fix: adaptive E2E hardening - stub retry w/ port alignment, HCL guard, php composer sanitize, case-sensitive COPY check, clone timeouts, partial-apply cleanup

Author: Oussama928

src/agents/agentInfraCost/core/deploy_templates.py

@@ -13,9 +13,10 @@
 
 # Each entry: (base_image, build_steps, expose_port, health_path, start_cmd)
 _TEMPLATES: dict[tuple[str, str], dict] = {
-    # --- Java / Spring Boot ---
+    # --- Java / Spring Boot (Maven) ---
     ("java", "spring"): {
         "base_image": "eclipse-temurin:17-jre",
+        "build_tool": "maven",
         "build": (
             "FROM maven:3.9-eclipse-temurin-17 AS builder\n"
             "WORKDIR /app\n"
@@ -33,6 +34,27 @@
         ),
         "health_path": "/actuator/health",
     },
+    # --- Java / Spring Boot (Gradle) ---
+    ("java", "gradle_spring"): {
+        "base_image": "eclipse-temurin:17-jre",
+        "build_tool": "gradle",
+        "build": (
+            "FROM gradle:8.5-jdk17 AS builder\n"
+            "WORKDIR /app\n"
+            "{copy_deps}\n"
+            "{copy_src}\n"
+            "RUN gradle bootJar --no-daemon -x test\n"
+        ),
+        "runtime": (
+            "FROM eclipse-temurin:17-jre\n"
+            "WORKDIR /app\n"
+            "COPY --from=builder /app/build/libs/*.jar app.jar\n"
+            "EXPOSE 8080\n"
+            'HEALTHCHECK --interval=30s --timeout=5s CMD curl -f http://localhost:8080/ || exit 1\n'
+            'CMD ["java", "-jar", "app.jar"]\n'
+        ),
+        "health_path": "/actuator/health",
+    },
     # --- Python / Flask ---
     ("python", "flask"): {
         "base_image": "python:3.12-slim",
@@ -155,7 +177,18 @@ def match_template(
 
     file_set = {f.lower() for f in detected_files}
 
-    # Try exact (lang, framework) match first
+    # Java: detect build tool from presence of pom.xml vs build.gradle
+    if lang == "java" and "spring" in norm_fws:
+        if "pom.xml" in file_set:
+            tmpl = _TEMPLATES.get(("java", "spring"))
+            if tmpl:
+                return _resolve_template(tmpl, lang, "spring", file_set)
+        elif any(f in file_set for f in ("build.gradle", "build.gradle.kts")):
+            tmpl = _TEMPLATES.get(("java", "gradle_spring"))
+            if tmpl:
+                return _resolve_template(tmpl, lang, "gradle_spring", file_set)
+
+    # Try exact (lang, framework) match
     for fw in norm_fws:
         key = (lang, fw)
         tmpl = _TEMPLATES.get(key)

src/agents/agentInfraCost/core/output_builder.py

@@ -82,12 +82,19 @@
 
 # Runnable stub bodies per language: bare FROM+COPY exits immediately (base-image
 # CMD is a no-op), crash-looping the task until every health probe times out.
+# Include health-file shims so the ALB target group probe (/health, /healthz,
+# /actuator/health etc.) succeeds even when the terraform default differs from
+# the stub's "/" root. http.server and http-server serve plain files at those
+# exact paths, so create them at build time.
 _STUB_RUN: Final[dict[str, str]] = {
-    "javascript": 'EXPOSE 3000\nENV PORT=3000\nCMD ["npx", "-y", "http-server", "-p", "3000", "."]',
-    "typescript": 'EXPOSE 3000\nENV PORT=3000\nCMD ["npx", "-y", "http-server", "-p", "3000", "."]',
-    "python": 'EXPOSE 8080\nCMD ["python", "-m", "http.server", "8080", "--bind", "0.0.0.0"]',
-    "ruby": 'EXPOSE 8080\nCMD ["ruby", "-run", "-e", "httpd", ".", "-p", "8080"]',
-    "php": 'EXPOSE 8080\nCMD ["php", "-S", "0.0.0.0:8080", "-t", "."]',
+    "javascript": 'RUN echo ok > health && echo ok > healthz && echo ok > status && mkdir -p api && echo ok > api/health\n'
+                  'EXPOSE 3000\nENV PORT=3000\nCMD ["npx", "-y", "http-server", "-p", "3000", ".", "--cors"]',
+    "typescript": 'RUN echo ok > health && echo ok > healthz && echo ok > status && mkdir -p api && echo ok > api/health\n'
+                  'EXPOSE 3000\nENV PORT=3000\nCMD ["npx", "-y", "http-server", "-p", "3000", ".", "--cors"]',
+    "python": 'RUN echo ok > health && echo ok > healthz && echo ok > status && mkdir -p api && echo ok > api/health\n'
+              'EXPOSE 8080\nCMD ["python", "-m", "http.server", "8080", "--bind", "0.0.0.0"]',
+    "ruby": 'RUN echo ok > health && echo ok > healthz\nEXPOSE 8080\nCMD ["ruby", "-run", "-e", "httpd", ".", "-p", "8080"]',
+    "php": 'RUN echo ok > health && echo ok > healthz\nEXPOSE 8080\nCMD ["php", "-S", "0.0.0.0:8080", "-t", "."]',
 }
 
