@factorialco/gat 2.0.0 → 2.1.0

package/README.md

@@ -18,10 +18,10 @@ npm i -D @factorialco/gat typescript ts-node commander @swc/core
 
 ### Writing a template
 
-The `gat` CLI assumes that your templates are inside `.github/templates`. Let's create our first template:
+The `gat` CLI assumes that you have a `index.ts` file inside `.github/templates`. Let's create our first template:
 
 ```ts
-// .github/templates/my-first-workflow.ts
+// .github/templates/index.ts
 import { Workflow } from "@factorialco/gat";
 
 new Workflow("My first workflow")
@@ -39,10 +39,10 @@ new Workflow("My first workflow")
       },
     ],
   })
-  .compile();
+  .compile("my-first-workflow.yml");
 ```
 
-Notice that you need to call the `compile()` method at the end.
+Notice that you need to call the `compile()` method at the end, passing the file name of the generated Github Actions workflow.
 
 ### Compiling your templates
 
@@ -52,12 +52,6 @@ You can build your templates running this command in your root folder:
 npx gat build
 ```
 
-Alternatively you can also compile a single template:
-
-```bash
-npx gat build .github/templates/some-workflow.ts
-```
-
 Following the previous example, you should see now a file `.github/workflows/my-first-workflow.yml` like this:
 
 ```yaml

package/dist/step.d.ts

@@ -15,3 +15,4 @@ export interface UseStep extends BaseStep {
     uses: string;
     with?: Record<string, string | number | boolean>;
 }
+export declare const isUseStep: (step: Step) => step is UseStep;

package/dist/step.js

@@ -1,2 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isUseStep = void 0;
+const isUseStep = (step) => {
+    return step.uses !== undefined;
+};
+exports.isUseStep = isUseStep;

package/dist/workflow.d.ts

@@ -1,6 +1,6 @@
 import { ConcurrencyGroup, Job, JobOptions, StringWithNoSpaces } from "./job";
 import type { Event, EventName, EventOptions } from "./event";
-import { BaseStep, Step } from "./step";
+import { Step } from "./step";
 declare const DEFAULT_RUNNERS: string[];
 interface DefaultOptions {
     workingDirectory: string;
@@ -9,7 +9,7 @@ interface EnvVar {
     name: string;
     value: string;
 }
-export declare class Workflow<JobStep extends BaseStep = Step, Runner = typeof DEFAULT_RUNNERS, JobName = never> {
+export declare class Workflow<JobStep extends Step = Step, Runner = typeof DEFAULT_RUNNERS, JobName = never> {
     name: string;
     events: Event[];
     jobs: Array<Job<JobStep, Runner, JobName>>;
@@ -24,6 +24,6 @@ export declare class Workflow<JobStep extends BaseStep = Step, Runner = typeof D
     setConcurrencyGroup(concurrencyGroup: ConcurrencyGroup): this;
     defaultRunner(): string;
     private assignRunner;
-    compile(filepath?: string): string | Promise<void>;
+    compile(filepath?: string): Promise<string | void>;
 }
 export {};

