@git.zone/cli 6.1.2 → 6.2.0

package/ts/mod_release/helpers.npmartifact.ts

@@ -5,7 +5,33 @@ import {
 } from "./classes.releasejournal.js";
 import { assertCredentialFreeGitPushDestination } from "./helpers.releasebranch.js";
 
-const supportedPnpmVersion = "11.25.0";
+const supportedPnpmVersions = ["11.25.0", "12.3.4"] as const;
+const pnpmHelpRequirements = {
+  "11.25.0": {
+    pack: ["--out <path>", "--json"],
+    publish: [
+      "publish [<tarball>|<dir>]",
+      "--no-git-checks",
+      "--ignore-scripts",
+      "--json",
+      "--tag <tag>",
+      "--access <public|restricted>",
+    ],
+  },
+  "12.3.4": {
+    pack: ["Usage: pnpm pack [OPTIONS]", "--out <OUT>", "--json"],
+    publish: [
+      "Usage: pnpm publish [OPTIONS] [PACKAGE]",
+      "Tarball or directory to publish",
+      "--no-git-checks",
+      "--ignore-scripts",
+      "--json",
+      "--tag <TAG>",
+      "--access <ACCESS>",
+      "[possible values: public, restricted]",
+    ],
+  },
+} as const;
 const maximumMetadataResponseBytes = 8 * 1024 * 1024;
 const capabilityCommandTimeoutMs = 30_000;
 const packCommandTimeoutMs = 10 * 60_000;
@@ -13,7 +39,7 @@ const publishCommandTimeoutMs = 5 * 60_000;
 const packageNameRegex = /^(?:@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*|[a-z0-9][a-z0-9._-]*)$/;
 
 export interface IPnpmReleaseCapability {
-  version: typeof supportedPnpmVersion;
+  version: (typeof supportedPnpmVersions)[number];
 }
 
 export type TNpmArtifactProbeStatus =
@@ -72,10 +98,12 @@ const readPackageIdentity = async (
 
 const requireHelpFragments = (
   outputArg: string,
-  fragmentsArg: string[],
+  fragmentsArg: readonly string[],
   commandArg: string,
 ): void => {
-  const missing = fragmentsArg.filter((fragmentArg) => !outputArg.includes(fragmentArg));
+  const missing = fragmentsArg.filter(
+    (fragmentArg) => !outputArg.includes(fragmentArg),
+  );
   if (missing.length > 0) {
     throw new Error(
       `pnpm ${commandArg} is missing required exact-release capabilities: ${missing.join(", ")}.`,
@@ -94,11 +122,15 @@ export const assertPnpmReleaseCapability = async (
     timeoutKillGraceMs: 5_000,
   });
   const version = versionResult.stdout.trim();
-  if (versionResult.exitCode !== 0 || version !== supportedPnpmVersion) {
+  const supportedVersion = supportedPnpmVersions.find(
+    (candidateArg) => candidateArg === version,
+  );
+  if (versionResult.exitCode !== 0 || !supportedVersion) {
     throw new Error(
-      `Exact release packaging requires the verified pnpm ${supportedPnpmVersion}; resolved ${version || "unknown"}.`,
+      `Exact release packaging requires a verified pnpm version (${supportedPnpmVersions.join(", ")}); resolved ${version || "unknown"}.`,
     );
   }
+  const requirements = pnpmHelpRequirements[supportedVersion];
 
   const packHelp = await smartshellArg.execSpawn("pnpm", ["pack", "--help"], {
     cwd: cwdArg,
@@ -109,7 +141,7 @@ export const assertPnpmReleaseCapability = async (
   if (packHelp.exitCode !== 0) {
     throw new Error("Unable to inspect pnpm pack capabilities.");
   }
-  requireHelpFragments(packHelp.combinedOutput, ["--out <path>", "--json"], "pack");
+  requireHelpFragments(packHelp.combinedOutput, requirements.pack, "pack");
 
   const publishHelp = await smartshellArg.execSpawn(
     "pnpm",
@@ -126,17 +158,10 @@ export const assertPnpmReleaseCapability = async (
   }
   requireHelpFragments(
     publishHelp.combinedOutput,
-    [
-      "publish [<tarball>|<dir>]",
-      "--no-git-checks",
-      "--ignore-scripts",
-      "--json",
-      "--tag <tag>",
-      "--access <public|restricted>",
-    ],
+    requirements.publish,
     "publish",
   );
-  return { version: supportedPnpmVersion };
+  return { version: supportedVersion };
 };
 
 const legacyPublishWorkflowPaths = [

package/ts/mod_services/classes.dockercontainer.ts

@@ -60,15 +60,19 @@ export interface IDockerArgvExecutionErrorOptions {
   signal?: NodeJS.Signals;
 }
 
