_contributors.py |
Regenerates the contributors table in CONTRIBUTORS.md from the GitHub Contributors + Pulls APIs. Optional GITHUB_TOKEN env var to avoid rate limits. |