package/dist/workflow.js

@@ -9,8 +9,31 @@ const kebabCase_1 = __importDefault(require("lodash/kebabCase"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const util_1 = require("util");
+const step_1 = require("./step");
 const writeFilePromise = (0, util_1.promisify)(fs_1.default.writeFile);
 const DEFAULT_RUNNERS = ["ubuntu-22.04"];
+const chainAttackCache = {};
+const supplyChainAttack = async (step) => {
+    if (!(0, step_1.isUseStep)(step))
+        return;
+    const uses = step.uses;
+    if (!uses)
+        return uses;
+    if (chainAttackCache[uses])
+        return chainAttackCache[uses];
+    const match = uses.match(/(?<repository>.*)@(?<version>.*)/);
+    if (!match)
+        return uses;
+    const { repository, version } = match.groups;
+    const response = await fetch(`https://api.github.com/repos/${repository}/tags`);
+    const tags = (await response.json());
+    const tag = tags.find((tag) => tag.name === version);
+    if (!tag)
+        return uses;
+    const result = `${repository}@${tag.commit.sha}`;
+    chainAttackCache[uses] = result;
+    return result;
+};
 class Workflow {
     constructor(name) {
         this.name = name;
@@ -47,10 +70,13 @@ class Workflow {
         const isSelfHosted = !DEFAULT_RUNNERS.includes(runnerName);
         return isSelfHosted ? ["self-hosted", runnerName] : runnerName;
     }
-    compile(filepath) {
+    async compile(filepath) {
         const result = {
             name: this.name,
-            on: Object.fromEntries(this.events.map(({ name, options }) => [name, options ? options : null])),
+            on: Object.fromEntries(this.events.map(({ name, options }) => [
+                name,
+                options ? options : null,
+            ])),
             concurrency: this.concurrencyGroup
                 ? {
                     group: this.concurrencyGroup.groupSuffix,
@@ -67,7 +93,7 @@ class Workflow {
             env: this.env.length > 0
                 ? Object.fromEntries(this.env.map(({ name, value }) => [name, value]))
                 : undefined,
-            jobs: Object.fromEntries(this.jobs.map(({ name, options: { prettyName, permissions, ifExpression, runsOn, matrix, env, steps, dependsOn, services, timeout, concurrency, outputs, workingDirectory, }, }) => [
+            jobs: Object.fromEntries(await Promise.all(this.jobs.map(async ({ name, options: { prettyName, permissions, ifExpression, runsOn, matrix, env, steps, dependsOn, services, timeout, concurrency, outputs, workingDirectory, }, }) => [
                 name,
                 {
                     name: prettyName,
@@ -105,18 +131,22 @@ class Workflow {
                             },
                         }
                         : undefined,
-                    steps: steps.map(({ id, name, ifExpression, workingDirectory, continueOnError, timeout, ...options }) => ({
-                        id,
-                        name,
-                        if: ifExpression,
-                        "continue-on-error": continueOnError,
-                        "working-directory": workingDirectory,
-                        "timeout-minutes": timeout,
-                        ...options,
+                    steps: await Promise.all(steps.map(async (step) => {
+                        const { id, name, ifExpression, workingDirectory, continueOnError, timeout, ...options } = step;
+                        return {
+                            id,
+                            name,
+                            if: ifExpression,
+                            "continue-on-error": continueOnError,
+                            "working-directory": workingDirectory,
+                            "timeout-minutes": timeout,
+                            ...options,
+                            uses: await supplyChainAttack(step),
+                        };
                     })),
                     outputs,
                 },
-            ])),
+            ]))),
         };
         const compiled = `# Workflow automatically generated by gat\n# DO NOT CHANGE THIS FILE MANUALLY\n\n${(0, js_yaml_1.dump)(result, {
             noRefs: true,

