Anchor --reconcile sweep root at the canonical base for nested subdirectories

[ttstarck]

Problem

reconcile_scopes derived each entry's --reconcile sweep root from File.dirname(output_directory), which silently assumes subdirectory: is exactly one level deep. When a definition nests its subdirectory deeper — e.g. subdirectory: "exclude-argocd/auth" — the sweep root descended with it (to .../spp/<name>/exclude-argocd/ instead of .../spp/<name>/). Files rendered under the old shallower layout (.../spp/<name>/auth/…) then sat as siblings of the sweep root, outside every sweep scope, so reconcile never deleted them.

This was observed in a real SPP deploy: the render added .../spp/staging-qa04a/exclude-argocd/auth/… but left the pre-existing .../spp/staging-qa04a/auth/… orphaned.

Fix

1. Anchor base_root at the entry's canonical base, independent of subdirectory: depth:

   • non-SPP → <region>/<cluster_type>/<color>
   • SPP → <region>/<cluster_type>/<color>/spp/SPP-PLACEHOLDER

   The sweep root now stays put when a subdirectory: is renamed or nested deeper, so leftovers at the old path are swept.

2. Enforce render-under-root for non-SPP entries under --reconcile. An entry that renders outside its canonical base (only reachable via the deprecated directory: field) now hard-errors (OutOfScopeError) before any writes. This completes the layout hard-validation deferred in ADR-0001; SPP entries were already constrained to the spp/SPP-PLACEHOLDER prefix.

3. Removed the now-redundant spp_sweep_root helper (canonical base_root always ends in SPP-PLACEHOLDER).

Tests

Written test-first (red → green):

• Two end-to-end reproductions of the reported orphaning (SPP and non-SPP): a stale file at the shallower old-layout path is now swept while the freshly-rendered nested output is kept.
• #reconcile_scopes cases proving base_root stays canonical at any subdirectory depth, including the legacy directory: case.
• Enforcement: a non-SPP entry rendering outside its canonical base hard-errors and deletes nothing.

Full suite: 109 examples, 0 failures.

Notes

• Patch bump 0.6.1 → 0.6.2.
• No behavior change for the standard subdirectory:/base layout at one level (canonical base == old dirname), so existing sweep specs are untouched.
• kube-platform (region-exempt) never renders with --reconcile (separate consumer on gem 0.3.0), so the new non-SPP guard is not collateral.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR fixes --reconcile stale-file cleanup for entries whose subdirectory: nests multiple levels by anchoring sweep roots at the canonical base path (instead of dirname(output_directory)), and adds a hard guard to prevent non-SPP entries from rendering outside their canonical base during reconcile.

Changes:

• Rework ResourceSet#reconcile_scopes to return canonical base_root values (non-SPP: <region>/<type>/<color>, SPP: <region>/<type>/<color>/spp/SPP-PLACEHOLDER) regardless of subdirectory: depth.
• Enforce (under --reconcile) that non-SPP output_directory must fall within its base_root (reject legacy directory: layouts that escape the canonical base).
• Add/adjust end-to-end and unit specs covering deeper nested subdirectories, legacy directory: behavior under reconcile, and the new guard; bump version + changelog.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
spec/kubernetes_template_rendering/template_directory_renderer_spec.rb	Adds end-to-end reproductions for orphaned stale files (SPP + non-SPP) and the new non-SPP out-of-scope hard error under --reconcile.
spec/kubernetes_template_rendering/resource_set_spec.rb	Updates/extends #reconcile_scopes expectations to assert canonical base rooting for nested subdirectories and legacy directory: output.
lib/kubernetes_template_rendering/version.rb	Bumps gem version to 0.6.2.
lib/kubernetes_template_rendering/template_directory_renderer.rb	Adds reconcile-time enforcement that non-SPP outputs must render within canonical base_root; simplifies SPP sweep-root derivation.
lib/kubernetes_template_rendering/resource_set.rb	Changes reconcile scope computation to use canonical base roots rather than dirname(output_directory).
CHANGELOG.md	Documents the reconcile sweep-root fix and the new reconcile-time non-SPP guard.

Comments suppressed due to low confidence (1)

lib/kubernetes_template_rendering/template_directory_renderer.rb:155

• --spp values are interpolated into filesystem paths via gsub without any validation. If a user passes a value containing path separators (e.g. "../"), reconcile could end up sweeping an unintended subtree under rendered_directory (even though it remains in-prefix). Consider rejecting any --spp name that is not a single safe path segment before constructing sweep roots.

      root = scope[:base_root]
      return [root] if @spps.empty?
      return [root] unless root.include?(ResourceSet::SPP_PLACEHOLDER)

      [root] + @spps.map { |spp_name| root.gsub(ResourceSet::SPP_PLACEHOLDER, spp_name) }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.