@catladder/cli 5.1.0 → 5.1.2

package/package.json

@@ -53,7 +53,7 @@
     }
   ],
   "license": "MIT",
-  "version": "5.1.0",
+  "version": "5.1.2",
   "scripts": {
     "lint": "eslint \"src/**/*.ts\"",
     "lint:fix": "eslint \"src/**/*.ts\" --fix",

package/src/apps/cli/commands/project/doctor/checkGithubImageCasing.ts

@@ -0,0 +1,87 @@
+import { readdir, readFile } from "fs/promises";
+import { join } from "path";
+import type { Config } from "@catladder/pipeline";
+import {
+  GHCR_REPOSITORY_EXPRESSION,
+  getEnabledPipelineTypes,
+  getPipelineGitRemote,
+} from "@catladder/pipeline";
+import { getConfiguredGithubRepo } from "../../../../../secrets";
+import type { DoctorReport } from "./DoctorReport";
+
+const WORKFLOWS_FOLDER = ".github/workflows";
+const GENERATED_FILE_PREFIX = "catladder-";
+
+/**
+ * the generated workflow files, or an empty list when none exist yet
+ */
+const readGeneratedWorkflows = async (): Promise<string[]> => {
+  const entries = await readdir(WORKFLOWS_FOLDER).catch(() => []);
+  return Promise.all(
+    entries
+      .filter((file) => file.startsWith(GENERATED_FILE_PREFIX))
+      .map((file) => readFile(join(WORKFLOWS_FOLDER, file), "utf8")),
+  );
+};
+
+/**
+ * ghcr image paths must be lowercase, but `${{ github.repository }}`
+ * interpolates github's display casing — so a repository whose owner or
+ * name contains an uppercase character needs a lowercased literal in the
+ * generated workflows. Generation bakes that in, which means committed
+ * workflows generated by an older catladder (or hand-edited ones) still
+ * carry the expression and fail every docker job with
+ * `repository name must be lowercase`.
+ *
+ * Unlike the rest of the github checks this needs no `gh` login — only
+ * the git remote and the committed files.
+ */
+export const checkGithubImageCasing = async (
+  report: DoctorReport,
+  config: Config,
+) => {
+  if (!getEnabledPipelineTypes(config).includes("github")) return;
+
+  const repo = await getConfiguredGithubRepo();
+  if (!repo || repo === repo.toLowerCase()) {
+    // an all-lowercase repository keeps the expression on purpose (it
+    // stays correct in forks), and an unresolvable remote is reported
+    // by checkGithub already
+    return;
+  }
+
+  report.section("github image names");
+
+  const workflows = await readGeneratedWorkflows();
+  if (workflows.length === 0) {
+    report.warn(
+      `no generated workflows in ${WORKFLOWS_FOLDER} to check`,
+      "run: catenv",
+    );
+    return;
+  }
+
+  const stale = workflows.filter((content) =>
+    content.includes(GHCR_REPOSITORY_EXPRESSION),
+  );
+  if (stale.length > 0) {
+    report.fail(
+      `'${repo}' is mixed-case, but ${stale.length}/${workflows.length} generated workflows still use ${GHCR_REPOSITORY_EXPRESSION} — ghcr rejects uppercase image paths, so every docker job fails with "repository name must be lowercase"`,
+      "run: catenv (and commit the regenerated workflows)",
+    );
+    return;
+  }
+
+  const uppercase = workflows.flatMap((content) =>
+    [...content.matchAll(/ghcr\.io\/\S*[A-Z]\S*/g)].map(([match]) => match),
+  );
+  if (uppercase.length > 0) {
+    report.fail(
+      `uppercase ghcr image paths in the generated workflows: ${[...new Set(uppercase)].join(", ")}`,
+      `run: catenv — if it persists, set pipelines.github.repository (the '${getPipelineGitRemote(config, "github")}' remote resolves to '${repo}')`,
+    );
+    return;
+  }
+
+  report.ok(`ghcr image paths lowercased for '${repo}'`);
+};

package/src/apps/cli/commands/project/doctor/index.ts

@@ -7,6 +7,7 @@ import {
 import type { IO } from "../../../../../core/types";
 import { checkCloudRun } from "./checkCloudRun";
 import { checkGithub } from "./checkGithub";
+import { checkGithubImageCasing } from "./checkGithubImageCasing";
 import { checkGitlab } from "./checkGitlab";
 import { checkStore } from "./checkStore";
 import { DoctorReport } from "./DoctorReport";
@@ -53,6 +54,7 @@ export const doctorProject = async (
     await checkGitlab(instance, report, contexts);
   }
   await checkCloudRun(report, contexts);
+  await checkGithubImageCasing(report, config);
   await checkGithub(report, config);
 
   report.summarize();

package/src/utils/github.ts

@@ -1,5 +1,6 @@
 import { execFile as execFileCb, spawn } from "child_process";
 import { promisify } from "util";
+import { parseGithubRepoFromRemoteUrl } from "@catladder/pipeline";
 
 const execFile = promisify(execFileCb);
 
@@ -25,10 +26,7 @@ export const getGithubRepoFromRemote = async (
 ): Promise<string | undefined> => {
   try {
     const { stdout } = await execFile("git", ["remote", "get-url", remoteName]);
-    const match = stdout.match(
-      /github\.com[:/]([\w.-]+\/[\w.-]+?)(\.git)?\s*$/,
-    );
-    return match?.[1];
+    return parseGithubRepoFromRemoteUrl(stdout);
   } catch {
     return undefined;
   }