@davidvornholt/standards 0.26.4 → 0.27.0

package/src/dev-env-brokered-source.ts

@@ -0,0 +1,128 @@
+import { execFileSync } from 'node:child_process';
+import { realpathSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { parseDestination } from './creds-dest';
+import { resolveTargetRelResult } from './creds-target';
+import type { BrokeredS3Reference } from './dev-env-brokered';
+import { isRecord } from './github-settings-parse';
+
+const repositoryPattern =
+  /^[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/u;
+const gitSuffixPattern = /\.git$/u;
+const sshRemotePattern = /^git@github\.com:(?<repository>[^\s]+?)(?:\.git)?$/u;
+
+export type BrokeredS3Source = Readonly<{
+  repository: string;
+  checkout: string;
+}>;
+
+export const parseBrokeredSource = (raw: unknown): BrokeredS3Source | null => {
+  if (
+    !(
+      isRecord(raw) &&
+      Object.keys(raw).length === 2 &&
+      typeof raw.repository === 'string' &&
+      repositoryPattern.test(raw.repository) &&
+      typeof raw.checkout === 'string' &&
+      raw.checkout.trim() === raw.checkout &&
+      raw.checkout.length > 0 &&
+      !raw.checkout.includes('\\')
+    )
+  ) {
+    return null;
+  }
+  return { repository: raw.repository, checkout: raw.checkout };
+};
+
+export const brokeredReferenceIdentity = (
+  reference: BrokeredS3Reference,
+): string =>
+  `${reference.source === undefined ? '' : `${reference.source.repository}@`}${reference.brokeredS3}:${reference.key}`;
+
+export const validBrokeredIdentity = (raw: string): boolean => {
+  const separator = raw.indexOf('@');
+  return separator === -1
+    ? parseDestination(raw) !== null
+    : repositoryPattern.test(raw.slice(0, separator)) &&
+        parseDestination(raw.slice(separator + 1)) !== null;
+};
+
+const remoteRepository = (remote: string): string | null => {
+  const ssh = sshRemotePattern.exec(remote)?.groups?.repository;
+  if (ssh !== undefined) {
+    return ssh;
+  }
+  try {
+    const url = new URL(remote);
+    if (
+      url.hostname !== 'github.com' ||
+      !['https:', 'ssh:'].includes(url.protocol) ||
+      url.port !== '' ||
+      url.search !== '' ||
+      url.hash !== ''
+    ) {
+      return null;
+    }
+    return url.pathname.slice(1).replace(gitSuffixPattern, '');
+  } catch {
+    return null;
+  }
+};
+
+type SourceResolution =
+  | Readonly<{ ok: true; root: string; rel: string }>
+  | Readonly<{ ok: false; problem: string }>;
+
+export const resolveBrokeredSource = (
+  consumer: string,
+  reference: BrokeredS3Reference,
+): SourceResolution => {
+  let root = consumer;
+  if (reference.source !== undefined) {
+    try {
+      root = resolve(consumer, reference.source.checkout);
+      if (realpathSync(root) !== root) {
+        return {
+          ok: false,
+          problem: 'source checkout must not contain symlinks',
+        };
+      }
+      const git = (args: ReadonlyArray<string>) =>
+        execFileSync('git', ['-C', root, ...args], {
+          encoding: 'utf8',
+          stdio: ['ignore', 'pipe', 'ignore'],
+        }).trim();
+      if (git(['rev-parse', '--show-toplevel']) !== root) {
+        return {
+          ok: false,
+          problem: 'source checkout must name a repository root',
+        };
+      }
+      if (
+        remoteRepository(git(['remote', 'get-url', 'origin'])) !==
+        reference.source.repository
+      ) {
+        return {
+          ok: false,
+          problem:
+            'source checkout origin does not match the authorized repository',
+        };
+      }
+    } catch {
+      return {
+        ok: false,
+        problem: 'source checkout is not an accessible Git repository',
+      };
+    }
+  }
+  const target = resolveTargetRelResult(root, reference.brokeredS3);
+  return target.ok
+    ? { ok: true, root, rel: target.rel }
+    : {
+        ok: false,
+        problem:
+          target.kind === 'ambiguous'
+            ? target.problem
+            : `secrets target "${reference.brokeredS3}" does not exist; create it and mint the pair with \`bun standards creds add cloudflare --s3\``,
+      };
+};

package/src/dev-env-brokered.ts

@@ -7,6 +7,10 @@
 
 import { parseDestination } from './creds-dest';
 import { parseSopsKeyPath } from './creds-sops-structure';
+import {
+  type BrokeredS3Source,
+  parseBrokeredSource,
+} from './dev-env-brokered-source';
 import { isRecord } from './github-settings-parse';
 
 export const BROKERED_S3_PARTS = [
@@ -20,9 +24,10 @@ export type BrokeredS3Reference = {
   readonly brokeredS3: string;
   readonly key: string;
   readonly part: BrokeredS3Part;
+  readonly source?: BrokeredS3Source;
 };
 
