@factorialco/gat 3.3.0 → 3.4.0

package/dist/template.d.ts

@@ -0,0 +1,8 @@
+import { Workflow } from "./workflow";
+interface CompileOptions {
+    templates: Record<string, Workflow>;
+    lockFilePath: string;
+    writeLockFile: boolean;
+}
+export declare const compileTemplates: (options: CompileOptions) => Promise<(string | void)[]>;
+export {};

package/dist/template.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compileTemplates = void 0;
+const fs_1 = __importDefault(require("fs"));
+const rest_1 = require("@octokit/rest");
+const createLockFile = async (templates, lockFilePath) => {
+    const actions = Object.values(templates).reduce((acc, template) => {
+        template.jobs.forEach((job) => {
+            if ("steps" in job.options) {
+                job.options.steps.forEach((step) => {
+                    if ("uses" in step) {
+                        acc.push(step.uses);
+                    }
+                });
+            }
+        });
+        return acc;
+    }, []);
+    const uniqueActions = [...new Set(actions)];
+    const octokit = process.env.GITHUB_TOKEN
+        ? new rest_1.Octokit({
+            auth: process.env.GITHUB_TOKEN,
+        })
+        : new rest_1.Octokit();
+    const resolvedActions = {};
+    await Promise.all(uniqueActions.map(async (action) => {
+        const match = action.match(/(?<repository>.*)@(?<version>.*)/);
+        if (!match)
+            return;
+        const { repository, version } = match.groups;
+        const [owner, repo] = repository.split("/");
+        const response = await octokit.rest.repos.listTags({
+            owner,
+            repo,
+        });
+        const tag = response.data.find((tag) => tag.name === version);
+        if (!tag) {
+            throw new Error(`Unable to retrieve ${action} from Github tags`);
+        }
+        resolvedActions[action] = `${repository}@${tag.commit.sha}`;
+    }));
+    fs_1.default.writeFileSync(lockFilePath, JSON.stringify(resolvedActions, null, 2));
+};
+const compileTemplates = async (options) => {
+    const { templates, lockFilePath, writeLockFile } = options;
+    if (writeLockFile) {
+        await createLockFile(templates, lockFilePath);
+    }
+    const resolvedActions = fs_1.default.existsSync(lockFilePath)
+        ? JSON.parse(fs_1.default.readFileSync(lockFilePath, "utf8"))
+        : {};
+    return Promise.all(Object.entries(templates).map(([filePath, template]) => template.compile({ filePath, resolvedActions })));
+};
+exports.compileTemplates = compileTemplates;

package/dist/workflow.d.ts

@@ -1,5 +1,5 @@
-import { ConcurrencyGroup, Job, StepsJobOptions, StringWithNoSpaces, UsesJobOptions } from "./job";
 import type { Event, EventName, EventOptions } from "./event";
+import { ConcurrencyGroup, Job, StepsJobOptions, StringWithNoSpaces, UsesJobOptions } from "./job";
 import { type Step } from "./step";
 interface DefaultOptions {
     workingDirectory: string;
@@ -8,10 +8,9 @@ interface EnvVar {
     name: string;
     value: string;
 }
-interface CompileOptions {
+interface WorkflowCompileOptions {
     filePath?: string;
-    lockFilePath?: string;
-    writeLockFile?: boolean;
+    resolvedActions?: Record<string, string>;
 }
 export type RunnerDefinition = string | {
     group: string;
@@ -31,6 +30,6 @@ export declare class Workflow<JobStep extends Step = Step, Runner extends Runner
     setEnv(name: string, value: string): this;
     setConcurrencyGroup(concurrencyGroup: ConcurrencyGroup | null): this;
     defaultRunner(): string;
-    compile(compileOptions?: CompileOptions): Promise<string | void>;
+    compile(compileOptions?: WorkflowCompileOptions): Promise<string | void>;
 }
 export {};

