@akash-chowdhury-24/deployhub 2.0.31 → 2.0.33

package/src/utils/docker-port-publish.js

@@ -0,0 +1,328 @@
+import { execa } from 'execa';
+import { getEnvMethod, getEnvSettings } from '../core/environments.js';
+import { resolveDockerContainerName } from './docker-container-name.js';
+import { resolveDockerRemoteMode } from './docker-remote-mode.js';
+import { resolveDockerSshTarget } from './docker-remote.js';
+import { createSshExecSession } from '../deployment/ssh-connection.js';
+import { shellQuote } from './shell-quote.js';
+
+/** Go template: running|bindings. Empty HostIp treated as 0.0.0.0. */
+export const DOCKER_INSPECT_PORT_FORMAT =
+  `{{if .State.Running}}running{{else}}stopped{{end}}|` +
+  `{{range $p, $conf := .NetworkSettings.Ports}}` +
+  `{{range $conf}}` +
+  `{{if eq .HostIp ""}}0.0.0.0{{else}}{{.HostIp}}{{end}}:{{.HostPort}}->` +
+  `{{end}}{{end}}`;
+
+export const DOCKER_PORT_NOT_PUBLISHED_TRAILER =
+  'The app is not reachable from outside the container.';
+
+/**
+ * Exact doctor/verify failure copy when a container is running without `-p`.
+ * @param {string} containerName
+ * @param {number} port
+ */
+export function formatDockerPortNotPublished(containerName, port) {
+  return (
+    `Container '${containerName}' is running but port ${port} is not published ` +
+    `on the host (no 0.0.0.0:${port}-> mapping).\n` +
+    DOCKER_PORT_NOT_PUBLISHED_TRAILER
+  );
+}
+
+/**
+ * @param {string} containerName
+ * @param {number} port
+ */
+export function formatDockerPortPublished(containerName, port) {
+  return `Container '${containerName}' publishes 0.0.0.0:${port}->`;
+}
+
+/**
+ * @param {string} envName
+ */
+export function formatDockerSshPortRequired(envName) {
+  return (
+    `Docker remote.mode "ssh" requires a published port. ` +
+    `Set environments.${envName}.config.port (or top-level port) so the container ` +
+    `is started with -p <port>:<port>. Deploying without -p leaves the app unreachable.`
+  );
+}
+
+/**
+ * @param {unknown} raw
+ * @returns {number|null}
+ */
+function parsePublishPort(raw) {
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 1 || n > 65535) return null;
+  return n;
+}
+
+/**
+ * Top-level `config.port` is the legacy single-env fallback (scenario 2A).
+ * With two or more docker environments it must not be inherited by a later
+ * env that never stored its own `config.port` — that would silently publish
+ * another environment's port.
+ *
+ * @param {import('../core/config.js').DeployHubConfig} [config]
+ * @param {string} [envName]
+ */
+function shouldUseTopLevelDockerPortFallback(config = {}, envName) {
+  const dockerNames = Object.entries(config.environments || {})
+    .filter(([, entry]) => getEnvMethod(entry) === 'docker')
+    .map(([name]) => name);
+
+  if (dockerNames.length <= 1) return true;
+  if (!envName) return false;
+
+  if (config.defaultEnvironment && dockerNames.includes(config.defaultEnvironment)) {
+    return envName === config.defaultEnvironment;
+  }
+  if (
+    config.unprefixedSecretEnvironment &&
+    dockerNames.includes(config.unprefixedSecretEnvironment)
+  ) {
+    return envName === config.unprefixedSecretEnvironment;
+  }
+  return false;
+}
+
+/**
+ * Configured host/container publish port. No silent default — missing means
+ * SSH must fail loudly instead of running unpublished.
+ *
+ * Fallback chain is still `settings.port ?? config.port` (plus `backend.port`)
+ * for legacy single-env configs and the original docker env. It is not used
+ * for additional docker environments that omitted `config.port`.
+ *
+ * @param {import('../core/config.js').DeployHubConfig} [config]
+ * @param {Record<string, unknown>} [settings]
+ * @param {string} [envName]
+ * @returns {number|null}
+ */
+export function resolveDockerPublishPort(config = {}, settings = {}, envName) {
+  const own = parsePublishPort(settings.port);
+  if (own != null) return own;
+  if (!shouldUseTopLevelDockerPortFallback(config, envName)) return null;
+  return parsePublishPort(config.port ?? config.backend?.port);
+}
+
+/**
+ * @param {string} stdout
+ * @param {number} port
+ */
+export function inspectShowsHostPortMapping(stdout, port) {
+  return String(stdout || '').includes(`0.0.0.0:${port}->`);
+}
+
+/**
+ * @param {string} containerName
+ */
+export function buildDockerInspectPortsArgs(containerName) {
+  return ['inspect', '--format', DOCKER_INSPECT_PORT_FORMAT, containerName];
+}
+
+/**
+ * @param {string} containerName
+ */
+export function buildDockerInspectPortsCommand(containerName) {
+  const args = buildDockerInspectPortsArgs(containerName);
+  return `docker inspect --format ${shellQuote(args[2])} ${shellQuote(containerName)}`;
+}
+
+/**
+ * @param {{ code?: number|null, stdout?: string, stderr?: string }} result
+ * @param {{ containerName: string, port: number, requireRunning: boolean }} opts
+ * @returns {{ pass: boolean, reason: 'published'|'not-running'|'unpublished'|'missing-container', message: string }}
+ */
+export function evaluateDockerPortPublish(result, opts) {
+  const { containerName, port, requireRunning } = opts;
+  const code = result.code;
+  const raw = String(result.stdout || '');
+  let running = true;
+  let mappings = raw;
+  const pipe = raw.indexOf('|');
+  if (pipe >= 0 && (raw.startsWith('running|') || raw.startsWith('stopped|'))) {
+    running = raw.startsWith('running|');
+    mappings = raw.slice(pipe + 1);
+  }
+
+  if ((code !== 0 && code !== null && code !== undefined) || !running) {
+    if (!requireRunning) {
+      return {
+        pass: true,
+        reason: 'not-running',