-const REFERENCE_PROPERTIES = ['brokeredS3', 'key', 'part'] as const;
+const REFERENCE_PROPERTIES = ['brokeredS3', 'key', 'part', 'source'] as const;
 
 export const isBrokeredS3ReferenceShape = (
   value: unknown,
@@ -46,11 +51,18 @@ export const parseBrokeredS3Reference = (
   for (const property of Object.keys(raw)) {
     if (!REFERENCE_PROPERTIES.includes(property as 'brokeredS3')) {
       problems.push(
-        `${label} brokered S3 pair reference has unknown property ${JSON.stringify(property)}; allowed properties are brokeredS3, key, and part`,
+        `${label} brokered S3 pair reference has unknown property ${JSON.stringify(property)}; allowed properties are brokeredS3, key, part, and source`,
       );
     }
   }
   const { brokeredS3: target, key, part } = raw;
+  const source =
+    raw.source === undefined ? undefined : parseBrokeredSource(raw.source);
+  if (source === null) {
+    problems.push(
+      `${label} source must contain exactly a GitHub repository owner/name and a checkout path`,
+    );
+  }
   if (
     typeof target !== 'string' ||
     parseDestination(`${target}:reference_validation`) === null
@@ -78,6 +90,7 @@ export const parseBrokeredS3Reference = (
       brokeredS3: target as string,
       key: key as string,
       part: part as BrokeredS3Part,
+      ...(source === undefined || source === null ? {} : { source }),
     },
   };
 };

package/src/dev-env.ts

@@ -42,6 +42,21 @@ export type DevEnvPlan = {
   readonly problems: ReadonlyArray<string>;
 };
 
+const workspaceConfigurationProblems = (
+  consumer: string,
+  targets: ReadonlyArray<import('./dev-env-compose').ComposedDevEnvTarget>,
+): ReadonlyArray<string> =>
+  targets.flatMap((target) => {
+    const workspace = `${target.group}/${target.workspace}`;
+    if (!existsSync(join(consumer, workspace, 'package.json'))) {
+      return [
+        `${target.sources.join(' + ')} defines ${target.group}.${target.workspace}, but ${workspace}/package.json does not exist`,
+      ];
+    }
+    const problem = devEnvGitIgnoreProblem(consumer, `${workspace}/.env.local`);
+    return problem === null ? [] : [problem];
+  });
+
 export const planDevEnvChanges = (
   consumer: string,
   inputs: DevEnvInputs,
@@ -66,6 +81,13 @@ export const planDevEnvChanges = (
     },
     layer(DEV_LOCAL_FILE, inputs.local),
   );
+  const configurationProblems = [
+    ...composed.problems,
+    ...workspaceConfigurationProblems(consumer, composed.targets),
+  ];
+  if (configurationProblems.length > 0) {
+    return { writes: [], removals: [], problems: configurationProblems };
+  }
   const resolved = resolveBrokeredReferences(
     consumer,
     composed.targets,

package/src/github-api.ts

@@ -16,7 +16,7 @@ import { isRecord } from './github-settings-parse';
 const API_ROOT = 'https://api.github.com';
 
 const GITHUB_REMOTE_PATTERN =
-  /github\.com[/:](?<repo>[^/]+\/[^/]+?)(?:\.git)?$/u;
+  /^(?:https?:\/\/(?:[^/@]+@)?github\.com\/|ssh:\/\/git@github\.com\/|git@github\.com:)(?<repo>[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9._-]+?)(?:\.git)*$/iu;
 
 export const HTTP_OK = 200;
 export const HTTP_CREATED = 201;
@@ -55,7 +55,10 @@ export const resolveToken = (): string | null => {
 
 export const resolveGithubRepo = (consumer: string): string | null => {
   const url = quietExec('git', ['-C', consumer, 'remote', 'get-url', 'origin']);
-  return url?.match(GITHUB_REMOTE_PATTERN)?.groups?.repo ?? null;
+  const repo = url?.match(GITHUB_REMOTE_PATTERN)?.groups?.repo?.toLowerCase();
+  return repo === undefined || ['.', '..'].includes(repo.split('/')[1] ?? '')
+    ? null
+    : repo;
 };
 
 export type ApiResponse = { readonly status: number; readonly body: unknown };

package/src/github-apply.ts

@@ -9,9 +9,12 @@ import {
   HTTP_OK,
   request,
 } from './github-api';
+import { resolveHiddenBypassActors } from './github-bypass-actors';
 import { diffRepositorySettings } from './github-diff';
+import { fetchBypassActorCountsViaGraphql } from './github-graphql';
 import { fetchLiveRulesets } from './github-ruleset-api';
-import { diffRuleset } from './github-ruleset-diff';
+import { diffRuleset, diffRulesets } from './github-ruleset-diff';
+import { isHiddenBypassActors } from './github-ruleset-visibility';
 import { type GithubSettings, isRecord } from './github-settings-parse';
 
