Detect and offer to update outdated build.sh/view.sh from bblocks-template

Bake a shallow clone of bblocks-template into the Docker image at build
time so postprocessing can compare a repo's build.sh/view.sh against the
current template without a runtime network fetch. A file is only treated
as a candidate for refresh if its content has never changed since it was
added to the repo's git history (ignoring mode-only commits like chmod);
otherwise it's assumed to be intentionally customized and left alone.
Also offers to fix the executable bit independently when content is
already current, since silently chmod'ing would otherwise show up as a
confusing unprompted diff in git status.

Promote permissions.py's EOF-safe y/n prompt helper to a public
ask_yes_no() so this feature can reuse the same fail-safe behavior when
stdin isn't interactive.

Author: avillar

Dockerfile

@@ -21,10 +21,16 @@ RUN /venv/bin/python -m pip install -r /requirements.txt
 # Apply rdflib fixes
 RUN /venv/bin/python -m pip install git+https://github.com/avillar/rdflib.git@6.x
 
+# Reference copy of bblock-template, used to detect outdated scaffolding scripts
+# (build.sh, view.sh, ...) in the repo being processed
+RUN git clone --depth 1 https://github.com/opengeospatial/bblocks-template.git /opt/bblocks-template && \
+    rm -rf /opt/bblocks-template/.git
+
 ENV PYTHONPATH=/src/
 ENV PYTHONUNBUFFERED=1
 ENV NODE_PATH=/src/node_modules
 ENV BBP_GIT_INFO_FILE=/GIT_INFO
+ENV BBP_TEMPLATE_DIR=/opt/bblocks-template
 
 COPY ogc/ /src/ogc/
 

ogc/bblocks/entrypoint.py

@@ -14,6 +14,7 @@
 from ogc.bblocks.log import setup_logging, log_indent
 
 from ogc.bblocks.postprocess import postprocess
+from ogc.bblocks.template_sync import check_template_files
 from ogc.na import ingest_json, update_vocabs
 
 import jsonschema
@@ -309,6 +310,9 @@
     except Exception as e:
         logger.warning("Could not autodetect base_url / github_base_url: %s", e)
 
+    if git_repo_path:
+        check_template_files(git_repo_path)
+
     steps = args.steps.split(',') if args.steps else None
 
     # 1. Postprocess BBs

ogc/bblocks/permissions.py

@@ -30,7 +30,14 @@ def _save_cache(sandbox_dir: Path, cache: dict) -> None:
         json.dump(cache, f, indent=2)
 
 
-def _ask_yes_no(prompt: str) -> bool:
+_DEFAULT_NO_INPUT_MESSAGE = (
+    "No interactive input available to answer this prompt (stdin is closed) "
+    "- denying by default. Run `docker run -i ...` to answer prompts interactively, "
+    "or pass --skip-permissions true to bypass permission checks entirely."
+)
+
+
+def ask_yes_no(prompt: str, no_input_message: str = _DEFAULT_NO_INPUT_MESSAGE) -> bool:
     """Ask a y/n question.
 
     If stdin has no interactive input to offer (e.g. `docker run` without `-i`),
@@ -41,11 +48,7 @@ def _ask_yes_no(prompt: str) -> bool:
         try:
             answer = input(f"{prompt} [y/N] ").strip().lower()
         except EOFError:
-            logger.warning(
-                "No interactive input available to answer this prompt (stdin is closed) "
-                "- denying by default. Run `docker run -i ...` to answer prompts interactively, "
-                "or pass --skip-permissions true to bypass permission checks entirely."
-            )
+            logger.warning(no_input_message)
             return False
         if answer in ('y', 'yes'):
             return True
@@ -126,7 +129,7 @@ def _check_plugin_permissions(
             if pip_deps:
                 print(f"║ Dependencies: {', '.join(pip_deps)}")
             print()
-            if _ask_yes_no(f"Allow {label.lower()} plugin '{module}' to be installed and run?"):
+            if ask_yes_no(f"Allow {label.lower()} plugin '{module}' to be installed and run?"):
                 cached[module] = version_key
                 allowed.add(module)
                 cache[cache_key] = cached
@@ -169,7 +172,7 @@ def check_permissions(
             for bb_id, bb_name in unapproved_types[t_type]:
                 print(f"║    • {bb_id}  ({bb_name})")
         print("║")
-        if _ask_yes_no("Allow these transforms to run?"):
+        if ask_yes_no("Allow these transforms to run?"):
             for t_type in unapproved_types:
                 cached_types.add(t_type)
             cache['transform-types'] = sorted(cached_types)