package/dist/workflow.spec.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const vitest_1 = require("vitest");
 const workflow_1 = require("./workflow");
 (0, vitest_1.describe)("Workflow", () => {
-    (0, vitest_1.it)("generates a simple workflow", () => {
+    (0, vitest_1.it)("generates a simple workflow", async () => {
         const workflow = new workflow_1.Workflow("Simple");
         workflow
             .on("pull_request", { types: ["opened"] })
@@ -14,9 +14,9 @@ const workflow_1 = require("./workflow");
             steps: [{ name: "Do something else", run: "exit 0" }],
             dependsOn: ["job1"],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("allows multiple events", () => {
+    (0, vitest_1.it)("allows multiple events", async () => {
         const workflow = new workflow_1.Workflow("Multiple events");
         workflow
             .on("push", { branches: ["main"] })
@@ -24,9 +24,9 @@ const workflow_1 = require("./workflow");
             .addJob("job1", {
             steps: [{ name: "Do something", run: "exit 0" }],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("allows declaring default options", () => {
+    (0, vitest_1.it)("allows declaring default options", async () => {
         const workflow = new workflow_1.Workflow("Default options");
         workflow
             .on("push", { branches: ["main"] })
@@ -36,9 +36,9 @@ const workflow_1 = require("./workflow");
             .addJob("job1", {
             steps: [{ name: "Do something", run: "exit 0" }],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("allows declaring environment variables", () => {
+    (0, vitest_1.it)("allows declaring environment variables", async () => {
         const workflow = new workflow_1.Workflow("With Environment variables");
         workflow
             .on("push")
@@ -52,9 +52,9 @@ const workflow_1 = require("./workflow");
                 },
             ],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("allows using a concurrency group", () => {
+    (0, vitest_1.it)("allows using a concurrency group", async () => {
         const workflow = new workflow_1.Workflow("Concurrency group");
         workflow.on("push").addJob("job1", {
             concurrency: {
@@ -67,9 +67,9 @@ const workflow_1 = require("./workflow");
                 },
             ],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("allows using outputs", () => {
+    (0, vitest_1.it)("allows using outputs", async () => {
         const workflow = new workflow_1.Workflow("Using outputs");
         workflow.on("push").addJob("job1", {
             steps: [
@@ -82,9 +82,9 @@ const workflow_1 = require("./workflow");
                 "random-number": "${{ steps.random-number.outputs.random-number }}",
             },
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("allows conditional jobs", () => {
+    (0, vitest_1.it)("allows conditional jobs", async () => {
         const workflow = new workflow_1.Workflow("Conditional job");
         workflow.on("push").addJob("job1", {
             ifExpression: "${{ github.ref != 'refs/heads/main' }}",
@@ -94,9 +94,9 @@ const workflow_1 = require("./workflow");
                 },
             ],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("allows a job matrix", () => {
+    (0, vitest_1.it)("allows a job matrix", async () => {
         const workflow = new workflow_1.Workflow("Conditional job");
         workflow.on("push").addJob("job1", {
             matrix: {
@@ -124,9 +124,9 @@ const workflow_1 = require("./workflow");
                 },
             ],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("allows uses steps", () => {
+    (0, vitest_1.it)("allows uses steps", async () => {
         const workflow = new workflow_1.Workflow("Uses steps");
         workflow
             .on("push")
@@ -142,9 +142,9 @@ const workflow_1 = require("./workflow");
                 },
             ],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("allows custom types in a workflow", () => {
+    (0, vitest_1.it)("allows custom types in a workflow", async () => {
         const workflow = new workflow_1.Workflow("With custom types");
         workflow.on("push").addJob("job1", {
             runsOn: "standard-runner",
@@ -160,9 +160,9 @@ const workflow_1 = require("./workflow");
                 },
             ],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("support workflow dispatch event", () => {
+    (0, vitest_1.it)("support workflow dispatch event", async () => {
         const workflow = new workflow_1.Workflow("Workflow dispatch");
         workflow
             .on("workflow_dispatch", {
@@ -181,26 +181,26 @@ const workflow_1 = require("./workflow");
             .addJob("job1", {
             steps: [{ name: "Do something", run: "exit 0" }],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("supports schedule event", () => {
+    (0, vitest_1.it)("supports schedule event", async () => {
         const workflow = new workflow_1.Workflow("Schedule")
             .on("schedule", [{ cron: "0 4 * * 1-5" }])
             .addJob("job1", {
             steps: [{ name: "Do something", run: "exit 0" }],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("supports a pretty name for the job", () => {
+    (0, vitest_1.it)("supports a pretty name for the job", async () => {
         const workflow = new workflow_1.Workflow("Job with pretty name")
             .on("push")
             .addJob("job1", {
             prettyName: "My pretty name",
             steps: [{ name: "Do something", run: "exit 0" }],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("allows permissions into jobs", () => {
+    (0, vitest_1.it)("allows permissions into jobs", async () => {
         const workflow = new workflow_1.Workflow("Job with permissions")
             .on("push")
             .addJob("job1", {
@@ -210,9 +210,9 @@ const workflow_1 = require("./workflow");
             },
             steps: [{ name: "Do something", run: "exit 0" }],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("allows multiline strings", () => {
+    (0, vitest_1.it)("allows multiline strings", async () => {
         const workflow = new workflow_1.Workflow("Multiline strings")
             .on("push")
             .addJob("job1", {
@@ -224,9 +224,9 @@ exit 0`,
                 },
             ],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("allows concurrency groups at workflow level", () => {
+    (0, vitest_1.it)("allows concurrency groups at workflow level", async () => {
         const workflow = new workflow_1.Workflow("Concurrency at workflow level")
             .on("push")
             .setConcurrencyGroup({
@@ -241,6 +241,6 @@ exit 0`,
                 },
             ],
         });
-        (0, vitest_1.expect)(workflow.compile()).toMatchSnapshot();
+        (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factorialco/gat",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "Write your GitHub Actions workflows using TypeScript",
   "bin": {
     "gat": "dist/cli.js"