R-1303: watch — abandoned templates are GAP, a seed's unread pins stay pending (no storm after a seed); 38 checks

scripts/security_watch_inventory.py

@@ -135,8 +135,10 @@ def catalog_items(root):
         compose = os.path.join(tdir, app, "docker-compose.yml")
         if not os.path.isfile(compose):
             continue
-        ups = felhom_upstream_block(_read(os.path.join(tdir, app, ".felhom.yml"))) \
-            if os.path.isfile(os.path.join(tdir, app, ".felhom.yml")) else {}
+        meta = _read(os.path.join(tdir, app, ".felhom.yml")) if os.path.isfile(os.path.join(tdir, app, ".felhom.yml")) else ""
+        ups = felhom_upstream_block(meta)
+        # `lifecycle: abandoned` — still running on boxes that had it, never updated again (plant-it): listed, not looked up.
+        abandoned = bool(re.search(r"^lifecycle:\s*[\"']?abandoned", meta, re.M))
         seen = set()
         for line in _read(compose).splitlines():
             m = IMAGE_RX.match(line)
@@ -146,7 +148,7 @@ def catalog_items(root):
             if (image, tag) in seen:
                 continue
             seen.add((image, tag))
-            items.append({"group": "app", "owner": app, "image": image, "tag": tag,
+            items.append({"group": "app", "owner": app, "image": image, "tag": tag, "abandoned": abandoned,
                           "where": "templates/%s/.felhom.yml upstream: %s" % (app, image),
                           "sources_text": ups.get(image)})
     return items