Report the accumulated warnings on stderr when the estate load fails, and fold
the dropped-record tally into the error. Count records rather than warning
messages in --explain, by carrying the count on the Warn hook.
catalog-impact built its PuppetDB client without a Warn hook, so a host whose
fact records all failed to decode vanished from the estate table with no
warning on any output path.
- wire catalog-impact's Warn hook into NodeWarnings
- default an unset Warn to stderr so a dropped record is never silent
- thread stderr through run() instead of writing os.Stderr directly
- count dropped fact records in the explain resolution-incomplete line
A differently quoted substring inside a ${...} interpolation ended the
outer string early and truncated the argument list, dropping every name
after it. One shared walker now backs every source scan.
Lowercase the recovered prefix of an unresolved reference, and every
class name as it is added, so a mixed-case interpolated name still
widens.
Report fact records with no certname instead of dropping them, and
assert stripSource keeps newline positions rather than just length.
- rename internal/pdbmux to internal/puppetdb
- fetch facts with one GET /pdb/query/v4/facts AST query per node
- drop the per-node fallback route and its two response shapes
- rename --pdb to --puppetdb, CATALOG_DIFF_PDB to CATALOG_DIFF_PUPPETDB and
pdb_url to puppetdb_url
- describe the fact source generically in the README and AGENTS.md
The capture carried a production certname, real role and class names and
internal paths into a public repo.
- replace hostnames, class names and paths with fake equivalents
- keep the shape under test: catalog envelope, string version, null
code_id, resources with and without parameters and file/line, the
exported and sensitive_parameters cases
- document the range of --retry and --timeout
Real PuppetDB answers /factsets/<certname> with an array; the fallback
decoded a bare object, so it only worked against pdbmux's own divergent
response.
- decode an array of factsets, picking the requested certname
- keep accepting a single bare factset object
- drop and report a fact record that will not decode instead of failing
the whole fetch
- fail only when nothing in the response decodes
A negative --retry skipped the compile loop, leaving a nil error inside
exitError that panicked when printed.
- reject a negative or oversized --retry and a non-positive --timeout as
usage errors (exit 3)
- print an exit code when exitError carries no inner error
- cap the backoff shift so a large --retry cannot overflow
- cancel the sibling compile on the first failure, and do not report that
cancellation as the cause
- report a context cancellation during the retry backoff instead of the
stale compile error
- walk the classes holding an unresolved reference when tracing any class
it could have named, so a dropped edge cannot lose hosts
- list unresolved references in --explain, in unresolved_references in
--json and on stderr, and flag summary.resolution_incomplete
- name an ordering reference as such in the --explain chain
- strip # comments with quote-state tracking so a hash in a string no
longer truncates the line
- skip heredoc bodies in every @(EOT) form so documentation text is not
indexed as a class reference
- take every literal name out of a selector, following a bare variable
through the assignments in its own file
- record a class reference that stays unresolved against its file, with
any literal prefix, instead of dropping it
- read a class name case insensitively in a title or type reference
- tag each edge as a declaration or an ordering reference
- unwrap the {"catalog": ...} envelope, still accepting a bare catalog
- report an environment-less response as a protocol mismatch, not an ENC problem
- make Resource.Line a pointer and Resource.Params() map absent onto empty
- render a missing manifest location as "(source unknown)"
- retry compile failures caused by the compiler's PuppetDB query
- stop retrying manifest errors the compiler returns as HTTP 500
- add a trimmed real-server response fixture and tests for each shape
A hieradata file for a role with no members produces an empty host list, which
is indistinguishable from a mapping failure.
- list files that mapped cleanly but selected nobody in --explain
A params.pp is only ever reached by inherits and $class::var, so changing one
resolved to no hosts at all.
- index inherits, $class::var reads and create_resources()
- match a defined type declared part-way along a line
Work out which hosts a puppet-prod change can affect, so a catalog test can
fan out over exactly those hosts instead of the whole estate.
- add cmd/catalog-impact and internal/impact
- map hieradata paths onto fact selectors from the hiera hierarchy
- trace manifest classes back to role classes through include, contain,
class {} and hiera_include, to a fixed point
- fetch the estate fact table from pdbmux in one query via FactsByName
- widen to all hosts, loudly, for any path that matches no rule
- ship the binary and its completions in the RPM
Compile a host's catalog in a base and a test environment over the
puppetserver API, then diff the two.
- add catalog-diff CLI with cobra flags, config precedence and exit codes
- add puppetserver mTLS client for POST /puppet/v4/catalog
- add pdbmux fact client
- add catalog normalisation, diff engine and text/JSON renderers
- add Makefile, nfpm RPM packaging and woodpecker pipelines
benvin
unkin-agent
gitadmin