@izykitten/ce 0.0.3-dev.0 → 0.0.3-dev.1

package/README.md

@@ -38,7 +38,7 @@ Tags and the `TAG_PREFIX`/`CACHE_PREFIX` values can use placeholders, filled fro
 | `{image}` | registry host and repository, lowercased, e.g. `code.izy.sh/library/gateway` |
 | `{ref}` | the branch name, `pr-<number>` for a pull request, or the tag name |
 | `{branch}`, `{pr}`, `{tag}` | the branch, PR number or tag, set only when building that kind of ref |
-| `{default}` | set only when building the default branch, never for a pull request |
+| `{default}` | set only when building the default branch, never for a pull request or tag |
 | `{revision}`, `{sha}` | the commit, in full and as its first 7 characters |
 | `{version}`, `{major}`, `{minor}`, `{patch}` | from a SemVer tag such as `v1.2.3` or `1.2.3-rc.1` |
 | `{stable}` | set only for a SemVer tag without a pre-release |
@@ -48,7 +48,7 @@ Tags and the `TAG_PREFIX`/`CACHE_PREFIX` values can use placeholders, filled fro
 
 Values are made safe for a tag: any ASCII character a tag cannot have becomes `-`, so branch `ci/modernize-build` gives `ci-modernize-build`; a non-ASCII character is an error. A value never adds a tag or changes the image name. Prefixes can use `{name}` but not guards.
 
-Guards decide from the run's metadata, so they need it too: outside a Forgejo Actions run, or with its event file missing `repository.default_branch`, `{?default}` fails like `{default}` would. Only `{env.NAME}` works everywhere.
+Guards decide from the run's metadata, so they need it too: outside a Forgejo Actions run, `{?default}` fails like `{default}` would. Only `{env.NAME}` works everywhere. To tell whether a branch is the default one, ce reads `repository.default_branch` from the event file, or `DEFAULT_BRANCH` when the event has none, as on a scheduled run; set `DEFAULT_BRANCH: main` in such a workflow. Pull requests and tags are never the default branch, so they need neither.
 
 Put templates in single quotes: `?` is a glob character in zsh.
 
@@ -64,6 +64,14 @@ A branch, PR and default-branch build:
     -t '{image}:{ref},{?default}latest,{?default}caddy-{env.CADDY_VERSION}' .
 ```
 
+With `CACHE_PREFIX='{ref}'`, each branch and pull request gets a gha cache of its own, so a new one starts cold. To also read the default branch's cache, add it as a `--cache-from`. ce only prefixes a `--cache-from` whose scope matches a `--cache-to`, so this one is passed on unchanged and only read:
+
+```sh
+--cache type=gha,mode=max --cache-from type=gha,scope=main
+```
+
+PR 3 then reads `pr-3` and `main` and writes only `pr-3`; main reads its own cache a second time. With a scope of its own, such as `--cache type=gha,mode=max,scope=js`, the cache to read is `main-js`. This only picks what is read: whether it hits depends on what main last wrote.
+
 A release on a SemVer tag, with the version aliases only for stable releases:
 
 ```sh

package/dist/ce.js

@@ -360,10 +360,11 @@ class CiMetadata {
     return ref.kind === "tag" ? SEMVER.exec(ref.name) : null;
   }
   #defaultBranch() {
-    const repository = this.#payload().repository;
-    const branch = isObject(repository) ? repository.default_branch : undefined;
-    if (typeof branch !== "string" || !branch) {
-      throw new CeError("ce: {default} needs repository.default_branch in the event file, which it does not have");
+    const repository = this.#ciEnv("EVENT_PATH") ? this.#payload().repository : undefined;
+    const fromEvent = isObject(repository) ? repository.default_branch : undefined;
+    const branch = typeof fromEvent === "string" && fromEvent || nonEmpty(this.#env.DEFAULT_BRANCH);
+    if (!branch) {
+      throw new CeError("ce: {default} needs repository.default_branch in the event file or DEFAULT_BRANCH, and neither is set");
     }
     return branch;
   }
@@ -505,6 +506,11 @@ function checkValue(template, vars, what) {
 }
 function expandValue(template, vars, encode, what) {
   checkValue(template, vars, what);
+  for (const part of parse(template, vars)) {
+    if ("name" in part && vars.get(part.name) === undefined) {
+      throw new CeError(`ce: {${part.name}} has no value here, in the ${what} ${JSON.stringify(template)}`);
+    }
+  }
   return expand(template, vars, encode);
 }
 
