@magland/mochi 0.3.1

package/dist/ci/artifacts.js

@@ -0,0 +1,201 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArtifactError = void 0;
+exports.isValidArtifactName = isValidArtifactName;
+exports.artifactsDir = artifactsDir;
+exports.artifactPath = artifactPath;
+exports.listArtifacts = listArtifacts;
+exports.deploySite = deploySite;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const layout_1 = require("../layout");
+const scan_1 = require("../scan");
+const runs_1 = require("./runs");
+// Workflow artifacts. An artifact is a tar stream a job uploads under a name,
+// stored inside the run's directory so that it is pruned with the run and
+// copied with a vault backup like everything else:
+//
+//   <vault>/collections/<collection>/repos/<repo>.runs/12/artifacts/github-pages.tar
+//
+// mochi does not implement GitHub's artifact wire protocol. The
+// upload-artifact and download-artifact actions are substituted by mochi's
+// own (see the runner's overrides), which speak the small API in ci/api.ts;
+// this module is only the storage underneath it.
+class ArtifactError extends Error {
+}
+exports.ArtifactError = ArtifactError;
+// Artifact names come from workflow files. They become filenames, so they are
+// constrained the same way job ids are, and for the same reason.
+function isValidArtifactName(name) {
+    return /^[A-Za-z0-9][A-Za-z0-9._-]{0,110}$/.test(name) && !name.includes('..');
+}
+function artifactsDir(root, collection, repo, n) {
+    const base = (0, runs_1.runsDir)(root, collection, repo);
+    if (!base)
+        return null;
+    return path.join(base, String(n), 'artifacts');
+}
+function artifactPath(root, collection, repo, n, name) {
+    if (!isValidArtifactName(name))
+        return null;
+    const dir = artifactsDir(root, collection, repo, n);
+    if (!dir)
+        return null;
+    return path.join(dir, `${name}.tar`);
+}
+function listArtifacts(root, collection, repo, n) {
+    const dir = artifactsDir(root, collection, repo, n);
+    if (!dir)
+        return [];
+    let entries;
+    try {
+        entries = fs.readdirSync(dir);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const e of entries) {
+        if (!e.endsWith('.tar'))
+            continue;
+        const name = e.slice(0, -4);
+        if (!isValidArtifactName(name))
+            continue;
+        try {
+            const st = fs.statSync(path.join(dir, e));
+            out.push({ name, size: st.size, createdAt: st.mtime.toISOString() });
+        }
+        catch {
+            // vanished between readdir and stat
+        }
+    }
+    return out.sort((a, b) => a.name.localeCompare(b.name));
+}
+function run(cmd, args) {
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.execFile)(cmd, args, { maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+            if (err)
+                reject(new ArtifactError((stderr || err.message).toString().trim()));
+            else
+                resolve(stdout.toString());
+        });
+    });
+}
+// Deploy an artifact as the repository's site.
+//
+// The bytes arrive from a runner, so extraction is treated as untrusted: tar
+// runs into a scratch directory outside the published one, every resulting
+// path is checked to be inside it, and only then does the new site replace
+// the old one by rename. A half-extracted archive therefore never becomes the
+// live site, and a crafted archive cannot write outside the vault.
+async function deploySite(root, collection, repo, n, artifactName) {
+    if (!(0, scan_1.isValidName)(collection) || !(0, scan_1.isValidName)(repo))
+        throw new ArtifactError('invalid repository');
+    const tar = artifactPath(root, collection, repo, n, artifactName);
+    if (!tar || !fs.existsSync(tar)) {
+        throw new ArtifactError(`no artifact named ${artifactName} in run #${n}`);
+    }
+    const dir = (0, layout_1.repoPath)(root, collection, `${(0, scan_1.displayName)(repo)}.site`);
+    const scratch = `${dir}.incoming-${process.pid}`;
+    const previous = `${dir}.previous-${process.pid}`;
+    fs.rmSync(scratch, { recursive: true, force: true });
+    fs.mkdirSync(scratch, { recursive: true });
+    try {
+        // Containment during extraction is tar's own: GNU tar and libarchive both
+        // strip a leading `/` and a `..` from member names, and both refuse to
+        // write through a symlink a member of the same archive created, which is
+        // what stops `link -> /etc` followed by `link/passwd`. The walk below runs
+        // after the bytes are on disk, so it removes an escaping link rather than
+        // preventing a write through one; that division is load-bearing, and a tar
+        // without those two behaviours would not be safe to point at this.
+        await run('tar', ['-xf', tar, '-C', scratch, '--no-same-owner', '--no-same-permissions']);
+        // upload-pages-artifact wraps the site in a tar of its own, so an
+        // artifact holding exactly one artifact.tar is unwrapped once more. This
+        // is what makes the real actions/upload-pages-artifact work unchanged.
+        const entries = fs.readdirSync(scratch);
+        if (entries.length === 1 && entries[0] === 'artifact.tar') {
+            const inner = path.join(scratch, 'artifact.tar');
+            const unwrapped = `${scratch}.inner`;
+            fs.rmSync(unwrapped, { recursive: true, force: true });
+            fs.mkdirSync(unwrapped);
+            await run('tar', ['-xf', inner, '-C', unwrapped, '--no-same-owner', '--no-same-permissions']);
+            fs.rmSync(scratch, { recursive: true, force: true });
+            fs.renameSync(unwrapped, scratch);
+        }
+        const scratchReal = fs.realpathSync(scratch);
+        let files = 0;
+        const walk = (dir) => {
+            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+                const full = path.join(dir, entry.name);
+                // A symlink pointing outside the site would publish arbitrary files
+                // from the vault's disk, so links are removed rather than followed.
+                if (entry.isSymbolicLink()) {
+                    const target = path.resolve(dir, fs.readlinkSync(full));
+                    if (target !== scratchReal && !target.startsWith(scratchReal + path.sep)) {
+                        fs.rmSync(full, { force: true });
+                        continue;
+                    }
+                }
+                if (entry.isDirectory())
+                    walk(full);
+                else
+                    files++;
+            }
+        };
+        walk(scratch);
+        if (files === 0)
+            throw new ArtifactError(`artifact ${artifactName} contains no files`);
+        fs.rmSync(previous, { recursive: true, force: true });
+        const had = fs.existsSync(dir);
+        if (had)
+            fs.renameSync(dir, previous);
+        try {
+            fs.renameSync(scratch, dir);
+        }
+        catch (e) {
+            if (had)
+                fs.renameSync(previous, dir);
+            throw e;
+        }
+        fs.rmSync(previous, { recursive: true, force: true });
+        return { files };
+    }
+    finally {
+        fs.rmSync(scratch, { recursive: true, force: true });
+        fs.rmSync(`${scratch}.inner`, { recursive: true, force: true });
+    }
+}

