@factorialco/gat 3.2.1 → 3.3.0

package/dist/job.d.ts

@@ -20,7 +20,7 @@ export interface Service {
     options?: string;
     volumes?: string[];
 }
-export interface BaseJobOptions<RunnerDefinition, Name> {
+export interface StepsJobOptions<Step, RunnerDefinition, Name> {
     prettyName?: string;
     permissions?: object;
     ifExpression?: string;
@@ -33,11 +33,12 @@ export interface BaseJobOptions<RunnerDefinition, Name> {
     matrix?: Matrix | string;
     outputs?: Record<string, string>;
     workingDirectory?: string;
-}
-export interface StepsJobOptions<Step, RunnerDefinition, Name> extends BaseJobOptions<RunnerDefinition, Name> {
     steps: Step[];
 }
-export interface UsesJobOptions<RunnerDefinition, Name> extends BaseJobOptions<RunnerDefinition, Name> {
+export interface UsesJobOptions<Name> {
+    prettyName?: string;
+    dependsOn?: Array<Name>;
+    ifExpression?: string;
     uses: string;
     with?: Record<string, string | number | boolean | object>;
     secrets?: Record<string, string | number | boolean | object> | "inherit";
@@ -45,5 +46,5 @@ export interface UsesJobOptions<RunnerDefinition, Name> extends BaseJobOptions<R
 export type StringWithNoSpaces<T> = T extends `${string} ${string}` ? never : T extends ` ${string}` ? never : T extends `${string} ` ? never : T;
 export interface Job<Step, RunnerDefinition, Name> {
     name: string;
-    options: StepsJobOptions<Step, RunnerDefinition, Name> | UsesJobOptions<RunnerDefinition, Name>;
+    options: StepsJobOptions<Step, RunnerDefinition, Name> | UsesJobOptions<Name>;
 }

package/dist/workflow.d.ts

@@ -8,6 +8,11 @@ interface EnvVar {
     name: string;
     value: string;
 }
+interface CompileOptions {
+    filePath?: string;
+    lockFilePath?: string;
+    writeLockFile?: boolean;
+}
 export type RunnerDefinition = string | {
     group: string;
     labels?: string[];
@@ -22,10 +27,10 @@ export declare class Workflow<JobStep extends Step = Step, Runner extends Runner
     constructor(name: string);
     on<T extends EventName>(name: T, options?: EventOptions<T>): this;
     addDefaults(options: DefaultOptions): this;
-    addJob<T extends string>(name: StringWithNoSpaces<T>, options: StepsJobOptions<JobStep, Runner, JobName> | UsesJobOptions<Runner, JobName>): Workflow<JobStep, Runner, JobName | T>;
+    addJob<T extends string>(name: StringWithNoSpaces<T>, options: StepsJobOptions<JobStep, Runner, JobName> | UsesJobOptions<JobName>): Workflow<JobStep, Runner, JobName | T>;
     setEnv(name: string, value: string): this;
     setConcurrencyGroup(concurrencyGroup: ConcurrencyGroup | null): this;
     defaultRunner(): string;
-    compile(filepath?: string): Promise<string | void>;
+    compile(compileOptions?: CompileOptions): Promise<string | void>;
 }
 export {};