-export interface IFencedBindOperationOptions {
+export interface IFencedBindOperationSpecification {
+  entrypoint: string;
+  command: readonly string[];
+}
+
+export interface IFencedBindOperationOptions extends IFencedBindOperationSpecification {
   image: string;
   hostPath: string;
   containerPath: string;
-  entrypoint: string;
-  command: readonly string[];
   labels: Record<string, string>;
   executionOptions: () => IDockerExecArgvOptions;
   rollbackTimeoutMs?: number;
+  recoverablePredecessors?: readonly IFencedBindOperationSpecification[];
 }
 
 interface IFencedBindRuntimeOptions extends IFencedBindOperationOptions {
@@ -607,16 +611,23 @@ export class DockerContainer {
       inspectionArg.mounts.length === 1 &&
       inspectionArg.mounts[0].source === plugins.path.resolve(optionsArg.hostPath) &&
       inspectionArg.mounts[0].readWrite;
+    const operationMatches = [
+      { entrypoint: optionsArg.entrypoint, command: optionsArg.command },
+      ...(optionsArg.recoverablePredecessors ?? []),
+    ].some(
+      (specificationArg) =>
+        inspectionArg.entrypoint.length === 1 &&
+        inspectionArg.entrypoint[0] === specificationArg.entrypoint &&
+        inspectionArg.command.length === specificationArg.command.length &&
+        inspectionArg.command.every(
+          (entryArg, indexArg) => entryArg === specificationArg.command[indexArg],
+        ),
+    );
     if (
       inspectionArg.name !== expectedNameArg ||
       inspectionArg.image !== optionsArg.image ||
       inspectionArg.user !== '0' ||
-      inspectionArg.entrypoint.length !== 1 ||
-      inspectionArg.entrypoint[0] !== optionsArg.entrypoint ||
-      inspectionArg.command.length !== optionsArg.command.length ||
-      !inspectionArg.command.every(
-        (entryArg, indexArg) => entryArg === optionsArg.command[indexArg],
-      ) ||
+      !operationMatches ||
       !labelsMatch ||
       !mountMatches ||
       inspectionArg.mounts[0].destination !== optionsArg.containerPath

package/ts/mod_services/classes.servicemanager.ts

@@ -1315,8 +1315,11 @@ export class ServiceManager {
       image: objectStorageImage,
       hostPath: dataPath,
       containerPath: '/data',
-      entrypoint: '/bin/chown',
-      command: ['-R', 'objectstorage:objectstorage', '/data'],
+      entrypoint: '/bin/sh',
+      command: [
+        '-c',
+        '/bin/chown -R objectstorage:objectstorage /data && /bin/chmod 0700 /data',
+      ],
       labels: {
         'git.zone.tool': serviceToolLabel,
         'git.zone.service': 'objectstorage',
@@ -1327,6 +1330,12 @@ export class ServiceManager {
       },
       executionOptions: dockerTimeoutArg,
       rollbackTimeoutMs: objectStorageRollbackTimeoutMs,
+      recoverablePredecessors: [
+        {
+          entrypoint: '/bin/chown',
+          command: ['-R', 'objectstorage:objectstorage', '/data'],
+        },
+      ],
     });
     return labels;
   }
@@ -1590,6 +1599,28 @@ export class ServiceManager {
         await this.config.validateObjectStoragePorts();
       }
 
+      if (initialInspection?.status === 'restarting') {
+        logger.log('note', '  Stopping restart loop before securing data...');
+        await this.revalidateObjectStorageContainer(
+          initialInspection.id,
+          containers.objectstorage,
+          expectedLabels,
+          dockerTimeout,
+        );
+        await this.docker.execArgv(['stop', initialInspection.id], dockerTimeout());
+        initialInspection = await this.revalidateObjectStorageContainer(
+          initialInspection.id,
+          containers.objectstorage,
+          expectedLabels,
+          dockerTimeout,
+        );
+        if (initialInspection.running || initialInspection.status === 'restarting') {
+          throw new Error(
+            `ObjectStorage container ${containers.objectstorage} remained in its restart loop.`,
+          );
+        }
+      }
+
       const needsRecreate =
         !!initialInspection &&
         !this.objectStorageConfigurationMatches(initialInspection, expectedLabels);
@@ -1614,6 +1645,7 @@ export class ServiceManager {
           ? 'Recreated with canonical configuration and reconciled'
           : 'Created, started, and reconciled';
       } else if (!initialInspection.running) {
+        await this.prepareObjectStorageDataDirectory(dockerTimeout);
         logger.log('note', '  Starting existing container...');
         activeInspection = initialInspection;
         await startById(activeInspection.id, false);