@magland/mochi 0.3.1

package/dist/runner/client.js

@@ -0,0 +1,428 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Runner = exports.JobClient = exports.DEFAULT_IMAGES = void 0;
+exports.configPath = configPath;
+exports.loadRunnerConfig = loadRunnerConfig;
+exports.saveRunnerConfig = saveRunnerConfig;
+exports.executeSpec = executeSpec;
+exports.imageForLabels = imageForLabels;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const actions_1 = require("./actions");
+const docker_1 = require("./docker");
+const externals_1 = require("./externals");
+const job_1 = require("./job");
+const wake_1 = require("./wake");
+exports.DEFAULT_IMAGES = {
+    'ubuntu-latest': 'catthehacker/ubuntu:act-latest',
+    'ubuntu-24.04': 'catthehacker/ubuntu:act-24.04',
+    'ubuntu-22.04': 'catthehacker/ubuntu:act-22.04',
+    'self-hosted': 'catthehacker/ubuntu:act-latest',
+};
+function configPath() {
+    const base = process.env.XDG_CONFIG_HOME ?? path.join(os.homedir(), '.config');
+    return path.join(base, 'mochi', 'runner.json');
+}
+function loadRunnerConfig(file = configPath()) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+        if (typeof parsed.host !== 'string' || typeof parsed.token !== 'string')
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+function saveRunnerConfig(config, file = configPath()) {
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(config, null, 2) + '\n', { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+// The per-job wire client: logs, heartbeats, progress, and the final report.
+// It needs a host and a bearer token and nothing else about its caller, which
+// is what lets a manual session (`mochi job run`) drive it with a session
+// token exactly as the long-lived runner drives it with a runner token.
+class JobClient {
+    runner;
+    spec;
+    buffer = [];
+    flushing = false;
+    cancelSeen = false;
+    timer = null;
+    constructor(runner, spec) {
+        this.runner = runner;
+        this.spec = spec;
+    }
+    base() {
+        const a = this.spec.address;
+        return `${this.runner.host}/api/runner/jobs/${encodeURIComponent(a.collection)}/${encodeURIComponent(a.repo)}/${a.run}/${encodeURIComponent(a.job)}`;
+    }
+    headers(extra = {}) {
+        return {
+            authorization: `Bearer ${this.runner.token}`,
+            'x-mochi-lease': this.spec.lease,
+            ...extra,
+        };
+    }
+    log(stepIndex, line) {
+        this.buffer.push({ s: stepIndex, t: new Date().toISOString(), l: line });
+        if (this.buffer.length >= 200)
+            void this.flush();
+    }
+    async flush() {
+        if (this.flushing || this.buffer.length === 0)
+            return;
+        this.flushing = true;
+        const batch = this.buffer.splice(0, this.buffer.length);
+        try {
+            await fetch(`${this.base()}/logs`, {
+                method: 'POST',
+                headers: this.headers({ 'content-type': 'application/x-ndjson' }),
+                body: batch.map((l) => JSON.stringify(l)).join('\n') + '\n',
+            });
+        }
+        catch {
+            // Losing a log batch must never fail the job; the work matters more
+            // than its transcript.
+        }
+        finally {
+            this.flushing = false;
+        }
+    }
+    start() {
+        this.timer = setInterval(() => {
+            void this.flush();
+            void this.heartbeat();
+        }, 3000);
+    }
+    stop() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = null;
+    }
+    cancelled() {
+        return this.cancelSeen;
+    }
+    async heartbeat() {
+        try {
+            const res = await fetch(`${this.base()}/heartbeat`, { method: 'POST', headers: this.headers() });
+            if (res.status === 409) {
+                // The server took the job back (lease expired, run cancelled). Stop.
+                this.cancelSeen = true;
+                return;
+            }
+            const body = (await res.json());
+            if (body.cancel)
+                this.cancelSeen = true;
+        }
+        catch {
+            // A transient failure is not a cancellation; keep working.
