@andrian.yablonskyy/thub-common 1.0.28 → 1.0.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@andrian.yablonskyy/thub-common",
-  "version": "1.0.28",
+  "version": "1.0.30",
   "description": "Shared job-spec schema, state enums and a thin API client used by the Agent and Client",
   "main": "src/index.js",
   "files": [

package/src/job-spec.schema.js

@@ -102,11 +102,10 @@ const DOCKER_IMAGE_PATTERN =
         }
       },
       // Environment variables (`--env NAME=value`) the Client sets for every
-      // command it runs for the job — git, docker login, the job's command.
-      // DOCKER_REGISTRY + DOCKER_USERNAME + DOCKER_PASSWORD: the Client logs in
-      // to that registry first (README §8.1). Values are secrets as far as
-      // the Coordinator is concerned: masked in the Agent API and dropped
-      // from its database once the job ends.
+      // command it runs for the job — git and the job's command. No name
+      // means anything special. Values are secrets as far as the Coordinator
+      // is concerned: masked in the Agent API and dropped from its database
+      // once the job ends.
       env: {
         type: 'object',
         maxProperties: 64,
@@ -128,9 +127,6 @@ const DOCKER_IMAGE_PATTERN =
       // see README §7.1 "Dry-run the pipeline".
       dryRun: { type: 'boolean', default: false }
     }
-  },
+  };
 
-  // The job env variables the Client logs in to a Docker registry with.
-  DOCKER_LOGIN_ENV = ['DOCKER_REGISTRY', 'DOCKER_USERNAME', 'DOCKER_PASSWORD'];
-
-module.exports = { jobSpecSchema, DOCKER_IMAGE_PATTERN, ENV_NAME_PATTERN, DOCKER_LOGIN_ENV };
+module.exports = { jobSpecSchema, DOCKER_IMAGE_PATTERN, ENV_NAME_PATTERN };

package/src/updates.js

@@ -89,20 +89,50 @@ function npmBin(){
   return fs.existsSync(candidate) ? candidate : 'npm';
 }
 
+// npm's errors for a version that isn't downloadable (yet): right after a
+// publish, the registry can list a version whose tarball still 404s for a
+// few minutes — worth waiting for, unlike any other failure.
+const NOT_YET_AVAILABLE = /\b(E404|ETARGET|ENOVERSIONS)\b/,
+  // How long to wait before each retry of such a failure: ~7.5 min in all.
+  NPM_RETRY_DELAYS_SEC = [30, 60, 120, 240];
+
+function sleepSync(ms){
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
 // `npm i -g <pkg>@<version>` (as the current user — root for the Client's
-// update helper; `sudo` is the caller's job otherwise). Returns npm's exit code.
-function npmInstallGlobal(pkg, version, { env = process.env, stdio = 'inherit' } = {}){
+// and Coordinator's update helpers; `sudo` is the caller's job otherwise).
+// Always with --prefer-online, so a stale cached packument can't hide or
+// misplace a fresh version. A "not found" failure is retried after each of
+// `retryDelaysSec` (npm's stderr is read to tell, and passed on); anything
+// else fails at once. Returns npm's exit code. `spawn`/`sleep`: for tests.
+function npmInstallGlobal(pkg, version, {
+  env = process.env, stdio = 'inherit', retryDelaysSec = NPM_RETRY_DELAYS_SEC, log = (line) => console.error(line),
+  spawn = spawnSync, sleep = sleepSync
+} = {}){
   if (!Object.values(PACKAGES).includes(pkg)){
     throw new Error(`Refusing to install unknown package ${pkg}`);
   }
   if (!isValidVersion(version)){
     throw new Error(`Invalid version "${version}"`);
   }
-  const result = spawnSync(npmBin(), ['i', '-g', `${pkg}@${version}`], { env, stdio });
-  if (result.error){
-    throw result.error;
+  const [stdin, stdout] = Array.isArray(stdio) ? stdio : [stdio, stdio],
+    args = ['i', '-g', '--prefer-online', `${pkg}@${version}`];
+  for (let attempt = 0; ; attempt++){
+    const result = spawn(npmBin(), args, { env, stdio: [stdin, stdout, 'pipe'], encoding: 'utf8' });
+    if (result.error){
+      throw result.error;
+    }
+    const stderr = result.stderr || '';
+    if (stderr){
+      process.stderr.write(stderr);
+    }
+    if (result.status === 0 || !NOT_YET_AVAILABLE.test(stderr) || attempt >= retryDelaysSec.length){
+      return result.status;
+    }
+    log(`${pkg}@${version} isn't downloadable from the registry yet (just published?) — retrying in ${retryDelaysSec[attempt]} s`);
+    sleep(retryDelaysSec[attempt] * 1000);
   }
-  return result.status;
 }
 
