@factorialco/gat 3.2.2 → 3.3.1

package/dist/workflow.d.ts

@@ -8,6 +8,11 @@ interface EnvVar {
     name: string;
     value: string;
 }
+interface CompileOptions {
+    filePath?: string;
+    lockFilePath?: string;
+    writeLockFile?: boolean;
+}
 export type RunnerDefinition = string | {
     group: string;
     labels?: string[];
@@ -26,6 +31,6 @@ export declare class Workflow<JobStep extends Step = Step, Runner extends Runner
     setEnv(name: string, value: string): this;
     setConcurrencyGroup(concurrencyGroup: ConcurrencyGroup | null): this;
     defaultRunner(): string;
-    compile(filepath?: string): Promise<string | void>;
+    compile(compileOptions?: CompileOptions): Promise<string | void>;
 }
 export {};

package/dist/workflow.js

@@ -9,31 +9,54 @@ const kebabCase_1 = __importDefault(require("lodash/kebabCase"));
 const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const util_1 = require("util");
-const axios_1 = __importDefault(require("axios"));
+const rest_1 = require("@octokit/rest");
 const step_1 = require("./step");
 const writeFilePromise = (0, util_1.promisify)(fs_1.default.writeFile);
-const chainAttackCache = {};
-const supplyChainAttack = async (step, enabled = false) => {
+let firstCompileCall = true;
+const supplyChainAttack = async (step, compileOptions) => {
+    const { lockFilePath, writeLockFile = false } = compileOptions;
     if (!(0, step_1.isUseStep)(step))
         return;
-    if (!enabled)
+    // The user is not interested in frozen sha versions
+    if (!lockFilePath)
         return step.uses;
     const uses = step.uses;
-    if (!uses)
-        return uses;
-    if (chainAttackCache[uses])
-        return chainAttackCache[uses];
     const match = uses.match(/(?<repository>.*)@(?<version>.*)/);
+    // The uses is not a valid Github action with a tag
     if (!match)
         return uses;
     const { repository, version } = match.groups;
-    const response = await axios_1.default.get(`https://api.github.com/repos/${repository}/tags`);
-    const tags = response.data;
-    const tag = tags.find((tag) => tag.name === version);
-    if (!tag)
-        return uses;
+    if (firstCompileCall && writeLockFile && fs_1.default.existsSync(lockFilePath)) {
+        firstCompileCall = false;
+        fs_1.default.rmSync(lockFilePath);
+    }
+    const chainAttackCache = fs_1.default.existsSync(lockFilePath)
+        ? JSON.parse(fs_1.default.readFileSync(lockFilePath, "utf8"))
+        : {};
+    if (chainAttackCache[uses])
+        return chainAttackCache[uses];
+    if (!writeLockFile) {
+        throw new Error(`Unable to retrieve ${uses} from lock file and writeLockFile is false`);
+    }
+    const [owner, repo] = repository.split("/");
+    const octokit = process.env.GITHUB_TOKEN
+        ? new rest_1.Octokit({
+            auth: process.env.GITHUB_TOKEN,
+        })
+        : new rest_1.Octokit();
+    const response = await octokit.rest.repos.listTags({
+        owner,
+        repo,
+    });
+    const tag = response.data.find((tag) => tag.name === version);
+    if (!tag) {
+        throw new Error(`Unable to retrieve ${uses} from Github tags`);
+    }
     const result = `${repository}@${tag.commit.sha}`;
     chainAttackCache[uses] = result;
+    if (writeLockFile) {
+        fs_1.default.writeFileSync(lockFilePath, JSON.stringify(chainAttackCache, null, 2));
+    }
     return result;
 };
 class Workflow {
@@ -67,7 +90,7 @@ class Workflow {
     defaultRunner() {
         return "ubuntu-22.04";
     }
-    async compile(filepath) {
+    async compile(compileOptions = {}) {
         const result = {
             name: this.name,
             on: Object.fromEntries(this.events.map(({ name, options }) => [
@@ -154,7 +177,7 @@ class Workflow {
                                 "working-directory": workingDirectory,
                                 "timeout-minutes": timeout,
                                 ...options,
-                                uses: await supplyChainAttack(step),
+                                uses: await supplyChainAttack(step, compileOptions),
                             };
                         })),
                         outputs,
@@ -167,9 +190,9 @@ class Workflow {
             lineWidth: 200,
             noCompatMode: true,
         })}`;
-        if (!filepath)
+        if (!compileOptions.filePath)
             return compiled;
-        return writeFilePromise(path_1.default.join(process.cwd(), ".github", "workflows", filepath), compiled);
+        return writeFilePromise(path_1.default.join(process.cwd(), ".github", "workflows", compileOptions.filePath), compiled);
     }
 }
 exports.Workflow = Workflow;

package/dist/workflow.spec.js

@@ -1,7 +1,11 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 const vitest_1 = require("vitest");
 const workflow_1 = require("./workflow");
+const fs_1 = __importDefault(require("fs"));
 (0, vitest_1.describe)("Workflow", () => {
     (0, vitest_1.it)("generates a simple workflow", async () => {
         const workflow = new workflow_1.Workflow("Simple");
@@ -278,4 +282,31 @@ exit 0`,
         });
         (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
+    (0, vitest_1.it)("supports supply chain attack, without writing the lock file", async () => {
+        const workflow = new workflow_1.Workflow("Supply chain attack");
+        workflow.on("push").addJob("job1", {
+            steps: [
+                { name: "Do something", uses: "tj-actions/changed-files@v45.0.7" },
+            ],
+        });
+        fs_1.default.writeFileSync("/tmp/lockfile1.json", JSON.stringify({
+            "tj-actions/changed-files@v45.0.7": "tj-actions/changed-files@youhavebeenhacked",
+        }, null, 2));
+        (0, vitest_1.expect)(await workflow.compile({
+            lockFilePath: "/tmp/lockfile1.json",
+            writeLockFile: false,
+        })).toMatchSnapshot();
+    });
+    (0, vitest_1.it)("supports supply chain attack, with writing the lock file", async () => {
+        const workflow = new workflow_1.Workflow("Supply chain attack");
+        workflow.on("push").addJob("job1", {
+            steps: [
+                { name: "Do something", uses: "tj-actions/changed-files@v45.0.7" },
+            ],
+        });
+        (0, vitest_1.expect)(await workflow.compile({
+            lockFilePath: "/tmp/lockfile2.json",
+            writeLockFile: true,
+        })).toMatchSnapshot();
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factorialco/gat",
-  "version": "3.2.2",
+  "version": "3.3.1",
   "description": "Write your GitHub Actions workflows using TypeScript",
   "bin": {
     "gat": "dist/cli.js"
@@ -33,12 +33,12 @@
     "eslint": "^8.23.0",
     "eslint-config-prettier": "^9.0.0",
     "prettier": "^3.0.3",
-    "tsx": "^3.14.0",
+    "tsx": "^4.19.3",
     "typescript": "^5.2.2",
     "vitest": "^0.34.6"
   },
   "dependencies": {
-    "axios": "^1.6.0",
+    "@octokit/rest": "^21.1.1",
     "js-yaml": "^4.1.0",
     "lodash": "^4.17.21"
   },