+        }
+    }
+    async progress(steps) {
+        await this.flush();
+        try {
+            await fetch(`${this.base()}/status`, {
+                method: 'POST',
+                headers: this.headers({ 'content-type': 'application/json' }),
+                body: JSON.stringify({ lease: this.spec.lease, status: 'running', stepStates: steps }),
+            });
+        }
+        catch {
+            // reported again on the next step
+        }
+    }
+    async complete(result) {
+        await this.flush();
+        try {
+            await fetch(`${this.base()}/status`, {
+                method: 'POST',
+                headers: this.headers({ 'content-type': 'application/json' }),
+                body: JSON.stringify({
+                    lease: this.spec.lease,
+                    status: 'completed',
+                    conclusion: result.conclusion,
+                    stepStates: result.steps,
+                    outputs: result.outputs,
+                    summaries: result.summaries,
+                }),
+            });
+        }
+        catch (e) {
+            // The lease will expire and the server will requeue the job.
+            console.error(`  could not report the result: ${e instanceof Error ? e.message : e}`);
+        }
+    }
+}
+exports.JobClient = JobClient;
+class Runner {
+    host;
+    token;
+    labels;
+    images;
+    workDir;
+    network;
+    idleSeconds;
+    wake;
+    // When this runner last had something to do. A wake request counts, so that
+    // a runner started for a job that is a moment behind the request does not
+    // time out before the job arrives.
+    idleSince = Date.now();
+    stopping = false;
+    // The acquire poll the loop is sitting in, so that stopping can abort it. A
+    // runner between jobs is inside a request the server holds open for twenty-five
+    // seconds, and a stop that only set the flag above was not acted on until that
+    // request answered: Ctrl-C printed "stopping" and then appeared to hang.
+    polling = null;
+    // The registered name, learned from whoami at startup. Only used in
+    // messages, but a message from a runner that does not say which runner
+    // sent it is of little use on a vault serving more than one.
+    name = '';
+    actions;
+    externals;
+    constructor(config) {
+        this.host = config.host.replace(/\/+$/, '');
+        this.token = config.token;
+        this.labels = config.labels ?? [];
+        this.images = { ...exports.DEFAULT_IMAGES, ...(config.images ?? {}) };
+        this.workDir = config.workDir ?? (0, job_1.defaultWorkDir)();
+        this.network = config.network;
+        this.idleSeconds = config.idleSeconds && config.idleSeconds > 0 ? config.idleSeconds : null;
+        this.wake = config.wakePort && config.wakeSecret ? { port: config.wakePort, secret: config.wakeSecret } : null;
+        const actionCache = config.cacheDir ? path.join(config.cacheDir, 'actions') : (0, actions_1.defaultActionCacheDir)();
+        const externalsCache = config.cacheDir ? path.join(config.cacheDir, 'externals') : (0, externals_1.defaultExternalsDir)();
+        this.actions = new actions_1.ActionStore(actionCache, config.actionsUrl, config.actionCache);
+        this.externals = new externals_1.Externals(externalsCache);
+    }
+    imageFor(labels) {
+        return imageForLabels(this.images, labels);
+    }
+    cloneUrl(collection, repo) {
+        return `${this.host}/${encodeURIComponent(collection)}/${encodeURIComponent(repo)}`;
+    }
+    async whoami() {
+        const res = await fetch(`${this.host}/api/runner/whoami`, {
+            headers: { authorization: `Bearer ${this.token}` },
+        });
+        if (!res.ok) {
+            const body = (await res.json().catch(() => ({})));
+            throw new Error(body.error ?? `the server answered ${res.status}`);
+        }
+        return (await res.json());
+    }
+    async acquire(labels) {
+        const poll = new AbortController();
+        this.polling = poll;
+        try {
+            const res = await fetch(`${this.host}/api/runner/acquire`, {
+                method: 'POST',
+                headers: { authorization: `Bearer ${this.token}`, 'content-type': 'application/json' },
+                body: JSON.stringify({ labels }),
+                signal: poll.signal,
+            });
+            if (res.status === 204)
+                return null;
+            if (!res.ok) {
+                const body = (await res.json().catch(() => ({})));
+                throw new Error(body.error ?? `acquire failed with ${res.status}`);
+            }
+            return (await res.json());
+        }
+        catch (e) {
+            // An aborted poll is a stop, not a failure: answer it the way an empty
+            // poll is answered and let the loop see the flag and end.
