nordisk/holger

build-space/examples/press_build_thing.rs

//! # The worked example: holger presses nornir's build-thing
//!
//! Run it:
//!
//! ```sh
//! cargo run -p holger-build-space --example press_build_thing
//! ```
//!
//! This is the canonical *"a consumer presses the build-thing button"* demo
//! (task #36). holger is the first real consumer of `nornir-build-thing`: it
//! declares its build-space in Rust (`holger-recipe`, emitted to
//! `.nornir/build-variants.toml`) and here drives build-thing end to end **without**
//! nornir's iceberg / arrow / eframe stack.
//!
//! Two halves:
//!
//! 1. **Describe** — reflect holger's [`BuildSurface`]: the one product list (the
//!    four products and the estate's builds), each row projected to its materialized
//!    `cargo` command, up-front validity, and the `nornir build --variant <row>`
//!    action a Build button invokes.
//! 2. **Press** — pick the `holger` row and capture a content-addressed
//!    build-provenance [`Attestation`] for it (against a throw-away temp "repo"
//!    holding a fake produced artifact, so the demo stays light — no multi-minute
//!    release build), persist it to a dep-light `JsonFileSink` ledger, reload it,
//!    and prove the digest still verifies.
//!
//! The heavy, real end-to-end press is [`nornir_build_thing::build_variant`]
//! (spawn `cargo build --message-format=json`, hash the produced executables,
//! attest in one shot) — what `nornir build --variant holger --attest` runs. This
//! example uses the dep-light describe/attest seam so it is runnable anywhere.

use std::path::PathBuf;

use anyhow::Result;
use nornir_build_thing::{BuildProvenance, BuildProvenanceSink, JsonFileSink, Outcome};

fn main() -> Result<()> {
    // ── 1. DESCRIBE: reflect holger's build-space as a UI/CLI surface ────────
    let surface = holger_build_space::build_surface()?;
    println!(
        "holger presses nornir-build-thing — repo '{}'",
        surface.repo
    );
    println!("offers: {}", surface.offers.join(", "));
    println!("\n{:<9}  {:<7}  cargo command", "row", "valid");
    println!("{}", "-".repeat(72));
    for v in &surface.variants {
        println!(
            "{:<9}  {:<7}  {}",
            v.name,
            if v.valid { "ok" } else { "INVALID" },
            v.command_line
        );
    }
    println!("\nbuild actions (what a 'Build' button invokes):");
    for v in &surface.variants {
        println!("  {}", v.build_action.cli);
    }

    // ── 2. PRESS: attest the `holger` row's produced artifact ────────────────
    // A throw-away repo holding a fake produced binary, so we can content-hash a
    // real file without a heavy release build. The real press is
    // `nornir_build_thing::build_variant(&set, "holger", repo_root)`.
    let repo = tempfile::tempdir()?;
    let out = repo.path().join("target/release");
    std::fs::create_dir_all(&out)?;
    let artifact = out.join("holger");
    std::fs::write(&artifact, b"ELF holger (the server) - demo artifact bytes")?;

    let attestation = holger_build_space::press_tier(
        "holger",
        repo.path(),
        Outcome::Success,
        &[PathBuf::from(&artifact)],
    )?;

    let rec = &attestation.record;
    println!("\npressed 'holger' → build-provenance attestation");
    println!("  schema      : {}", rec.schema);
    println!("  variant     : {}", rec.variant.command_line());
    println!("  toolchain   : {}", rec.toolchain.rustc);
    println!(
        "  host        : {} cores, {} MiB",
        rec.host.cores,
        rec.host.memory_bytes / (1024 * 1024)
    );
    println!(
        "  vcs rev     : {} (dirty: {})",
        rec.inputs.vcs_rev, rec.inputs.vcs_dirty
    );
    for a in &rec.artifacts {
        println!(
            "  artifact    : {} ({} bytes) sha256:{}",
            a.path, a.bytes, a.sha256
        );
    }
    println!("  digest      : {}", attestation.digest_hex());
    println!(
        "  sealed      : {} (real seal = znippy detached-CMS, nornir's build-provenance feature)",
        attestation.is_sealed()
    );
    assert!(
        attestation.digest_matches_record()?,
        "digest verifies against the record"
    );

    // ── 3. LEDGER: persist + reload the record, proving it round-trips ───────
    let ledger_dir = repo.path().join("provenance");
    let sink = JsonFileSink::new(&ledger_dir);
    sink.record(rec)?;
    let line = std::fs::read_to_string(sink.path())?;
    let reloaded = BuildProvenance::from_json(line.trim())?;
    assert_eq!(
        &reloaded, rec,
        "the ledgered record round-trips byte-for-byte"
    );
    println!("\nledger      : {}", sink.path().display());
    println!(
        "reloaded    : record round-trips (repo '{}', row '{}') ✓",
        reloaded.repo, reloaded.variant.name
    );

    println!("\nOK — holger described its build-space and pressed the 'holger' row's provenance.");
    Ok(())
}