+        message: `No running container '${containerName}' — deploy first, then re-run this check.`,
+      };
+    }
+    if (!running && (code === 0 || code === null || code === undefined)) {
+      return {
+        pass: false,
+        reason: 'missing-container',
+        message:
+          `Container '${containerName}' is not running — cannot confirm port ${port} is published.`,
+      };
+    }
+    return {
+      pass: false,
+      reason: 'missing-container',
+      message:
+        `Container '${containerName}' is not running — cannot confirm port ${port} is published.`,
+    };
+  }
+
+  if (inspectShowsHostPortMapping(mappings, port)) {
+    return {
+      pass: true,
+      reason: 'published',
+      message: formatDockerPortPublished(containerName, port),
+    };
+  }
+
+  return {
+    pass: false,
+    reason: 'unpublished',
+    message: formatDockerPortNotPublished(containerName, port),
+  };
+}
+
+/**
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @param {string[]} envNames
+ */
+export function anyDockerEnvHasPublishPort(config, envNames) {
+  return (envNames || []).some((envName) => {
+    const entry = config.environments?.[envName];
+    if (getEnvMethod(entry) !== 'docker') return false;
+    const settings = getEnvSettings(entry);
+    return resolveDockerPublishPort(config, settings, envName) != null;
+  });
+}
+
+/**
+ * Whether the post-deploy verify stage should run (HTTP health and/or docker port).
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @param {string[]} envNames
+ * @param {(config: import('../core/config.js').DeployHubConfig, envNames: string[]) => boolean} hasHealthUrl
+ */
+export function verifyStageShouldRun(config, envNames, hasHealthUrl) {
+  return Boolean(hasHealthUrl(config, envNames) || anyDockerEnvHasPublishPort(config, envNames));
+}
+
+/**
+ * Inspect one docker environment's running container for 0.0.0.0:<port>->.
+ *
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @param {string} envName
+ * @param {{ requireRunning?: boolean, env?: Record<string, string|undefined> }} [options]
+ */
+export async function checkEnvDockerPortPublish(config, envName, options = {}) {
+  const entry = config.environments?.[envName];
+  const method = getEnvMethod(entry);
+  if (method !== 'docker') {
+    return { skipped: true, envName, pass: true, message: '' };
+  }
+
+  const settings = getEnvSettings(entry);
+  const env = options.env || process.env;
+  const requireRunning = options.requireRunning !== false;
+  const port = resolveDockerPublishPort(config, settings, envName);
+  const remoteMode = resolveDockerRemoteMode(settings, env);
+  const containerName = resolveDockerContainerName(config, envName);
+
+  if (port == null) {
+    if (remoteMode === 'ssh') {
+      return {
+        skipped: false,
+        envName,
+        pass: false,
+        message: formatDockerSshPortRequired(envName),
+      };
+    }
+    return { skipped: true, envName, pass: true, message: '' };
+  }
+
+  /** @type {{ code?: number|null, stdout?: string, stderr?: string }} */
+  let result;
+  if (remoteMode === 'ssh') {
+    const target = resolveDockerSshTarget(settings, env);
+    const session = createSshExecSession({
+      ...target,
+      keyPath: target.keyPath ? String(target.keyPath) : undefined,
+      env,
+    });
+    const ssh = await session.connect();
+    try {
+      result = await session.execUnchecked(ssh, buildDockerInspectPortsCommand(containerName));
+    } finally {
+      ssh.dispose();
+    }
+  } else {
+    try {
+      const inspected = await execa('docker', buildDockerInspectPortsArgs(containerName), {
+        stdio: 'pipe',
+        env: { ...process.env, ...env },
+      });
+      result = { code: 0, stdout: inspected.stdout, stderr: inspected.stderr };
+    } catch (err) {
+      const execErr = /** @type {{ exitCode?: number, stdout?: string, stderr?: string }} */ (err);
+      result = {
+        code: execErr.exitCode ?? 1,
+        stdout: execErr.stdout || '',
+        stderr: execErr.stderr || (err instanceof Error ? err.message : String(err)),
+      };
+    }
+  }
+
+  const verdict = evaluateDockerPortPublish(result, {
+    containerName,
+    port,
+    requireRunning,
+  });
+  return {
+    skipped: false,
+    envName,
+    pass: verdict.pass,
+    message: verdict.message,
+    reason: verdict.reason,
+  };
+}
+
+/**
+ * @param {import('../core/config.js').DeployHubConfig} config
+ * @param {string[]} envNames
+ * @param {{ requireRunning?: boolean, env?: Record<string, string|undefined> }} [options]
+ */
+export async function runDockerPortPublishChecksForEnvs(config, envNames, options = {}) {
+  /** @type {{ envName: string, message: string }[]} */
+  const results = [];
+  /** @type {{ envName: string, error: string }[]} */
+  const failures = [];
+
+  for (const envName of envNames || []) {
+    const outcome = await checkEnvDockerPortPublish(config, envName, options);
+    if (outcome.skipped) continue;
+    if (outcome.pass) {
+      results.push({ envName: outcome.envName, message: outcome.message });
+    } else {
+      failures.push({ envName: outcome.envName, error: outcome.message });
+    }
+  }
+
+  return { results, failures };
+}
+
+export default {
+  DOCKER_INSPECT_PORT_FORMAT,
+  formatDockerPortNotPublished,
+  formatDockerPortPublished,
+  formatDockerSshPortRequired,
+  resolveDockerPublishPort,
+  inspectShowsHostPortMapping,
+  evaluateDockerPortPublish,
+  anyDockerEnvHasPublishPort,
+  verifyStageShouldRun,
+  checkEnvDockerPortPublish,
+  runDockerPortPublishChecksForEnvs,
+};