+            if (this.stopping)
+                return null;
+            throw e;
+        }
+        finally {
+            this.polling = null;
+        }
+    }
+    stop() {
+        this.stopping = true;
+        // Aborting the poll hangs up on the server, which releases any job it was
+        // in the middle of leasing to this runner rather than leaving it leased to
+        // nobody. Nothing is executing at this point: a runner inside a poll is a
+        // runner between jobs.
+        this.polling?.abort();
+    }
+    async loop() {
+        const docker = await (0, docker_1.dockerAvailable)();
+        if (!docker) {
+            throw new Error(`${(0, docker_1.containerEngine)()} is not available. The runner executes every job in a container, so it needs a working \`${(0, docker_1.containerEngine)()}\` command.`);
+        }
+        const identity = await this.whoami();
+        const labels = this.labels.length ? this.labels.filter((l) => identity.labels.includes(l)) : identity.labels;
+        if (labels.length === 0) {
+            throw new Error(`none of the requested labels (${this.labels.join(', ')}) are registered for this runner (${identity.labels.join(', ')})`);
+        }
+        this.name = identity.name;
+        // Listening before the banner, because a runner that cannot be woken
+        // should say so at the top rather than after claiming to be ready. A
+        // failure to bind throws out of here: a runner meant to stop when idle
+        // and unable to be started again is worse than one that never started.
+        const listener = this.wake
+            ? await (0, wake_1.startWakeListener)({
+                port: this.wake.port,
+                secret: this.wake.secret,
+                onWake: () => {
+                    this.idleSince = Date.now();
+                },
+            })
+            : null;
+        console.log(`mochi runner ${identity.name} ready`);
+        console.log(`  server:  ${this.host}`);
+        console.log(`  engine:  ${(0, docker_1.containerEngine)()} ${docker}`);
+        console.log(`  workdir: ${this.workDir}`);
+        console.log(`  labels:  ${labels.join(', ')}`);
+        console.log(`  serving: ${identity.allow.join(', ')}`);
+        if (this.idleSeconds !== null)
+            console.log(`  idle:    stopping after ${this.idleSeconds}s with no job`);
+        if (listener)
+            console.log(`  wake:    listening on port ${listener.port}`);
+        console.log('Waiting for jobs.');
+        let backoff = 1000;
+        // Idle is measured from the end of the last job, not from the last poll:
+        // a runner between jobs polls every twenty-five seconds forever, so a
+        // timer reset by polling would never fire.
+        this.idleSince = Date.now();
+        try {
+            while (!this.stopping) {
+                let spec = null;
+                try {
+                    spec = await this.acquire(labels);
+                    backoff = 1000;
+                }
+                catch (e) {
+                    console.error(`  ${e instanceof Error ? e.message : e}; retrying in ${Math.round(backoff / 1000)}s`);
+                    await new Promise((r) => setTimeout(r, backoff));
+                    backoff = Math.min(backoff * 2, 60000);
+                    continue;
+                }
+                if (!spec) {
+                    if (this.idleSeconds !== null && Date.now() - this.idleSince >= this.idleSeconds * 1000) {
+                        console.log(`No job for ${this.idleSeconds}s; stopping.`);
+                        return;
+                    }
+                    continue;
+                }
+                await this.execute(spec);
+                this.idleSince = Date.now();
+            }
+        }
+        finally {
+            // Closed before this returns, and so before the process exits, which
+            // settles the race between stopping and being woken: a wake request
+            // that arrives after the decision to stop finds nothing listening and
+            // fails, and a failed wake is retried against a runner that by then has
+            // stopped and can be started again. Answering it and exiting anyway
+            // would leave the sender believing the runner was up.
+            await listener?.close();
+        }
+    }
+    async execute(spec) {
+        await executeSpec(spec, {
+            host: this.host,
+            token: this.token,
+            runnerName: this.name || 'this runner',
+            imageFor: (labels) => this.imageFor(labels),
+            workDir: this.workDir,
+            network: this.network,
+            actions: this.actions,
+            externals: this.externals,
+        });
+    }
+}
+exports.Runner = Runner;
+/**
+ * Take one leased job through execution and reporting. Shared between the
+ * long-lived runner and a manual session, which differ in how they came by
+ * the lease and in nothing that happens after.