package/dist/workflow.js

@@ -4,47 +4,18 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Workflow = void 0;
+const fs_1 = __importDefault(require("fs"));
 const js_yaml_1 = require("js-yaml");
 const kebabCase_1 = __importDefault(require("lodash/kebabCase"));
-const fs_1 = __importDefault(require("fs"));
 const path_1 = __importDefault(require("path"));
 const util_1 = require("util");
-const axios_1 = __importDefault(require("axios"));
 const step_1 = require("./step");
 const writeFilePromise = (0, util_1.promisify)(fs_1.default.writeFile);
-const supplyChainAttack = async (step, compileOptions) => {
-    const { lockFilePath, writeLockFile = false } = compileOptions;
+const supplyChainAttack = async (step, resolvedActions) => {
     if (!(0, step_1.isUseStep)(step))
         return;
-    // The user is not interested in frozen sha versions
-    if (!lockFilePath)
-        return step.uses;
     const uses = step.uses;
-    const match = uses.match(/(?<repository>.*)@(?<version>.*)/);
-    // The uses is not a valid Github action with a tag
-    if (!match)
-        return uses;
-    const { repository, version } = match.groups;
-    const chainAttackCache = fs_1.default.existsSync(lockFilePath)
-        ? JSON.parse(fs_1.default.readFileSync(lockFilePath, "utf8"))
-        : {};
-    if (chainAttackCache[uses])
-        return chainAttackCache[uses];
-    if (!writeLockFile) {
-        throw new Error(`Unable to retrieve ${uses} from lock file and writeLockFile is false`);
-    }
-    const response = await axios_1.default.get(`https://api.github.com/repos/${repository}/tags`);
-    const tags = response.data;
-    const tag = tags.find((tag) => tag.name === version);
-    if (!tag) {
-        throw new Error(`Unable to retrieve ${uses} from Github tags`);
-    }
-    const result = `${repository}@${tag.commit.sha}`;
-    chainAttackCache[uses] = result;
-    if (writeLockFile) {
-        fs_1.default.writeFileSync(lockFilePath, JSON.stringify(chainAttackCache, null, 2));
-    }
-    return result;
+    return resolvedActions[uses] ?? uses;
 };
 class Workflow {
     constructor(name) {
@@ -164,7 +135,7 @@ class Workflow {
                                 "working-directory": workingDirectory,
                                 "timeout-minutes": timeout,
                                 ...options,
-                                uses: await supplyChainAttack(step, compileOptions),
+                                uses: await supplyChainAttack(step, compileOptions.resolvedActions ?? {}),
                             };
                         })),
                         outputs,

package/dist/workflow.spec.js

@@ -1,11 +1,7 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 const vitest_1 = require("vitest");
 const workflow_1 = require("./workflow");
-const fs_1 = __importDefault(require("fs"));
 (0, vitest_1.describe)("Workflow", () => {
     (0, vitest_1.it)("generates a simple workflow", async () => {
         const workflow = new workflow_1.Workflow("Simple");
@@ -282,31 +278,17 @@ exit 0`,
         });
         (0, vitest_1.expect)(await workflow.compile()).toMatchSnapshot();
     });
-    (0, vitest_1.it)("supports supply chain attack, without writing the lock file", async () => {
+    (0, vitest_1.it)("supports supply chain attack", async () => {
         const workflow = new workflow_1.Workflow("Supply chain attack");
         workflow.on("push").addJob("job1", {
             steps: [
                 { name: "Do something", uses: "tj-actions/changed-files@v45.0.7" },
             ],
         });
-        fs_1.default.writeFileSync("/tmp/lockfile1.json", JSON.stringify({
-            "tj-actions/changed-files@v45.0.7": "tj-actions/changed-files@youhavebeenhacked",
-        }, null, 2));
         (0, vitest_1.expect)(await workflow.compile({
-            lockFilePath: "/tmp/lockfile1.json",
-            writeLockFile: false,
-        })).toMatchSnapshot();
-    });
-    (0, vitest_1.it)("supports supply chain attack, with writing the lock file", async () => {
-        const workflow = new workflow_1.Workflow("Supply chain attack");
-        workflow.on("push").addJob("job1", {
-            steps: [
-                { name: "Do something", uses: "tj-actions/changed-files@v45.0.7" },
-            ],
-        });
-        (0, vitest_1.expect)(await workflow.compile({
-            lockFilePath: "/tmp/lockfile2.json",
-            writeLockFile: true,
+            resolvedActions: {
+                "tj-actions/changed-files@v45.0.7": "tj-actions/changed-files@youhavebeenhacked",
+            },
         })).toMatchSnapshot();
     });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@factorialco/gat",
-  "version": "3.3.0",
+  "version": "3.4.0",
   "description": "Write your GitHub Actions workflows using TypeScript",
   "bin": {
     "gat": "dist/cli.js"
@@ -38,7 +38,7 @@
     "vitest": "^0.34.6"
   },
   "dependencies": {
-    "axios": "^1.6.0",
+    "@octokit/rest": "^21.1.1",
     "js-yaml": "^4.1.0",
     "lodash": "^4.17.21"
   },