package/src/utils/docker-remote-mode.js

@@ -0,0 +1,33 @@
+/**
+ * Docker remote-host mode only — no node-ssh import.
+ * Keep this module free of connection code so deployment-env.js can classify
+ * env defs without loading NodeSSH (which would break jest node-ssh mocks).
+ *
+ * Kubernetes must not honor this: a Kubernetes deploy talks to the cluster via
+ * kubectl, not a remote Docker daemon.
+ */
+
+/** @typedef {'ssh'|'local'|'raw'} DockerRemoteMode */
+
+/**
+ * @param {Record<string, unknown>} [settings]
+ * @param {Record<string, string|undefined>} [env]
+ * @returns {DockerRemoteMode}
+ */
+export function resolveDockerRemoteMode(settings = {}, env = process.env) {
+  const remote = settings.remote;
+  const explicit =
+    remote && typeof remote === 'object'
+      ? /** @type {Record<string, unknown>} */ (remote).mode
+      : undefined;
+  if (explicit === 'ssh' || explicit === 'local' || explicit === 'raw') {
+    return explicit;
+  }
+  // Existing configs with a bare DOCKER_HOST keep the unmanaged CLI transport.
+  if (settings.dockerHost || env.DOCKER_HOST) {
+    return 'raw';
+  }
+  return 'local';
+}
+
+export default { resolveDockerRemoteMode };