@@ -1203,14 +1209,18 @@ function registryGroups() {
   const suffixed = Object.keys(process.env).filter((name) => name.startsWith(prefix) && name.length > prefix.length).sort().map((name) => name.slice(prefix.length));
   return [...process.env.REGISTRY_HOST ? [""] : [], ...suffixed];
 }
+function unsetOrEmpty(name) {
+  return `${name} is ${process.env[name] === undefined ? "unset" : "empty"}`;
+}
 function oidcConfig() {
   const audience = process.env.AUD ?? "";
   if (!audience)
     return null;
   const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL ?? "";
   const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN ?? "";
-  if (!(requestUrl && requestToken)) {
-    return "Forgejo OIDC login config is incomplete: AUD requires ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN";
+  const missing = ["ACTIONS_ID_TOKEN_REQUEST_URL", "ACTIONS_ID_TOKEN_REQUEST_TOKEN"].filter((name) => !process.env[name]);
+  if (missing.length) {
+    return `Forgejo OIDC login config is incomplete: AUD is set, but ${missing.map(unsetOrEmpty).join("; ")}`;
   }
   try {
     assertAbsoluteHttpUrl(requestUrl, "must be an absolute HTTP(S) URL");
@@ -1257,36 +1267,46 @@ async function login() {
   let failed = false;
   for (const group of groups) {
     const suffix = group ? `__${group}` : "";
-    const host = process.env[`REGISTRY_HOST${suffix}`] ?? "";
-    const user = process.env[`REGISTRY_USER${suffix}`] ?? "";
-    const password = process.env[`REGISTRY_PASSWORD${suffix}`] ?? "";
+    const hostName = `REGISTRY_HOST${suffix}`;
+    const userName = `REGISTRY_USER${suffix}`;
+    const passwordName = `REGISTRY_PASSWORD${suffix}`;
+    const host = process.env[hostName] ?? "";
+    const user = process.env[userName] ?? "";
+    const password = process.env[passwordName] ?? "";
     const label = group || "default";
-    const incomplete = `Login config for '${label}' is incomplete: host/user/password not all set`;
-    if (!(host && user)) {
-      logError(incomplete);
-      failed = true;
-      continue;
-    }
-    for (const rawRegistry of host.split(/\s+/u).filter(Boolean)) {
-      let authority;
-      let registry;
+    const hosts = host.split(/\s+/u).filter(Boolean);
+    const registries = [];
+    for (const rawRegistry of hosts) {
       try {
-        authority = urlAuthority(rawRegistry);
-        registry = registryServer(rawRegistry);
+        const authority = urlAuthority(rawRegistry);
+        const registry = registryServer(rawRegistry);
+        registries.push({ registry, useOidc: oidc !== null && sameAuthority(authority, oidc.authority) });
       } catch (exc) {
         if (!(exc instanceof CeError))
           throw exc;
-        logError(`Invalid registry host for '${label}' (${rawRegistry}): ${exc.message}`);
-        failed = true;
-        continue;
-      }
-      const useOidc = oidc !== null && sameAuthority(authority, oidc.authority);
-      if (!useOidc && !password) {
-        logError(incomplete);
+        logError(rawRegistry.includes("@") ? `Invalid registry host for '${label}' in ${hostName}, not shown as it has an "@" and may hold a password` : `Invalid registry host for '${label}' (${rawRegistry}): ${exc.message}`);
         failed = true;
-        continue;
       }
-      targets.push({ registry, label, user, password, useOidc });
+    }
+    const missing = [];
+    if (!host)
+      missing.push(unsetOrEmpty(hostName));
+    else if (!hosts.length)
+      missing.push(`${hostName} has no registry in it`);
+    if (!user)
+      missing.push(unsetOrEmpty(userName));
+    const needPassword = registries.filter((r) => !r.useOidc).map((r) => r.registry);
+    if (!password && needPassword.length)
+      missing.push(`${unsetOrEmpty(passwordName)}, which ${needPassword.join(", ")} needs`);
+    if (missing.length) {
+      logError(`Login config for '${label}' is incomplete: ${missing.join("; ")}`);
+      failed = true;
+    }
+    if (!user)
+      continue;
+    for (const { registry, useOidc } of registries) {
+      if (useOidc || password)
+        targets.push({ registry, label, user, password, useOidc });
     }
   }
   let jwt = null;
@@ -1361,7 +1381,8 @@ Placeholders, in build tags and in the tag and cache prefixes:
     {ref}             Branch name, pr-<number>, or tag name
     {branch} {pr} {tag}
                       Set only when building that kind of ref
-    {default}         Set only when building the default branch
+    {default}         Set only when building the default branch, named by
+                      the event file or else DEFAULT_BRANCH
     {revision} {sha}  The commit, in full and as 7 characters
     {version} {major} {minor} {patch}
                       From a SemVer tag such as v1.2.3 (v optional)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@izykitten/ce",
-  "version": "0.0.3-dev.0",
+  "version": "0.0.3-dev.1",
   "description": "Container engine wrapper: tag/cache rewriting for docker, podman and buildah, registry login, and a Forgejo OIDC Docker credential helper",
   "type": "module",
   "license": "BSD-3-Clause",