 module.exports = {
@@ -113,5 +143,6 @@ module.exports = {
   defaultRegistry,
   fetchLatestVersion,
   npmBin,
-  npmInstallGlobal
+  npmInstallGlobal,
+  NPM_RETRY_DELAYS_SEC
 };

package/src/validate-job-spec.js

@@ -15,7 +15,7 @@
 
 const Ajv = require('ajv'),
   addFormats = require('ajv-formats'),
-  { jobSpecSchema, DOCKER_LOGIN_ENV } = require('./job-spec.schema'),
+  { jobSpecSchema } = require('./job-spec.schema'),
   { splitArgs } = require('./split-args');
 
 const ajv = new Ajv({ useDefaults: true, allErrors: true, strict: false });
@@ -55,8 +55,8 @@ function legacyShapeError(spec){
 const GIT_URL = /^(?:(?:https?|ssh|git):\/\/[^\s]+|[A-Za-z0-9._-]+@[A-Za-z0-9.-]+:[^\s]+)$/,
 
   // Job env names the Client sets itself for a job's commands (besides
-  // THUB_*): git's safety settings, and the job's own Docker config dir.
-  RESERVED_ENV = ['GIT_TERMINAL_PROMPT', 'GIT_ALLOW_PROTOCOL', 'DOCKER_CONFIG'];
+  // THUB_*): git's safety settings.
+  RESERVED_ENV = ['GIT_TERMINAL_PROMPT', 'GIT_ALLOW_PROTOCOL'];
 
 // Rules across fields, spelled out here rather than as schema if/then,
 // whose errors ("must match a schema in then") say little.
@@ -69,15 +69,10 @@ function crossFieldErrors(spec){
     errors.push('/git/url must be an https://, http://, ssh:// or git:// URL, or user@host:path');
   }
   const envNames = Object.keys(spec.env && typeof spec.env === 'object' ? spec.env : {}),
-    reserved = envNames.filter((n) => /^THUB_/.test(n) || RESERVED_ENV.includes(n)),
-    login = DOCKER_LOGIN_ENV.filter((n) => envNames.includes(n));
+    reserved = envNames.filter((n) => /^THUB_/.test(n) || RESERVED_ENV.includes(n));
   if (reserved.length){
     errors.push(`/env ${reserved.join(', ')}: set by the Client itself (THUB_*, ${RESERVED_ENV.join(', ')}) — use other names`);
   }
-  if (login.length && login.length < DOCKER_LOGIN_ENV.length){
-    errors.push(`/env a Docker registry login needs all of ${DOCKER_LOGIN_ENV.join(', ')} — missing ` +
-      DOCKER_LOGIN_ENV.filter((n) => !login.includes(n)).join(', '));
-  }
   if (spec.git?.options){
     try {
       splitArgs(spec.git.options);
@@ -97,4 +92,4 @@ function maskEnv(env){
 
 const MASKED = '***';
 
-module.exports = { validateJobSpec, maskEnv, DOCKER_LOGIN_ENV, JOB_ENV_MASK: MASKED };
+module.exports = { validateJobSpec, maskEnv, JOB_ENV_MASK: MASKED };