package/src/utils/docker-remote.js

@@ -0,0 +1,218 @@
+/**
+ * Docker remote-host mode: local daemon, first-class SSH (node-ssh), or raw
+ * DOCKER_HOST (Docker CLI ssh:// / tcp:// transport).
+ *
+ * Kubernetes must not import or honor this module — a Kubernetes deploy talks
+ * to the cluster via kubectl, not a remote Docker daemon.
+ */
+
+import { shellQuote } from './shell-quote.js';
+import { createSshExecSession } from '../deployment/ssh-connection.js';
+import { resolveDockerRemoteMode } from './docker-remote-mode.js';
+
+export { resolveDockerRemoteMode };
+
+/**
+ * SSH identity for docker remote.mode === "ssh".
+ * Same env names as ec2 (SSH_HOST / SSH_USER / SSH_KEY_PATH / SSH_KEY).
+ * Per-environment prefixing already separates these from a sibling ssh/ec2 env.
+ *
+ * @param {Record<string, unknown>} settings
+ * @param {Record<string, string|undefined>} env
+ */
+export function resolveDockerSshTarget(settings, env = process.env) {
+  const host = String(settings.host || env.SSH_HOST || '');
+  const user = String(settings.user || env.SSH_USER || '');
+  const keyPath = settings.keyPath || env.SSH_KEY_PATH;
+  const sshKey = env.SSH_KEY;
+  const sshPort = Number(env.SSH_SSH_PORT || settings.sshPort) || 22;
+  return { host, user, keyPath, sshKey, sshPort };
+}
+
+/**
+ * @param {string} host
+ * @param {string} user
+ * @returns {string}
+ */
+export function formatRemoteDockerSshFailure(host, user) {
+  return (
+    `Could not reach ${host} via SSH as '${user}'. Check host,\n` +
+    `username, and key path.`
+  );
+}
+
+/**
+ * @param {string} host
+ * @param {string} user
+ * @returns {string}
+ */
+export function formatRemoteDockerNotInstalled(host, user) {
+  return (
+    `Docker is not installed on the remote host (${user}@${host}).\n` +
+    `Install Docker on the server first: https://docs.docker.com/engine/install/`
+  );
+}
+
+/**
+ * @param {string} host
+ * @param {string} user
+ * @returns {string}
+ */
+export function formatRemoteDockerPermissionDenied(host, user) {
+  return (
+    `SSH user '${user}' cannot access the Docker daemon on ${host}\n` +
+    `(permission denied).\n` +
+    `Run this on the remote server, then reconnect your SSH session:\n` +
+    `sudo usermod -aG docker ${user}`
+  );
+}
+
+/**
+ * @param {string} host
+ * @param {string} user
+ * @returns {string}
+ */
+export function formatRemoteDockerDaemonOk(host, user) {
+  return `Remote Docker daemon reachable (${user}@${host})`;
+}
+
+/**
+ * @param {{ code?: number|null, stdout?: string, stderr?: string }} result
+ * @returns {'ok'|'permission'|'not-installed'|'other'}
+ */
+export function classifyRemoteDockerPs(result) {
+  const stdout = String(result?.stdout || '');
+  const stderr = String(result?.stderr || '');
+  const combined = `${stderr}\n${stdout}`.toLowerCase();
+  const code = result?.code;
+
+  if (code === 0 || code === null) {
+    return 'ok';
+  }
+
+  if (
+    combined.includes('permission denied') ||
+    combined.includes('got permission denied while trying to connect to the docker daemon')
+  ) {
+    return 'permission';
+  }
+
+  if (
+    code === 127 ||
+    combined.includes('command not found') ||
+    /docker:\s*not found/.test(combined) ||
+    (combined.includes('no such file or directory') && combined.includes('docker'))
+  ) {
+    return 'not-installed';
+  }
+
+  return 'other';
+}
+
+/**
+ * Probe `docker ps` over the shared node-ssh session. Never throws — doctor
+ * wraps each check independently.
+ *
+ * @param {{
+ *   host: string,
+ *   user: string,
+ *   keyPath?: string,
+ *   sshKey?: string,
+ *   sshPort?: number,
+ *   env?: Record<string, string|undefined>,
+ * }} target