 
@@ -188,10 +195,36 @@ def resolve_docker_artifacts(
     containers = analysis.stack_detection.containers or [
         analysis.stack_detection.container
     ]
-    # Language-aware base image for repos without a Dockerfile.
     fallback_base = _FALLBACK_BASE_IMAGES.get(
         analysis.stack_detection.primary_language, "python:3.12-slim"
     )
+    # Monorepo packaging artifacts: pnpm and similar tool repos carry internal
+    # Dockerfiles under docker/, __patches__, pnpr/, fixtures/, .github/ etc.
+    # Treating those as separate ECS images creates a multi-image service that
+    # always fails its build (version-mismatch, missing release tarball). Keep
+    # only root-proximate Dockerfiles unless docker-compose explicitly declared
+    # a multi-service primary; otherwise collapse to the primary entrypoint.
+    if len(containers) > 1:
+        shallow = [
+            c for c in containers
+            if c.dockerfile_path and Path(c.dockerfile_path).parts[0].lower() not in (
+                "docker", "__patches__", "fixtures", "pnpr", ".github", "scripts", "tools"
+            ) and c.dockerfile_path.count("/") <= 1
+        ]
+        if shallow:
+            containers = shallow
+        elif not any(c.dockerfile_path == "Dockerfile" for c in containers):
+            logger.info("Monorepo tool images filtered out; collapsing to single stub")
+            containers = []
+    if not containers:
+        # No Dockerfile at all (common for libraries/CLIs): synthesize one so
+        # the pipeline still produces a runnable artifact for health probing.
+        containers = [analysis.stack_detection.container] if analysis.stack_detection.container else []
+        if not containers or not containers[0].dockerfile_content:
+            if containers and containers[0]:
+                containers[0].dockerfile_content = None  # type: ignore
+            else:
+                containers = [type("C", (), {"dockerfile_path": None, "dockerfile_content": None, "base_image": fallback_base})()]  # type: ignore
     images: list[DockerImage] = []
     for index, container in enumerate(containers):
         base_image = container.base_image or fallback_base

src/agents/agentInfraCost/core/pipeline.py

@@ -137,6 +137,33 @@ def _apply_inferred_health_path(
         logger.warning("Health-path inference failed: %s", exc)
 
 
+def _apply_template_health_path(terraform_files: TerraformFiles, analysis: RepoAnalysisInput) -> None:
+    """When a deploy template matched, use its known health path in the ALB
+    target group instead of the generic '/' default. Idempotent, fail-soft."""
+    try:
+        from core.deploy_templates import match_template as _mt
+        tmpl = _mt(
+            analysis.stack_detection.primary_language,
+            analysis.stack_detection.frameworks,
+            analysis.stack_detection.detected_files,
+        )
+        if not tmpl or "health_path" not in tmpl:
+            return
+        hp = tmpl["health_path"]
+        if hp == "/":
+            return  # already the default
+        new_tf, n = re.subn(
+            r'(path\s*=\s*")/(")',
+            rf"\g<1>{hp}\g<2>",
+            terraform_files.main_tf,
+        )
+        if n:
+            terraform_files.main_tf = new_tf
+            logger.info("Template health path %s applied to target group", hp)
+    except Exception as exc:
+        logger.warning("Template health-path application failed: %s", exc)
+
+
 def _apply_inferred_health_port(
     terraform_files: TerraformFiles, primary_dockerfile: str | None
 ) -> None:
@@ -569,6 +596,8 @@ def _expose_port(image) -> int | None:
         terraform_files,
         primary_image.dockerfile if primary_image else None,
     )
+    # Use framework-specific health path from deploy templates when matched
+    _apply_template_health_path(terraform_files, analysis)
 
     # Fix dev-mode CMDs to production equivalents (fail-soft).
     if primary_image and primary_image.dockerfile:

src/agents/agentInfraCost/tests/test_pipeline.py

@@ -344,8 +344,8 @@ def test_health_path_inferred_to_root_when_app_has_no_health_route(
 
     output = run_pipeline(raw)
     main = output.artifacts.terraform.files.main_tf
-    assert 'path                = "/"' in main
-    assert 'path                = "/health"' not in main
+    # FastAPI uses /docs; the template health-path feature applies it instead of "/"
+    assert '"/docs"' in main
 
 
 def test_health_path_kept_when_app_exposes_health_route(

src/agents/codesec/agent.py

@@ -182,11 +182,13 @@ def _clone_repo(self, repo_url: str, job_id: str) -> Path:
         ]
 
         try:
+            # 300s: 60s expired for 66MB repos while docker buildx saturated
+            # the link (pnpm) — clone is I/O-bound, not hung.
             result = subprocess.run(
                 cmd,
                 capture_output=True,
                 text=True,
-                timeout=60,
+                timeout=300,
                 check=False,
             )
             if result.returncode != 0:
@@ -197,7 +199,7 @@ def _clone_repo(self, repo_url: str, job_id: str) -> Path:
                     cmd,
                     capture_output=True,
                     text=True,
-                    timeout=60,
+                    timeout=300,
                     check=False,
                 )
             if result.returncode != 0:
@@ -216,7 +218,7 @@ def _clone_repo(self, repo_url: str, job_id: str) -> Path:
                     fallback_cmd,
                     capture_output=True,
                     text=True,
-                    timeout=120,
+                    timeout=300,
                     check=False,
                 )
                 if result.returncode != 0: