@intentius/chant 0.13.1 → 0.15.1

package/src/components/config-defaults.test.ts

@@ -0,0 +1,263 @@
+import { describe, test, expect } from "vitest";
+import { applyConfigDefaults } from "./config-defaults";
+import type { DriverComponent } from "./driver";
+import type { ChantConfig } from "../config";
+
+function component(deploy: DriverComponent["deploy"]): DriverComponent {
+  return { name: "svc", dependsOn: [], deploy };
+}
+
+describe("applyConfigDefaults", () => {
+  test("generate-sbom: picks up sbom.format from config when the step omits it", () => {
+    const config: ChantConfig = { sbom: { format: "cyclonedx" } };
+    const comp = component([
+      { phase: "Build", steps: [{ kind: "generate-sbom", artifactType: "image", path: "img" }] },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { format?: string };
+    expect(step.format).toBe("cyclonedx");
+  });
+
+  test("generate-sbom: a step's own format overrides config", () => {
+    const config: ChantConfig = { sbom: { format: "cyclonedx" } };
+    const comp = component([
+      { phase: "Build", steps: [{ kind: "generate-sbom", artifactType: "image", path: "img", format: "spdx" }] },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { format?: string };
+    expect(step.format).toBe("spdx");
+  });
+
+  test("generate-sbom: falls back to DEFAULT_SBOM_FORMAT when neither step nor config sets it", () => {
+    const config: ChantConfig = {};
+    const comp = component([
+      { phase: "Build", steps: [{ kind: "generate-sbom", artifactType: "image", path: "img" }] },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { format?: string };
+    expect(step.format).toBe("spdx");
+  });
+
+  test("sign: fills keyless oidcIssuer from config's signing.oidcIssuer", () => {
+    const config: ChantConfig = { signing: { oidcIssuer: "https://token.actions.githubusercontent.com" } };
+    const comp = component([
+      { phase: "Publish", steps: [{ kind: "sign", imageRef: "repo@sha256:abc" }] },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { keyless?: { oidcIssuer?: string } };
+    expect(step.keyless?.oidcIssuer).toBe("https://token.actions.githubusercontent.com");
+  });
+
+  test("sign: a step's own keyless config is left untouched", () => {
+    const config: ChantConfig = { signing: { oidcIssuer: "https://token.actions.githubusercontent.com" } };
+    const comp = component([
+      {
+        phase: "Publish",
+        steps: [{ kind: "sign", imageRef: "repo@sha256:abc", keyless: { oidcIssuer: "https://custom.example.com" } }],
+      },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { keyless?: { oidcIssuer?: string } };
+    expect(step.keyless?.oidcIssuer).toBe("https://custom.example.com");
+  });
+
+  test("sign: a step's own key opts out of config keyless defaults entirely", () => {
+    const config: ChantConfig = { signing: { oidcIssuer: "https://token.actions.githubusercontent.com" } };
+    const comp = component([
+      { phase: "Publish", steps: [{ kind: "sign", imageRef: "repo@sha256:abc", key: { key: "kms://my-key" } }] },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { key?: { key: string }; keyless?: unknown };
+    expect(step.key).toEqual({ key: "kms://my-key" });
+    expect(step.keyless).toBeUndefined();
+  });
+
+  test("sign: config's key-based override (keyless: false + key) fills the step's key", () => {
+    const config: ChantConfig = { signing: { keyless: false, key: "kms://project-key" } };
+    const comp = component([
+      { phase: "Publish", steps: [{ kind: "sign", imageRef: "repo@sha256:abc" }] },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { key?: { key: string } };
+    expect(step.key).toEqual({ key: "kms://project-key" });
+  });
+
+  test("attest-provenance: also picks up the configured oidcIssuer", () => {
+    const config: ChantConfig = { signing: { oidcIssuer: "https://token.actions.githubusercontent.com" } };
+    const comp = component([
+      {
+        phase: "Publish",
+        steps: [{
+          kind: "attest-provenance",
+          imageRef: "repo@sha256:abc",
+          provenance: { sourceRef: "git@abc", artifactDigest: "sha256:abc" },
+          builderId: "https://github.com/actions/runner",
+        }],
+      },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { keyless?: { oidcIssuer?: string } };
+    expect(step.keyless?.oidcIssuer).toBe("https://token.actions.githubusercontent.com");
+  });
+
+  test("verify: fills expectedIssuer/expectedIdentity from config's signing section without repeating them per-step", () => {
+    const config: ChantConfig = {
+      signing: {
+        oidcIssuer: "https://token.actions.githubusercontent.com",
+        identity: "https://github.com/acme/repo/.github/workflows/release.yml@refs/heads/main",
+      },
+    };
+    const comp = component([
+      { phase: "Verify", steps: [{ kind: "verify", imageRef: "repo@sha256:abc", policy: {} }] },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as {
+      policy?: { expectedIssuer?: string; expectedIdentity?: string };
+    };
+    expect(step.policy?.expectedIssuer).toBe("https://token.actions.githubusercontent.com");
+    expect(step.policy?.expectedIdentity).toBe(
+      "https://github.com/acme/repo/.github/workflows/release.yml@refs/heads/main",
+    );
+  });
+
+  test("verify: a per-step policy value overrides config", () => {
+    const config: ChantConfig = {
+      signing: {
+        oidcIssuer: "https://token.actions.githubusercontent.com",
+        identity: "https://github.com/acme/repo/.github/workflows/release.yml@refs/heads/main",
+      },
+    };
+    const comp = component([
+      {
+        phase: "Verify",
+        steps: [{
+          kind: "verify",
+          imageRef: "repo@sha256:abc",
+          policy: { expectedIssuer: "https://custom-issuer.example.com" },
+        }],
+      },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { policy?: { expectedIssuer?: string; expectedIdentity?: string } };
+    expect(step.policy?.expectedIssuer).toBe("https://custom-issuer.example.com");
+    // Untouched field still fills from config.
+    expect(step.policy?.expectedIdentity).toBe(
+      "https://github.com/acme/repo/.github/workflows/release.yml@refs/heads/main",
+    );
+  });
+
+  test("verify: a step with no policy field at all still gets one filled from config", () => {
+    const config: ChantConfig = { signing: { oidcIssuer: "https://issuer.example.com", identity: "id" } };
+    const comp = component([
+      { phase: "Verify", steps: [{ kind: "verify", imageRef: "repo@sha256:abc" }] },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { policy?: { expectedIssuer?: string } };
+    expect(step.policy?.expectedIssuer).toBe("https://issuer.example.com");
+  });
+
+  test("vuln-gate: a vulnPolicy in config changes the step's effective policy", () => {
+    const config: ChantConfig = { vulnPolicy: { failSeverity: "high", warnSeverity: "medium" } };
+    const comp = component([
+      { phase: "Gate", steps: [{ kind: "vuln-gate", sbom: { bytes: "", mediaType: "", packageCount: 0, generator: "x", format: "spdx" } }] },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { policy?: { failSeverity?: string; warnSeverity?: string } };
+    expect(step.policy?.failSeverity).toBe("high");
+    expect(step.policy?.warnSeverity).toBe("medium");
+  });
+
+  test("vuln-gate: the step's own policy field wins over config for that field", () => {
+    const config: ChantConfig = { vulnPolicy: { failSeverity: "high", warnSeverity: "medium" } };
+    const comp = component([
+      {
+        phase: "Gate",
+        steps: [{
+          kind: "vuln-gate",
+          sbom: { bytes: "", mediaType: "", packageCount: 0, generator: "x", format: "spdx" },
+          policy: { failSeverity: "critical" },
+        }],
+      },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.deploy[0]!.steps[0] as { policy?: { failSeverity?: string; warnSeverity?: string } };
+    // Step wins on the field it set...
+    expect(step.policy?.failSeverity).toBe("critical");
+    // ...but config still fills the field the step left unset.
+    expect(step.policy?.warnSeverity).toBe("medium");
+  });
+
+  test("recurses into nested fan-out phases and onFailure compensation phases", () => {
+    const config: ChantConfig = { sbom: { format: "cyclonedx" } };
+    const comp = component([
+      {
+        phase: "Rollout",
+        steps: [
+          {
+            phase: "instance-1",
+            steps: [{ kind: "generate-sbom", artifactType: "image", path: "img" }],
+          },
+        ],
+        onFailure: [
+          { phase: "Compensate", steps: [{ kind: "generate-sbom", artifactType: "image", path: "img2" }] },
+        ],
+      },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    const nested = result.deploy[0]!.steps[0] as { steps: Array<{ format?: string }> };
+    expect(nested.steps[0]!.format).toBe("cyclonedx");
+    const compensated = result.deploy[0]!.onFailure![0]!.steps[0] as { format?: string };
+    expect(compensated.format).toBe("cyclonedx");
+  });
+
+  test("leaves gate steps untouched", () => {
+    const config: ChantConfig = { sbom: { format: "cyclonedx" } };
+    const comp = component([
+      { phase: "Approve", steps: [{ kind: "gate", signalName: "release-approval" }] },
+    ]);
+
+    const result = applyConfigDefaults(comp, config);
+    expect(result.deploy[0]!.steps[0]).toEqual({ kind: "gate", signalName: "release-approval" });
+  });
+
+  test("applies defaults to rollback phases too", () => {
+    const config: ChantConfig = { vulnPolicy: { failSeverity: "high" } };
+    const comp: DriverComponent = {
+      name: "svc",
+      dependsOn: [],
+      deploy: [{ phase: "Apply", steps: [{ kind: "deploy-thing" }] }],
+      rollback: [
+        { phase: "Rollback", steps: [{ kind: "vuln-gate", sbom: { bytes: "", mediaType: "", packageCount: 0, generator: "x", format: "spdx" } }] },
+      ],
+    };
+
+    const result = applyConfigDefaults(comp, config);
+    const step = result.rollback![0]!.steps[0] as { policy?: { failSeverity?: string } };
+    expect(step.policy?.failSeverity).toBe("high");
+  });
+
+  test("does not mutate the original component", () => {
+    const config: ChantConfig = { sbom: { format: "cyclonedx" } };
+    const comp = component([
+      { phase: "Build", steps: [{ kind: "generate-sbom", artifactType: "image", path: "img" }] },
+    ]);
+
+    applyConfigDefaults(comp, config);
+    const original = comp.deploy[0]!.steps[0] as { format?: string };
+    expect(original.format).toBeUndefined();
+  });
+});

package/src/components/config-defaults.ts

@@ -0,0 +1,145 @@
+/**
+ * Config-defaults pass (#629, epic #551 follow-up to #606/#622/#626) — the
+ * missing link between `chant.config.ts`'s `sbom`/`signing`/`vulnPolicy`
+ * sections and the steps that actually consume them.
+ *
+ * Before this module, `resolveSigningDefaults`/`resolveVulnPolicy`
+ * (../config.ts) were never called anywhere in the `chant run --components`
+ * path, and `resolveSbomFormat` was only ever called in post-hoc display
+ * code. A component author had to hand-code `format`/`keyless`/`oidcIssuer`/
+ * `policy` into every `generate-sbom`/`sign`/`attest-provenance`/`verify`/
+ * `vuln-gate` step, even when the project already declared a project-wide
+ * default in `chant.config.ts` — the config sections were decorative.
+ *
+ * `applyConfigDefaults` walks a `DriverComponent`'s `deploy` composition
+ * (including nested fan-out phases and `onFailure` compensation phases) and
+ * returns a new component with each recognized step's config-driven fields
+ * filled in *only where the step didn't already set them* — per-step value
+ * wins over config wins over the capability's own built-in default, the
+ * precedence every one of the `resolve*` docstrings in ../config.ts already
+ * claims. This module is the caller that finally makes that claim true.
+ *
+ * Kept entirely outside `./driver.ts`: the driver stays capability-agnostic
+ * (it dispatches by `kind` and knows nothing about `sbom`/`signing`/
+ * `vulnPolicy`) — this pass transforms the component's plain-data composition
+ * *before* it ever reaches the driver, the same "resolve config, then hand a
+ * capability-agnostic caller a fully-formed input" convention `resolveSbomFormat`'s
+ * own docstring already describes for its callers.
+ */
+
+import type { ChantConfig } from "../config";
+import { resolveSbomFormat, resolveSigningDefaults, resolveVulnPolicy } from "../config";
+import type { DriverComponent, DriverGate, DriverPhase, DriverStep } from "./driver";
+
+function isGateStep(step: DriverStep | DriverGate | DriverPhase): step is DriverGate {
+  return (step as { kind?: unknown }).kind === "gate";
+}
+
+function isPhaseStep(step: DriverStep | DriverGate | DriverPhase): step is DriverPhase {
+  return typeof (step as { phase?: unknown }).phase === "string" && Array.isArray((step as DriverPhase).steps);
+}
+
+/**
+ * Fill one step's config-resolved defaults in place (into a shallow clone),
+ * per its `kind` — the only place this module branches on capability kind,
+ * matching how `../verbs/sbom.ts`'s `generate` is the only branch point for
+ * artifact type. Fields the step already set are never overwritten.
+ */
+function applyStepDefaults(step: DriverStep, config: ChantConfig): DriverStep {
+  switch (step.kind) {
+    case "generate-sbom": {
+      const format = (step as { format?: unknown }).format as
+        | Parameters<typeof resolveSbomFormat>[1]
+        | undefined;
+      return { ...step, format: resolveSbomFormat(config, format) };
+    }
+
+    case "sign":
+    case "attest-provenance": {
+      const defaults = resolveSigningDefaults(config);
+      const next: DriverStep = { ...step };
+      // Only fill `keyless`/`key` when the step didn't already declare its own
+      // signing method — an explicit `key` (or `keyless`) on the step always
+      // wins over the project default, mirroring `resolveSigningDefaults`'s
+      // own "caller supplies any per-call override" contract.
+      if (next.keyless === undefined && next.key === undefined) {
+        if (!defaults.keyless && defaults.key) {
+          next.key = defaults.key;
+        } else if (defaults.identityPolicyDefaults.expectedIssuer !== undefined) {
+          // Keyless flow: thread the configured OIDC issuer through as a
+          // `keyless` override so `cosign sign/attest --oidc-issuer` picks it
+          // up, without clobbering any keyless sub-fields the step itself set.
+          const existingKeyless = (next.keyless as Record<string, unknown> | undefined) ?? {};
+          next.keyless = { oidcIssuer: defaults.identityPolicyDefaults.expectedIssuer, ...existingKeyless };
+        }
+      }
+      return next;
+    }
+
+    case "verify": {
+      const defaults = resolveSigningDefaults(config).identityPolicyDefaults;
+      const existingPolicy = (step.policy as Record<string, unknown> | undefined) ?? {};
+      const policy: Record<string, unknown> = { ...existingPolicy };
+      if (policy.expectedIssuer === undefined && defaults.expectedIssuer !== undefined) {
+        policy.expectedIssuer = defaults.expectedIssuer;
+      }
+      if (policy.expectedIdentity === undefined && defaults.expectedIdentity !== undefined) {
+        policy.expectedIdentity = defaults.expectedIdentity;
+      }
+      if (policy.identityIsRegexp === undefined && defaults.identityIsRegexp !== undefined) {
+        policy.identityIsRegexp = defaults.identityIsRegexp;
+      }
+      if (policy.key === undefined && defaults.key !== undefined) {
+        policy.key = defaults.key;
+      }
+      return { ...step, policy };
+    }
+
+    case "vuln-gate": {
+      const configPolicy = resolveVulnPolicy(config);
+      const existingPolicy = (step.policy as Record<string, unknown> | undefined) ?? {};
+      // Config policy fills the gaps; the step's own `policy` wins field-by-field.
+      const policy: Record<string, unknown> = { ...configPolicy, ...existingPolicy };
+      return { ...step, policy };
+    }
+
+    default:
+      return step;
+  }
+}
+
+/** Recursively apply step defaults across one entry (a step, a gate, or a nested fan-out phase). Gates are returned unchanged — they carry no capability input to resolve. */
+function applyEntryDefaults(
+  entry: DriverStep | DriverGate | DriverPhase,
+  config: ChantConfig,
+): DriverStep | DriverGate | DriverPhase {
+  if (isGateStep(entry)) return entry;
+  if (isPhaseStep(entry)) return applyPhaseDefaults(entry, config);
+  return applyStepDefaults(entry, config);
+}
+
+/** Apply step defaults across one phase's `steps` (recursing into nested fan-out phases) and its `onFailure` compensation phases. */
+function applyPhaseDefaults(phase: DriverPhase, config: ChantConfig): DriverPhase {
+  return {
+    ...phase,
+    steps: phase.steps.map((entry) => applyEntryDefaults(entry, config)),
+    ...(phase.onFailure ? { onFailure: phase.onFailure.map((p) => applyPhaseDefaults(p, config)) } : {}),
+  };
+}
+
+/**
+ * Return `component` with `chant.config.ts`'s `sbom`/`signing`/`vulnPolicy`
+ * defaults filled into its `deploy` (and `rollback`, which shares the same
+ * `DriverPhase[]` shape and can equally carry a `verify`/`vuln-gate` step)
+ * composition, wherever a step didn't already specify the value itself.
+ * Non-destructive: returns a new component/phase/step tree, never mutates
+ * `component` in place, so a caller holding the original discovered
+ * `DriverComponent` (e.g. for `chant describe`) is unaffected.
+ */
+export function applyConfigDefaults(component: DriverComponent, config: ChantConfig): DriverComponent {
+  return {
+    ...component,
+    deploy: component.deploy.map((phase) => applyPhaseDefaults(phase, config)),
+    ...(component.rollback ? { rollback: component.rollback.map((phase) => applyPhaseDefaults(phase, config)) } : {}),
+  };
+}