Add Core Hub staging deployment profile

scripts/check_staging_profile.py

@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+REQUIRED_FILES = [
+    "Dockerfile",
+    "k8s/railiance-staging/00-namespace.yaml",
+    "k8s/railiance-staging/20-runtime.yaml",
+    "k8s/railiance-staging/README.md",
+    "docs/deployment/staging-profile.md",
+]
+RUNTIME_REQUIRED = [
+    "kind: ConfigMap",
+    "core-hub-staging-runtime",
+    "kind: Job",
+    "core-hub-staging-migrate",
+    "command: [\"alembic\", \"upgrade\", \"head\"]",
+    "kind: Deployment",
+    "core-hub-api",
+    "path: /readyz",
+    "path: /healthz",
+    "secretRef:",
+    "core-hub-staging-env",
+]
+DOC_REQUIRED = [
+    "CORE-WP-0005-T02",
+    "make deployed-smoke",
+    "CORE_HUB_DATABASE_URL",
+    "CORE_HUB_API_TOKEN",
+    "CORE_HUB_AUTO_CREATE_TABLES=1",
+    "railiance-apps",
+    "inter-hub-dry-run",
+]
+FORBIDDEN_RUNTIME = [
+    "stringData:",
+    "CORE_HUB_DATABASE_URL:",
+    "CORE_HUB_API_TOKEN:",
+    "postgresql+asyncpg://core_hub:",
+    "Bearer ",
+]
+FORBIDDEN_DOC = [
+    "postgresql+asyncpg://core_hub:core_hub@",
+    "CORE_HUB_API_TOKEN=",
+]
+
+
+def assert_contains(path: Path, needles: list[str]) -> list[str]:
+    text = path.read_text(encoding="utf-8")
+    return [needle for needle in needles if needle not in text]
+
+
+def assert_absent(path: Path, needles: list[str]) -> list[str]:
+    text = path.read_text(encoding="utf-8")
+    return [needle for needle in needles if needle in text]
+
+
+def main() -> int:
+    failures: list[str] = []
+    for relative in REQUIRED_FILES:
+        if not (ROOT / relative).exists():
+            failures.append(f"missing required file: {relative}")
+
+    runtime = ROOT / "k8s/railiance-staging/20-runtime.yaml"
+    docs = ROOT / "docs/deployment/staging-profile.md"
+    dockerfile = ROOT / "Dockerfile"
+
+    if runtime.exists():
+        for missing in assert_contains(runtime, RUNTIME_REQUIRED):
+            failures.append(f"runtime manifest missing: {missing}")
+        for present in assert_absent(runtime, FORBIDDEN_RUNTIME):
+            failures.append(f"runtime manifest must not contain: {present}")
+
+    if docs.exists():
+        for missing in assert_contains(docs, DOC_REQUIRED):
+            failures.append(f"staging profile docs missing: {missing}")
+        for present in assert_absent(docs, FORBIDDEN_DOC):
+            failures.append(f"staging profile docs must not contain: {present}")
+
+    if dockerfile.exists():
+        docker_text = dockerfile.read_text(encoding="utf-8")
+        for needle in ["uv sync --no-dev --frozen", "EXPOSE 8010", "CORE_HUB_AUTO_CREATE_TABLES"]:
+            if needle not in docker_text:
+                failures.append(f"Dockerfile missing: {needle}")
+
+    if failures:
+        for failure in failures:
+            print(f"FAIL: {failure}")
+        return 1
+    print("staging profile check passed")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())