package/dist/workflow.js

@@ -12,28 +12,38 @@ const util_1 = require("util");
 const axios_1 = __importDefault(require("axios"));
 const step_1 = require("./step");
 const writeFilePromise = (0, util_1.promisify)(fs_1.default.writeFile);
-const chainAttackCache = {};
-const supplyChainAttack = async (step, enabled = false) => {
+const supplyChainAttack = async (step, compileOptions) => {
+    const { lockFilePath, writeLockFile = false } = compileOptions;
     if (!(0, step_1.isUseStep)(step))
         return;
-    if (!enabled)
+    // The user is not interested in frozen sha versions
+    if (!lockFilePath)
         return step.uses;
     const uses = step.uses;
-    if (!uses)
-        return uses;
-    if (chainAttackCache[uses])
-        return chainAttackCache[uses];
     const match = uses.match(/(?<repository>.*)@(?<version>.*)/);
+    // The uses is not a valid Github action with a tag
     if (!match)
         return uses;
     const { repository, version } = match.groups;
+    const chainAttackCache = fs_1.default.existsSync(lockFilePath)
+        ? JSON.parse(fs_1.default.readFileSync(lockFilePath, "utf8"))
+        : {};
+    if (chainAttackCache[uses])
+        return chainAttackCache[uses];
+    if (!writeLockFile) {
+        throw new Error(`Unable to retrieve ${uses} from lock file and writeLockFile is false`);
+    }
     const response = await axios_1.default.get(`https://api.github.com/repos/${repository}/tags`);
     const tags = response.data;
     const tag = tags.find((tag) => tag.name === version);
-    if (!tag)
-        return uses;
+    if (!tag) {
+        throw new Error(`Unable to retrieve ${uses} from Github tags`);
+    }
     const result = `${repository}@${tag.commit.sha}`;
     chainAttackCache[uses] = result;
+    if (writeLockFile) {
+        fs_1.default.writeFileSync(lockFilePath, JSON.stringify(chainAttackCache, null, 2));
+    }
     return result;
 };
 class Workflow {
@@ -67,7 +77,7 @@ class Workflow {
     defaultRunner() {
         return "ubuntu-22.04";
     }
-    async compile(filepath) {
+    async compile(compileOptions = {}) {
         const result = {
             name: this.name,
             on: Object.fromEntries(this.events.map(({ name, options }) => [
@@ -91,60 +101,59 @@ class Workflow {
                 ? Object.fromEntries(this.env.map(({ name, value }) => [name, value]))
                 : undefined,
             jobs: Object.fromEntries(await Promise.all(this.jobs.map(async ({ name, options: jobOptions }) => {
-                const { prettyName, permissions, ifExpression, runsOn, matrix, env, dependsOn, services, timeout, concurrency, outputs, workingDirectory, } = jobOptions;
-                const computedOptions = {
-                    name: prettyName,
-                    permissions,
-                    if: ifExpression,
-                    "runs-on": runsOn ?? this.defaultRunner(),
-                    "timeout-minutes": timeout ?? 15,
-                    needs: dependsOn,
-                    services,
-                    concurrency: concurrency
-                        ? {
-                            group: `${(0, kebabCase_1.default)(this.name)}-${name}-${concurrency.groupSuffix}`,
-                            "cancel-in-progress": concurrency.cancelPrevious,
-                        }
-                        : undefined,
-                    strategy: matrix
-                        ? {
-                            "fail-fast": false,
-                            matrix: typeof matrix === "string"
-                                ? matrix
-                                : {
-                                    ...Object.fromEntries(matrix.elements.map(({ id, options }) => [
-                                        id,
-                                        options,
-                                    ])),
-                                    include: matrix.extra,
-                                },
-                        }
-                        : undefined,
-                    env,
-                    defaults: workingDirectory
-                        ? {
-                            run: {
-                                "working-directory": workingDirectory,
-                            },
-                        }
-                        : undefined,
-                };
                 if ("uses" in jobOptions) {
+                    const { prettyName, ifExpression, dependsOn } = jobOptions;
                     return [
                         name,
                         {
-                            ...computedOptions,
+                            name: prettyName,
+                            if: ifExpression,
+                            needs: dependsOn,
                             uses: jobOptions.uses,
                             with: jobOptions.with,
                             secrets: jobOptions.secrets,
-                            outputs,
                         },
                     ];
                 }
+                const { prettyName, permissions, ifExpression, runsOn, matrix, env, dependsOn, services, timeout, concurrency, outputs, workingDirectory, } = jobOptions;
                 return [
                     name,
                     {
-                        ...computedOptions,
+                        name: prettyName,
+                        permissions,
+                        if: ifExpression,
+                        "runs-on": runsOn ?? this.defaultRunner(),
+                        "timeout-minutes": timeout ?? 15,
+                        needs: dependsOn,
+                        services,
+                        concurrency: concurrency
+                            ? {
+                                group: `${(0, kebabCase_1.default)(this.name)}-${name}-${concurrency.groupSuffix}`,
+                                "cancel-in-progress": concurrency.cancelPrevious,
+                            }
+                            : undefined,
+                        strategy: matrix
+                            ? {
+                                "fail-fast": false,
+                                matrix: typeof matrix === "string"
+                                    ? matrix
+                                    : {
+                                        ...Object.fromEntries(matrix.elements.map(({ id, options }) => [
+                                            id,
+                                            options,
+                                        ])),
+                                        include: matrix.extra,
+                                    },
+                            }
+                            : undefined,
+                        env,
+                        defaults: workingDirectory
+                            ? {
+                                run: {
+                                    "working-directory": workingDirectory,
+                                },
+                            }
+                            : undefined,
                         steps: await Promise.all(jobOptions.steps.map(async (step) => {
                             const { id, name, ifExpression, workingDirectory, continueOnError, timeout, ...options } = step;
                             return {
@@ -155,7 +164,7 @@ class Workflow {
                                 "working-directory": workingDirectory,
                                 "timeout-minutes": timeout,
                                 ...options,
-                                uses: await supplyChainAttack(step),
+                                uses: await supplyChainAttack(step, compileOptions),
                             };
                         })),
                         outputs,
@@ -168,9 +177,9 @@ class Workflow {
             lineWidth: 200,
             noCompatMode: true,
         })}`;
-        if (!filepath)
+        if (!compileOptions.filePath)
             return compiled;
-        return writeFilePromise(path_1.default.join(process.cwd(), ".github", "workflows", filepath), compiled);
+        return writeFilePromise(path_1.default.join(process.cwd(), ".github", "workflows", compileOptions.filePath), compiled);
     }
 }
 exports.Workflow = Workflow;