 // GitHub answers a PATCH containing a plan-unavailable setting with HTTP 200
@@ -123,7 +126,28 @@ export const applyRulesets = async (
   if (live.rulesets === null) {
     throw new Error(live.problem ?? 'unable to read rulesets');
   }
-  const liveByName = new Map(live.rulesets.map((r) => [String(r.name), r]));
+  let comparable = live.rulesets;
+  const initialDiff = diffRulesets(declared.rulesets, comparable);
+  if (initialDiff.unverifiable.some(isHiddenBypassActors)) {
+    const answered = await fetchBypassActorCountsViaGraphql(token, repo);
+    comparable = resolveHiddenBypassActors(
+      declared.rulesets,
+      comparable,
+      answered.counts,
+    );
+  }
+  const invisible = diffRulesets(declared.rulesets, comparable).unverifiable;
+  if (invisible.length > 0) {
+    throw new Error(
+      `cannot verify ruleset fields before applying: ${invisible.map(({ name, key }) => `${name}: ${key}`).join('; ')}; use a credential that can read the declared fields`,
+    );
+  }
+  const liveByName = new Map(comparable.map((r) => [String(r.name), r]));
+  if (liveByName.size !== comparable.length) {
+    throw new Error(
+      'duplicate live ruleset names prevent safe reconciliation; remove or rename the duplicate rulesets explicitly',
+    );
+  }
   const declaredNames = new Set(declared.rulesets.map((r) => String(r.name)));
   const actions: Array<string> = [];
   for (const ruleset of declared.rulesets) {

package/src/github-bypass-actors.ts

@@ -10,8 +10,8 @@ import { BYPASS_ACTORS_KEY } from './github-ruleset-diff';
 // their content is never observed: subsetMatches short-circuits at the length
 // check, two empty lists compare no element, and a declared ruleset with no
 // bypass_actors array never reaches that comparison. Nothing else looks inside
-// them; bypassActorCountDetail reads only `.length`, and github-live-drift.ts
-// is the sole importer, so a stand-in cannot reach a PATCH body. The guarantee
+// them; bypassActorCountDetail reads only `.length`, and both check/apply only use these live records for comparison. Writes
+// always send the original declaration, so a stand-in cannot reach a PATCH body. The guarantee
 // is not local: it also relies on declared ruleset names being unique, which
 // github-settings-parse.ts and github-settings-merge.ts enforce.
 const unreadableBypassActors = (count: number): ReadonlyArray<unknown> =>