ogc/bblocks/template_sync.py

@@ -0,0 +1,106 @@
+from __future__ import annotations
+
+import logging
+import os
+from pathlib import Path
+
+from ogc.bblocks.permissions import ask_yes_no
+
+logger = logging.getLogger(__name__)
+
+_TEMPLATE_DIR_ENV = 'BBP_TEMPLATE_DIR'
+_TRACKED_FILES = ('build.sh', 'view.sh')
+_MAX_COMMITS_SCANNED = 20
+
+
+def _is_executable(path: Path) -> bool:
+    return bool(path.stat().st_mode & 0o111)
+
+
+def _make_executable(path: Path) -> None:
+    path.chmod(path.stat().st_mode | 0o755)
+
+
+def check_template_files(git_repo_path: Path) -> None:
+    """Offer to update scaffolding files (build.sh, view.sh, ...) that are
+    outdated copies of their bblock-template counterparts.
+
+    A file is only treated as a candidate for updating if it has never been
+    modified since it was added to the repo's git history - if it has, we
+    assume it was intentionally customized and leave it alone.
+    """
+    template_dir = os.environ.get(_TEMPLATE_DIR_ENV)
+    if not template_dir:
+        return
+    template_dir = Path(template_dir)
+    if not template_dir.is_dir():
+        return
+
+    try:
+        import git
+        repo = git.Repo(git_repo_path)
+    except Exception as e:
+        logger.debug("Could not open git repo at %s to check template files: %s", git_repo_path, e)
+        return
+
+    for filename in _TRACKED_FILES:
+        target = git_repo_path / filename
+        template = template_dir / filename
+        if not target.is_file() or not template.is_file():
+            continue
+
+        commits = list(repo.iter_commits(paths=filename, max_count=_MAX_COMMITS_SCANNED))
+        if not commits:
+            continue
+
+        # Commits that only touch the file's mode (e.g. `chmod a+x build.sh`)
+        # leave its blob hash unchanged, so they don't count as customization
+        content_hashes = set()
+        for commit in commits:
+            try:
+                content_hashes.add(commit.tree[filename].hexsha)
+            except KeyError:
+                pass
+        if len(content_hashes) != 1:
+            # Content actually changed across commits (or couldn't be read),
+            # so we can't be sure it's still the pristine template version
+            logger.debug(
+                "Skipping template check for %s: its content changed across %d commit(s) "
+                "(expected its content to be unchanged since it was added)", filename, len(commits),
+            )
+            continue
+
+        if target.read_bytes() != template.read_bytes():
+            print()
+            print("╔══ Outdated template file detected")
+            print(f"║ {filename} differs from the latest version in bblocks-template,")
+            print(f"║ and does not appear to have been customized.")
+            print("║")
+            if ask_yes_no(
+                f"Update {filename} to the latest bblocks-template version?",
+                no_input_message=(
+                    f"No interactive input available to ask about updating {filename} "
+                    f"(stdin is closed) - leaving it as-is. It may be outdated; compare "
+                    f"against https://github.com/opengeospatial/bblocks-template/blob/master/{filename}"
+                ),
+            ):
+                target.write_bytes(template.read_bytes())
+                _make_executable(target)
+                print(f"  Updated {filename}.")
+                # The executable bit was implicitly accepted along with the content update
+                continue
+
+        if not _is_executable(target):
+            print()
+            print("╔══ Template file is not executable")
+            print(f"║ {filename} is missing the executable bit.")
+            print("║")
+            if ask_yes_no(
+                f"Make {filename} executable?",
+                no_input_message=(
+                    f"No interactive input available to ask about making {filename} executable "
+                    f"(stdin is closed) - leaving it as-is."
+                ),
+            ):
+                _make_executable(target)
+                print(f"  Made {filename} executable.")