+ */
+async function executeSpec(spec, deps) {
+    const label = `${spec.address.collection}/${spec.address.repo} #${spec.runNumber} ${spec.name}`;
+    console.log(`> ${label}`);
+    const client = new JobClient({ host: deps.host, token: deps.token }, spec);
+    client.start();
+    deps.actions.beginJob();
+    const started = Date.now();
+    let result;
+    try {
+        result = await (0, job_1.runJob)(spec, {
+            imageFor: deps.imageFor,
+            cloneUrl: (c, r) => `${deps.host}/${encodeURIComponent(c)}/${encodeURIComponent(r)}`,
+            workDir: deps.workDir,
+            network: deps.network,
+            actions: deps.actions,
+            externals: deps.externals,
+            serverUrl: deps.host,
+            runnerToken: deps.token,
+        }, {
+            log: (i, line) => client.log(i, line),
+            progress: (steps) => void client.progress(steps),
+            cancelled: () => client.cancelled(),
+        });
+    }
+    catch (e) {
+        // A failure here is the runner's own, not the workflow's, and the log
+        // is read on the vault by someone who cannot see this machine: say
+        // which runner it was and where it was working, so that the reader
+        // knows whose filesystem the message is about.
+        const where = `${deps.runnerName} on ${os.hostname()}, work dir ${deps.workDir}`;
+        client.log(-1, `runner error (${where}): ${e instanceof Error ? e.message : String(e)}`);
+        result = { conclusion: 'failure', steps: [], outputs: {}, summaries: [] };
+    }
+    await client.complete(result);
+    client.stop();
+    const secs = Math.round((Date.now() - started) / 1000);
+    console.log(`< ${label}: ${result.conclusion} in ${secs}s`);
+    return result;
+}
+/** The image a set of runs-on labels selects, given the label→image map. */
+function imageForLabels(images, labels) {
+    for (const l of labels) {
+        if (images[l])
+            return images[l];
+    }
+    // An unmapped label is taken as an image name when it looks like one,
+    // which makes `runs-on: node:24` work without configuration.
+    const looksLikeImage = labels.find((l) => l.includes('/') || l.includes(':'));
+    return looksLikeImage ?? images['ubuntu-latest'];
+}

package/dist/runner/context.js

@@ -0,0 +1,247 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Masker = exports.MAX_ACTION_DEPTH = exports.ACTIONS_MOUNT = exports.FILE_COMMAND_DIR = exports.RUNNER_TOOL_CACHE = exports.RUNNER_TEMP = exports.WORKSPACE = void 0;
+exports.newScope = newScope;
+exports.baseEnv = baseEnv;
+exports.contextsFor = contextsFor;
+exports.statusFunctions = statusFunctions;
+exports.shellCommand = shellCommand;
+exports.stepLabel = stepLabel;
+exports.parseWorkflowCommand = parseWorkflowCommand;
+exports.parseKeyValueFile = parseKeyValueFile;
+// The state and helpers shared by everything that executes inside a job:
+// the container paths, the environment, the expression contexts, and the
+// parsers for the two ways a step talks back to the runner (workflow commands
+// on stdout, and the file commands).
+//
+// This module holds no I/O. It exists so that job.ts (orchestration) and
+// steps.ts (execution, including recursion into composite actions) can share
+// definitions without importing each other.
+exports.WORKSPACE = '/mochi/workspace';
+exports.RUNNER_TEMP = '/mochi/temp';
+exports.RUNNER_TOOL_CACHE = '/mochi/tools';
+exports.FILE_COMMAND_DIR = '/mochi/files';
+exports.ACTIONS_MOUNT = '/mochi/actions';
+// How deep composite actions may nest before we call it a loop.
+exports.MAX_ACTION_DEPTH = 10;
+// Values a step asks to be redacted (::add-mask::) are removed from every
+// later log line. Masking happens on the runner, before a line is shipped, so
+// an unmasked value never reaches the vault.
