feat: harden BYOC deployment workflows - #418
Conversation
Greptile SummaryThe PR hardens BYOC cleanup and deployment feedback, adds platform package inspection/download commands, expands embedded CLI branding, and exposes failure-domain and nested-virtualization configuration.
Confidence Score: 2/5The PR should not merge until package downloads require integrity verification and GCP nested-virtualization requests are propagated through capacity-group provisioning. The package command can successfully persist unverified bytes, while the newly reachable GCP nested-virtualization path selects a capable machine but drops the opt-in needed to provide the requested capability. Files Needing Attention: crates/alien-cli/src/commands/packages.rs; crates/alien-core/src/instance_catalog.rs; crates/alien-preflights/src/mutations/compute_cluster.rs
|
| Filename | Overview |
|---|---|
| crates/alien-cli/src/commands/packages.rs | Adds the package command suite, but download integrity becomes optional when metadata lacks a checksum and plaintext URLs are accepted. |
| crates/alien-core/src/instance_catalog.rs | Expands nested-virtualization selection to GCP and Azure, exposing a GCP path where the selected capability is not propagated to provisioning. |
| crates/alien-gcp-clients/src/gcp/compute.rs | Adds the correct serialized GCP advanced-machine-features model, but no in-repository production path sets it. |
| crates/alien-deployment/src/manager_api_transport.rs | Makes final deletion reconciliation and lock release idempotent for structured HTTP 404 responses. |
| crates/alien-deploy-cli/src/lib.rs | Applies embedded command and display branding recursively through clap help. |
| packages/core/src/compute-cluster.ts | Validates and serializes per-capacity-group failure-domain spread using the expected nested map shape. |
Flowchart
%%{init: {'theme': 'neutral'}}%%
flowchart LR
CLI["alien packages download"] --> API["Platform package API"]
API --> Metadata["Artifact URL + optional checksum"]
Metadata --> Select["Select requested/native artifact"]
Select --> Fetch["Fetch artifact without API bearer token"]
Fetch --> Verify{"Checksum present?"}
Verify -- Yes --> Hash["Verify SHA-256"]
Verify -- No --> Write["Write unverified bytes"]
Hash -- Match --> Write
Hash -- Mismatch --> Reject["Reject download"]
Prompt To Fix All With AI
### Issue 1
crates/alien-cli/src/commands/packages.rs:243-253
**Unverified artifact downloads succeed**
When package metadata omits `sha256` or `shasum`, the downloader skips integrity verification and writes the response bytes successfully; because artifact discovery also accepts plaintext HTTP URLs, transit-modified content can be saved and reported as downloaded. Require integrity metadata for every artifact or reject downloads that cannot otherwise guarantee authenticity.
**How this was verified:** The download path conditionally hashes only when a checksum is present, while accepted HTTP response bytes are otherwise written directly.
### Issue 2
crates/alien-core/src/instance_catalog.rs:181
**GCP nested-virt flag is dropped**
When a GCP workload requests nested virtualization, this branch selects an `n2-standard-*` machine, but compute-cluster materialization copies only that machine and leaves `nested_virtualization` unset. GCP requires an explicit instance-template opt-in, so the resulting VM cannot provide the requested nested virtualization capability.
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.Reviews (1): Last reviewed commit: "feat: harden BYOC deployment workflows" | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| if let Some(expected) = &artifact.checksum { | ||
| let actual = hex::encode(Sha256::digest(&bytes)); | ||
| if !actual.eq_ignore_ascii_case(expected) { | ||
| return Err(AlienError::new(ErrorData::ConfigurationError { | ||
| message: format!( | ||
| "Checksum mismatch for '{}': expected {}, received {}.", | ||
| artifact.path, expected, actual | ||
| ), | ||
| })); | ||
| } | ||
| } |
There was a problem hiding this comment.
When package metadata omits sha256 or shasum, the downloader skips integrity verification and writes the response bytes successfully; because artifact discovery also accepts plaintext HTTP URLs, transit-modified content can be saved and reported as downloaded. Require integrity metadata for every artifact or reject downloads that cannot otherwise guarantee authenticity.
How this was verified: The download path conditionally hashes only when a checksum is present, while accepted HTTP response bytes are otherwise written directly.
Knowledge Base Used: Developer CLI and Deploy CLI
Prompt To Fix With AI
This is a comment left during a code review.
Path: crates/alien-cli/src/commands/packages.rs
Line: 243-253
Comment:
**Unverified artifact downloads succeed**
When package metadata omits `sha256` or `shasum`, the downloader skips integrity verification and writes the response bytes successfully; because artifact discovery also accepts plaintext HTTP URLs, transit-modified content can be saved and reported as downloaded. Require integrity metadata for every artifact or reject downloads that cannot otherwise guarantee authenticity.
**How this was verified:** The download path conditionally hashes only when a checksum is present, while accepted HTTP response bytes are otherwise written directly.
**Knowledge Base Used:** [Developer CLI and Deploy CLI](https://app.greptile.com/alien/-/custom-context/knowledge-base/alienplatform/alien/-/docs/developer-cli.md)
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.
| || name.starts_with("c8i-flex.") | ||
| || name.starts_with("r8i-flex.") | ||
| } | ||
| Platform::Gcp => self.name.starts_with("n2-standard-"), |
There was a problem hiding this comment.
When a GCP workload requests nested virtualization, this branch selects an n2-standard-* machine, but compute-cluster materialization copies only that machine and leaves nested_virtualization unset. GCP requires an explicit instance-template opt-in, so the resulting VM cannot provide the requested nested virtualization capability.
Knowledge Base Used: Cloud API Clients
Prompt To Fix With AI
This is a comment left during a code review.
Path: crates/alien-core/src/instance_catalog.rs
Line: 181
Comment:
**GCP nested-virt flag is dropped**
When a GCP workload requests nested virtualization, this branch selects an `n2-standard-*` machine, but compute-cluster materialization copies only that machine and leaves `nested_virtualization` unset. GCP requires an explicit instance-template opt-in, so the resulting VM cannot provide the requested nested virtualization capability.
**Knowledge Base Used:** [Cloud API Clients](https://app.greptile.com/alien/-/custom-context/knowledge-base/alienplatform/alien/-/docs/cloud-clients.md)
---
For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.1 participant
Summary
Validation