package/dist/ci/dispatch.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dispatchWorkflow = dispatchWorkflow;
+const git_1 = require("../git");
+const ops_1 = require("../ops");
+/**
+ * Plan a workflow_dispatch run, or throw OpError saying why not.
+ *
+ * The ref must be a branch this repository has: a dispatch runs a workflow file
+ * at a commit, and a ref that is not there has no commit to run at. The caller
+ * supplies the branches because it has already listed them.
+ */
+async function dispatchWorkflow(engine, repo, branches, defaultBranch, actor, request) {
+    const ref = request.ref || defaultBranch || '';
+    if (!(0, git_1.isValidRefName)(ref) || ref.startsWith('-'))
+        throw new ops_1.OpError('that is not a usable branch name');
+    const branch = branches.find((b) => b.name === ref);
+    if (!branch)
+        throw new ops_1.OpError(`branch ${ref} not found`, 'notfound');
+    if (request.workflow.trim() === '')
+        throw new ops_1.OpError('name the workflow to run');
+    try {
+        return await engine.handleDispatch(repo, request.workflow, `refs/heads/${ref}`, branch.sha, actor, request.inputs);
+    }
+    catch (e) {
+        // WorkflowError and anything else the engine raises are the caller's
+        // problem to be told about, not a server fault.
+        throw new ops_1.OpError(e instanceof Error ? e.message : String(e));
+    }
+}