+class Masker {
+    values = [];
+    add(value) {
+        const v = value.trim();
+        if (v.length >= 4 && !this.values.includes(v))
+            this.values.push(v);
+    }
+    apply(line) {
+        let out = line;
+        for (const v of this.values)
+            out = out.split(v).join('***');
+        return out;
+    }
+}
+exports.Masker = Masker;
+function newScope(depth = 0) {
+    return { outputs: {}, conclusions: {}, inputs: {}, actionEnv: {}, depth };
+}
+function baseEnv(spec) {
+    const gh = spec.github;
+    const str = (k) => {
+        const v = gh[k];
+        return v === undefined || v === null ? '' : String(v);
+    };
+    return {
+        CI: 'true',
+        GITHUB_ACTIONS: 'true',
+        MOCHI_ACTIONS: 'true',
+        GITHUB_WORKFLOW: spec.workflowName,
+        GITHUB_WORKFLOW_REF: str('workflow_ref'),
+        GITHUB_RUN_ID: String(spec.runNumber),
+        GITHUB_RUN_NUMBER: String(spec.runNumber),
+        GITHUB_RUN_ATTEMPT: '1',
+        GITHUB_JOB: spec.address.job,
+        GITHUB_ACTION: '',
+        GITHUB_ACTOR: str('actor'),
+        GITHUB_TRIGGERING_ACTOR: str('triggering_actor'),
+        GITHUB_REPOSITORY: str('repository'),
+        GITHUB_REPOSITORY_OWNER: str('repository_owner'),
+        GITHUB_EVENT_NAME: str('event_name'),
+        GITHUB_EVENT_PATH: `${exports.RUNNER_TEMP}/event.json`,
+        GITHUB_REF: spec.ref,
+        GITHUB_REF_NAME: spec.refName,
+        GITHUB_REF_TYPE: str('ref_type'),
+        GITHUB_SHA: spec.sha,
+        GITHUB_WORKSPACE: exports.WORKSPACE,
+        GITHUB_SERVER_URL: str('server_url'),
+        GITHUB_API_URL: str('api_url'),
+        GITHUB_GRAPHQL_URL: '',
+        GITHUB_RETENTION_DAYS: '90',
+        RUNNER_OS: 'Linux',
+        RUNNER_ARCH: process.arch === 'arm64' ? 'ARM64' : 'X64',
+        RUNNER_NAME: 'mochi',
+        RUNNER_TEMP: exports.RUNNER_TEMP,
+        RUNNER_TOOL_CACHE: exports.RUNNER_TOOL_CACHE,
+        RUNNER_DEBUG: '0',
+    };
+}
+function contextsFor(args) {
+    const { spec, scope, stepEnv } = args;
+    const steps = {};
+    const ids = new Set([...Object.keys(scope.outputs), ...Object.keys(scope.conclusions)]);
+    for (const id of ids) {
+        steps[id] = {
+            outputs: (scope.outputs[id] ?? {}),
+            outcome: scope.conclusions[id]?.outcome ?? 'success',
+            conclusion: scope.conclusions[id]?.conclusion ?? 'success',
+        };
+    }
+    const github = { ...spec.github };
+    github.workspace = exports.WORKSPACE;
+    if (scope.actionPath !== undefined)
+        github.action_path = scope.actionPath;
+    return {
+        github: github,
+        env: stepEnv,
+        job: { status: args.jobFailed ? 'failure' : 'success', container: {}, services: {} },
+        runner: {
+            os: 'Linux',
+            arch: process.arch === 'arm64' ? 'ARM64' : 'X64',
+            name: 'mochi',
+            temp: exports.RUNNER_TEMP,
+            tool_cache: exports.RUNNER_TOOL_CACHE,
+            debug: '0',
+            environment: 'self-hosted',
+        },
+        strategy: spec.strategy
+            ? {
+                'fail-fast': spec.strategy.failFast,
+                'job-index': spec.strategy.jobIndex,
+                'job-total': spec.strategy.jobTotal,
+            }
+            : {},
+        matrix: (spec.matrix ?? {}),
+        needs: spec.needs,
+        // Inside a composite action `inputs` is the action's inputs; at job level
+        // it is the workflow_dispatch inputs.