package/dist/workflow.spec.js

@@ -1,7 +1,11 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const vitest_1 = require("vitest");
 const workflow_1 = require("./workflow");
+const fs_1 = __importDefault(require("fs"));
 (0, vitest_1.describe)("Workflow", () => {
     (0, vitest_1.it)("generates a simple workflow", async () => {
         const workflow = new workflow_1.Workflow("Simple");
@@ -278,4 +282,31 @@ exit 0`,
         });
         (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
+    (0, vitest_1.it)("supports supply chain attack, without writing the lock file", async () => {
+        const workflow = new workflow_1.Workflow("Supply chain attack");
+        workflow.on("push").addJob("job1", {
+            steps: [
+                { name: "Do something", uses: "tj-actions/changed-files@v45.0.7" },
+            ],
+        });
+        fs_1.default.writeFileSync("/tmp/lockfile1.json", JSON.stringify({
+            "tj-actions/changed-files@v45.0.7": "tj-actions/changed-files@youhavebeenhacked",
+        }, null, 2));
+        (0, vitest_1.expect)(await workflow.compile({
+            lockFilePath: "/tmp/lockfile1.json",
+            writeLockFile: false,
+        })).toMatchSnapshot();
+    });
+    (0, vitest_1.it)("supports supply chain attack, with writing the lock file", async () => {
+        const workflow = new workflow_1.Workflow("Supply chain attack");
+        workflow.on("push").addJob("job1", {
+            steps: [
+                { name: "Do something", uses: "tj-actions/changed-files@v45.0.7" },
+            ],
+        });
+        (0, vitest_1.expect)(await workflow.compile({
+            lockFilePath: "/tmp/lockfile2.json",
+            writeLockFile: true,
+        })).toMatchSnapshot();
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factorialco/gat",
-  "version": "3.2.1",
+  "version": "3.3.0",
   "description": "Write your GitHub Actions workflows using TypeScript",
   "bin": {
     "gat": "dist/cli.js"
@@ -33,7 +33,7 @@
     "eslint": "^8.23.0",
     "eslint-config-prettier": "^9.0.0",
     "prettier": "^3.0.3",
-    "tsx": "^3.14.0",
+    "tsx": "^4.19.3",
     "typescript": "^5.2.2",
     "vitest": "^0.34.6"
   },