+ * @returns {Promise<{
+ *   sshOk: boolean,
+ *   sshError?: string,
+ *   kind?: ReturnType<typeof classifyRemoteDockerPs>,
+ *   detail?: string,
+ *   host: string,
+ *   user: string,
+ * }>}
+ */
+export async function probeRemoteDockerPs(target) {
+  const host = target.host;
+  const user = target.user;
+  if (!host || !user) {
+    return {
+      sshOk: false,
+      sshError: formatRemoteDockerSshFailure(host || '(missing host)', user || '(missing user)'),
+      host: host || '',
+      user: user || '',
+    };
+  }
+
+  const session = createSshExecSession({
+    host,
+    user,
+    keyPath: target.keyPath ? String(target.keyPath) : undefined,
+    sshKey: target.sshKey,
+    sshPort: target.sshPort,
+    env: target.env,
+  });
+
+  /** @type {import('node-ssh').NodeSSH | undefined} */
+  let ssh;
+  try {
+    ssh = await session.connect();
+    const result = await session.execUnchecked(ssh, 'docker ps');
+    const kind = classifyRemoteDockerPs(result);
+    const detail = String(result.stderr || result.stdout || '').trim();
+    return { sshOk: true, kind, detail, host, user };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      sshOk: false,
+      sshError: formatRemoteDockerSshFailure(host, user),
+      detail: msg,
+      host,
+      user,
+    };
+  } finally {
+    if (ssh) ssh.dispose();
+  }
+}
+
+/**
+ * Quoted remote docker commands (image/container/env interpolated via shellQuote).
+ * @param {string} imageRef
+ * @param {string} containerName
+ * @param {Record<string, string>} [runEnv]
+ * @param {{ publishPort?: number|null }} [options]
+ */
+export function buildRemoteDockerCommands(imageRef, containerName, runEnv = {}, options = {}) {
+  const image = shellQuote(imageRef);
+  const name = shellQuote(containerName);
+  /** @type {string[]} */
+  const envFlags = [];
+  for (const [key, value] of Object.entries(runEnv)) {
+    envFlags.push(`-e ${shellQuote(`${key}=${value}`)}`);
+  }
+  const envArg = envFlags.length > 0 ? `${envFlags.join(' ')} ` : '';
+  const publishPort = options.publishPort;
+  const pFlag =
+    publishPort != null ? `-p ${shellQuote(`${publishPort}:${publishPort}`)} ` : '';
+
+  return {
+    stop: `docker stop ${name} 2>/dev/null || true`,
+    rm: `docker rm -f ${name} 2>/dev/null || true`,
+    pull: `docker pull ${image}`,
+    run: `docker run -d --rm --name ${name} ${pFlag}${envArg}${image}`,
+    ps: `docker ps --filter ${shellQuote(`name=^/${containerName}$`)} --format ${shellQuote('{{.Status}}')}`,
+    info: 'docker info',
+    /**
+     * @param {string} registry
+     * @param {string} username
+     * @param {string} token
+     */
+    login: (registry, username, token) =>
+      `echo ${shellQuote(token)} | docker login ${shellQuote(registry)} -u ${shellQuote(username)} --password-stdin`,
+  };
+}
+
+export default {
+  resolveDockerRemoteMode,
+  resolveDockerSshTarget,
+  probeRemoteDockerPs,
+  buildRemoteDockerCommands,
+};

package/src/utils/github-actions.js

@@ -21,6 +21,7 @@ import {
   getEnvTrigger,
   getEnabledEnvironmentNames,
   isEnvEnabled,
+  getEnvSettings,
 } from '../core/environments.js';
 import { resolvePhpVersion } from './php-version.js';
 
@@ -540,7 +541,11 @@ export function buildWorkflowEnvEntries(
 
     const method = getEnvMethod(env);
     if (!method) continue;
-    const unprefixedKeys = getDeploymentWorkflowSecretKeys(method, config);
+    const unprefixedKeys = getDeploymentWorkflowSecretKeys(
+      method,
+      config,
+      getEnvSettings(env)
+    );
     for (const key of unprefixedKeys) {
       const secretName = envUsesPrefixedSecrets(envName, cfg)
         ? prefixSecretKey(envName, key)