+        inputs: (scope.depth > 0 ? scope.inputs : (spec.inputs ?? {})),
+        vars: {},
+        secrets: {},
+        steps: steps,
+    };
+}
+function statusFunctions(jobFailed, jobCancelled) {
+    return {
+        success: () => !jobFailed && !jobCancelled,
+        failure: () => jobFailed && !jobCancelled,
+        cancelled: () => jobCancelled,
+        always: () => true,
+    };
+}
+// The shell a `run:` step uses. GitHub's default on Linux is bash with -e,
+// and an explicit `bash` adds -o pipefail; the distinction is preserved
+// because workflows depend on it.
+function shellCommand(shell, scriptPath) {
+    const s = (shell ?? 'default').toLowerCase();
+    if (s === 'bash')
+        return ['bash', '--noprofile', '--norc', '-eo', 'pipefail', scriptPath];
+    if (s === 'sh')
+        return ['sh', '-e', scriptPath];
+    if (s === 'default')
+        return ['bash', '-e', scriptPath];
+    if (s === 'python')
+        return ['python3', scriptPath];
+    if (s.includes('{0}')) {
+        const parts = s.split(/\s+/).map((p) => (p === '{0}' ? scriptPath : p));
+        return parts;
+    }
+    return [s, scriptPath];
+}
+// A step's display name. Expressions are resolved before the text is cut to
+// length, since truncating first would leave a torn `${{` that then fails to
+// render and shows the reader the raw expression instead of its value.
+function stepLabel(step, index, resolve) {
+    const r = (s) => {
+        if (!resolve)
+            return s;
+        try {
+            return resolve(s);
+        }
+        catch {
+            return s;
+        }
+    };
+    if (step.name)
+        return r(step.name);
+    if (step.uses)
+        return step.uses;
+    if (step.run) {
+        const firstLine = r(step.run).split('\n').find((l) => l.trim() !== '') ?? '';
+        const trimmed = firstLine.trim();
+        return `Run ${trimmed.length > 70 ? trimmed.slice(0, 70) + '…' : trimmed}`;
+    }
+    return `Step ${index + 1}`;
+}
+// ::name key=value,key=value::message, with the documented escapes. The older
+// ##[name]message spelling is accepted too, since actions still emit it (the
+// problem-matcher commands, for instance).
+function parseWorkflowCommand(line) {
+    const hash = line.match(/^\s*##\[([A-Za-z-]+)\]([\s\S]*)$/);
+    if (hash)
+        return { name: hash[1].toLowerCase(), props: {}, message: hash[2] };
+    const m = line.match(/^\s*::([A-Za-z-]+)(\s+(.*?))?::([\s\S]*)$/);
+    if (!m) {
+        const bare = line.match(/^\s*::([A-Za-z-]+)::$/);
+        if (bare)
+            return { name: bare[1].toLowerCase(), props: {}, message: '' };
+        return null;
+    }
+    const props = {};
+    if (m[3]) {
+        for (const pair of m[3].split(',')) {
+            const i = pair.indexOf('=');
+            if (i === -1)
+                continue;
+            props[pair.slice(0, i).trim()] = unescapeProperty(pair.slice(i + 1));
+        }
+    }
+    return { name: m[1].toLowerCase(), props, message: unescapeData(m[4]) };
+}
+function unescapeData(s) {
+    return s.replace(/%25/g, '%').replace(/%0D/g, '\r').replace(/%0A/g, '\n');
+}
+function unescapeProperty(s) {
+    return unescapeData(s).replace(/%3A/g, ':').replace(/%2C/g, ',');
+}
+// The GITHUB_OUTPUT / GITHUB_ENV format: `key=value` lines, plus the heredoc
+// form for values containing newlines:
+//
+//   key<<EOF
+//   line one
+//   EOF
+function parseKeyValueFile(text) {
+    const out = {};
+    const lines = text.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (line.trim() === '')
+            continue;
+        const heredoc = line.match(/^([^=<]+)<<(\S+)\s*$/);
+        if (heredoc) {
+            const key = heredoc[1].trim();
+            const delim = heredoc[2];
+            const body = [];
+            i++;
+            while (i < lines.length && lines[i] !== delim) {
+                body.push(lines[i]);
+                i++;
+            }
+            out[key] = body.join('\n');
+            continue;
+        }
+        const eq = line.indexOf('=');
+        if (eq > 0)
+            out[line.slice(0, eq).trim()] = line.slice(eq + 1);
+    }
+    return out;
+}