package/src/sops-action-callers.ts

@@ -0,0 +1,133 @@
+import { existsSync } from 'node:fs';
+import { readdir, readFile } from 'node:fs/promises';
+import { join, posix } from 'node:path';
+import { isRecord } from './github-settings-parse';
+import type { ManagedEntry } from './managed-files';
+import { parseYaml } from './yaml-parse';
+
+const YAML_FILE = /\.ya?ml$/u;
+const ACTION = '.github/actions/sops-secret/action.yml';
+const LOCAL_ACTION = './.github/actions/sops-secret';
+const yamlFiles = async (root: string, rel: string): Promise<Array<string>> => {
+  if (!existsSync(join(root, rel))) {
+    return [];
+  }
+  const entries = await readdir(join(root, rel), { withFileTypes: true });
+  return (
+    await Promise.all(
+      entries.map((entry) => {
+        const path = `${rel}/${entry.name}`;
+        if (entry.isDirectory()) {
+          return yamlFiles(root, path);
+        }
+        return Promise.resolve(
+          entry.isFile() && YAML_FILE.test(path) ? [path] : [],
+        );
+      }),
+    )
+  ).flat();
+};
+const hasLegacyCaller = (value: unknown): boolean => {
+  if (Array.isArray(value)) {
+    return value.some(hasLegacyCaller);
+  }
+  if (!isRecord(value)) {
+    return false;
+  }
+  return (
+    (typeof value.uses === 'string' &&
+      value.uses.startsWith('./') &&
+      posix.resolve('/', value.uses) === posix.resolve('/', LOCAL_ACTION) &&
+      isRecord(value.with) &&
+      Object.hasOwn(value.with, 'env-name')) ||
+    Object.values(value).some(hasLegacyCaller)
+  );
+};
+
+const localActions = (value: unknown): Array<string> => {
+  if (Array.isArray(value)) {
+    return value.flatMap(localActions);
+  }
+  if (!isRecord(value)) {
+    return [];
+  }
+  const reference = value.uses;
+  return [
+    ...(typeof reference === 'string' && reference.startsWith('./')
+      ? [posix.normalize(reference)]
+      : []),
+    ...Object.values(value).flatMap(localActions),
+  ];
+};
+const callerProblems = async (
+  consumer: string,
+  incoming: ReadonlyMap<string, ManagedEntry>,
+): Promise<Array<string>> => {
+  const visited = new Set<string>();
+  const visit = async (path: string): Promise<Array<string>> => {
+    if (visited.has(path)) {
+      return [];
+    }
+    visited.add(path);
+    const source = incoming.get(path)?.absolutePath ?? join(consumer, path);
+    const parsed = parseYaml(await readFile(source, 'utf8'), path);
+    if (parsed.problem !== null) {
+      return [parsed.problem];
+    }
+    const problems =
+      !incoming.has(path) && hasLegacyCaller(parsed.value)
+        ? [
+            `${path} still passes env-name to ${LOCAL_ACTION}; before syncing, give the resolver step an id, remove env-name, and pass steps.<id>.outputs.value only to each consuming step's env or action input`,
+          ]
+        : [];
+    const nested = await Promise.all(
+      localActions(parsed.value).map(async (directory) => {
+        if (directory === '..' || directory.startsWith('../')) {
+          return [`${path} references a local action outside the repository`];
+        }
+        const paths = ['action.yml', 'action.yaml']
+          .map((filename) => posix.join(directory, filename))
+          .filter(
+            (target) =>
+              incoming.has(target) || existsSync(join(consumer, target)),
+          );
+        return (await Promise.all(paths.map(visit))).flat();
+      }),
+    );
+    return [...problems, ...nested.flat()];
+  };
+  return (
+    await Promise.all((await yamlFiles(consumer, '.github')).map(visit))
+  ).flat();
+};
+
+// Called before mirror writes. Consumer-owned workflows and composite actions
+// are not silently rewritten, so an action interface migration must stop before
+// replacing the implementation they still invoke with its retired input.
+export const collectSopsActionCallerProblems = async (
+  consumer: string,
+  incoming: ReadonlyMap<string, ManagedEntry> = new Map(),
+): Promise<ReadonlyArray<string>> => {
+  const action = incoming.get(ACTION);
+  const actionPath = action?.absolutePath ?? join(consumer, ACTION);
+  if (
+    !existsSync(actionPath) ||
+    (action !== undefined && action.kind !== 'file')
+  ) {
+    return [];
+  }
+  const { value: definition } = parseYaml(
+    await readFile(actionPath, 'utf8'),
+    ACTION,
+  );
+  if (
+    !(
+      isRecord(definition) &&
+      isRecord(definition.outputs) &&
+      Object.hasOwn(definition.outputs, 'value')
+    )
+  ) {
+    return [];
+  }
+  return callerProblems(consumer, incoming);
+};

package/src/structure-check.ts

@@ -4,6 +4,7 @@ import { isAbsolute, join } from 'node:path';
 import { isContainedPath } from './contained-path';
 import { isRecord } from './github-settings-parse';
 import { readJsonFile } from './json-file';
+import { collectSopsActionCallerProblems } from './sops-action-callers';
 import { collectBunVersionProblems } from './structure-bun-version';
 import {
   missingPublishedCliProblems,
@@ -154,14 +155,16 @@ export const collectStructureProblems = async (
   consumer: string,
   profile: StructureProfile,
 ): Promise<ReadonlyArray<string>> => {
-  const [root, secretsProblems] = await Promise.all([
+  const [root, secretsProblems, callerProblems] = await Promise.all([
     readJsonFile(join(consumer, 'package.json')),
     collectCiSecretsProblems(consumer),
+    collectSopsActionCallerProblems(consumer),
   ]);
   if (root === null) {
     return [
       'package.json must exist and contain a JSON object',
       ...secretsProblems,
+      ...callerProblems,
     ];
   }
   const declaration = workspacePatternsOf(root);
@@ -193,5 +196,6 @@ export const collectStructureProblems = async (
     ...inspectRootScripts(root, profile, requireA11y),
     ...inspections.flatMap((i) => [...i.problems]),
     ...secretsProblems,
+    ...callerProblems,
   ];
 };