@magland/mochi 0.3.1

package/dist/runner/docker.js

@@ -0,0 +1,197 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DockerError = void 0;
+exports.setContainerEngine = setContainerEngine;
+exports.containerEngine = containerEngine;
+exports.dockerAvailable = dockerAvailable;
+exports.probeEngine = probeEngine;
+exports.imagePresent = imagePresent;
+exports.pullImage = pullImage;
+exports.startContainer = startContainer;
+exports.removeContainer = removeContainer;
+exports.execInContainer = execInContainer;
+exports.writeFileInContainer = writeFileInContainer;
+exports.readFileInContainer = readFileInContainer;
+const child_process_1 = require("child_process");
+// The Docker surface the runner needs, as thin wrappers over the CLI rather
+// than the Engine API socket. Shelling out keeps the runner dependency-free
+// and works with anything that provides the docker command set; `podman`
+// answers the same arguments, so the binary is a setting rather than a fact.
+class DockerError extends Error {
+}
+exports.DockerError = DockerError;
+// Which binary carries the commands below. Set once at startup by whichever
+// CLI is running (see setContainerEngine); every wrapper reads it, so a
+// runner told to use podman uses it for everything or for nothing.
+let engineBin = 'docker';
+function setContainerEngine(bin) {
+    engineBin = bin;
+}
+function containerEngine() {
+    return engineBin;
+}
+function run(args, input) {
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.execFile)(engineBin, args, { maxBuffer: 64 * 1024 * 1024 }, (err, stdout, stderr) => {
+            if (err)
+                reject(new DockerError(`${engineBin} ${args[0]} failed: ${(stderr || err.message).trim()}`));
+            else
+                resolve({ stdout, stderr });
+        });
+        if (input !== undefined && child.stdin) {
+            child.stdin.write(input);
+            child.stdin.end();
+        }
+    });
+}
+async function dockerAvailable() {
+    try {
+        const { stdout } = await run(['version', '--format', '{{.Server.Version}}']);
+        return stdout.trim() || 'unknown';
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * What a given binary would report as its server version, without changing
+ * which one this process uses. The CLIs ask this of both `docker` and
+ * `podman` to offer a choice; a binary that is missing, or present with no
+ * working daemon behind it, answers null either way, since a runner cares
+ * only whether containers can actually be started.
+ */
+function probeEngine(bin) {
+    return new Promise((resolve) => {
+        (0, child_process_1.execFile)(bin, ['version', '--format', '{{.Server.Version}}'], { timeout: 15000 }, (err, stdout) => {
+            if (err)
+                resolve(null);
+            else
+                resolve(stdout.toString().trim() || 'unknown');
+        });
+    });
+}
+async function imagePresent(image) {
+    try {
+        await run(['image', 'inspect', image]);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function pullImage(image, onLine) {
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(engineBin, ['pull', image]);
+        const feed = (buf) => {
+            for (const line of buf.toString('utf8').split('\n')) {
+                if (line.trim() !== '')
+                    onLine(line.replace(/\r/g, ''));
+            }
+        };
+        child.stdout.on('data', feed);
+        child.stderr.on('data', feed);
+        child.on('error', (e) => reject(new DockerError(`docker pull failed: ${e.message}`)));
+        child.on('close', (code) => code === 0 ? resolve() : reject(new DockerError(`docker pull ${image} exited ${code}`)));
+    });
+}
+// One container per job, kept alive by a sleep so each step can exec into
+// it. This is how a container job behaves on GitHub: steps share a
+// filesystem and a process namespace, and anything a step installs is there
+// for the next one.
+async function startContainer(opts) {
+    const args = ['run', '--detach', '--name', opts.name, '--workdir', opts.workdir, '--entrypoint', ''];
+    for (const b of opts.binds) {
+        args.push('--volume', `${b.host}:${b.container}${b.readonly ? ':ro' : ''}`);
+    }
+    for (const [k, v] of Object.entries(opts.env)) {
+        args.push('--env', `${k}=${v}`);
+    }
+    if (opts.network)
+        args.push('--network', opts.network);
+    args.push(opts.image, 'sh', '-c', 'while true; do sleep 3600; done');
+    const { stdout } = await run(args);
+    return stdout.trim();
+}
+async function removeContainer(id) {
+    try {
+        await run(['rm', '--force', '--volumes', id]);
+    }
+    catch {
+        // a container that is already gone is the desired state
+    }
+}
+// Exec a command in a running container, streaming combined output. stdout
+// and stderr are interleaved into one callback because that is what a build
+// log is: their relative order matters more than their separation.
+function execInContainer(id, argv, onLine, opts = {}) {
+    const args = ['exec'];
+    if (opts.workdir)
+        args.push('--workdir', opts.workdir);
+    if (opts.user)
+        args.push('--user', opts.user);
+    for (const [k, v] of Object.entries(opts.env ?? {}))
+        args.push('--env', `${k}=${v}`);
+    args.push(id, ...argv);
+    const child = (0, child_process_1.spawn)(engineBin, args, { stdio: ['ignore', 'pipe', 'pipe'] });
+    // Split on newlines across chunk boundaries, and cap any single line so a
+    // program printing a gigabyte without a newline cannot exhaust memory.
+    const makeFeeder = () => {
+        let buffer = '';
+        return (buf) => {
+            buffer += buf.toString('utf8');
+            let i;
+            while ((i = buffer.indexOf('\n')) !== -1) {
+                onLine(buffer.slice(0, i).replace(/\r$/, ''));
+                buffer = buffer.slice(i + 1);
+            }
+            if (buffer.length > 64 * 1024) {
+                onLine(buffer.slice(0, 64 * 1024));
+                buffer = buffer.slice(64 * 1024);
+            }
+        };
+    };
+    const outFeed = makeFeeder();
+    const errFeed = makeFeeder();
+    child.stdout?.on('data', outFeed);
+    child.stderr?.on('data', errFeed);
+    const done = new Promise((resolve) => {
+        let settled = false;
+        const finish = (code) => {
+            if (!settled) {
+                settled = true;
+                resolve(code);
+            }
+        };
+        child.on('error', (e) => {
+            onLine(`docker exec failed: ${e.message}`);
+            finish(126);
+        });
+        child.on('close', (code) => finish(code === null ? 143 : code));
+    });
+    return { child, done };
+}
+// Copy a file into a container. `docker cp` from stdin needs a tar stream, so
+// the simpler route for the small files the runner writes (step scripts, the
+// environment files) is to pipe the bytes through a shell redirect.
+function writeFileInContainer(id, containerPath, content) {
+    return new Promise((resolve, reject) => {
+        const child = (0, child_process_1.spawn)(engineBin, ['exec', '--interactive', id, 'sh', '-c', `cat > "$0"`, containerPath], { stdio: ['pipe', 'ignore', 'pipe'] });
+        let stderr = '';
+        child.stderr?.on('data', (b) => {
+            stderr += b.toString('utf8');
+        });
+        child.on('error', (e) => reject(new DockerError(e.message)));
+        child.on('close', (code) => code === 0 ? resolve() : reject(new DockerError(`writing ${containerPath} failed: ${stderr.trim()}`)));
+        child.stdin?.write(content);
+        child.stdin?.end();
+    });
+}
+async function readFileInContainer(id, containerPath) {
+    try {
+        const { stdout } = await run(['exec', id, 'sh', '-c', `cat "$0" 2>/dev/null || true`, containerPath]);
+        return stdout;
+    }
+    catch {
+        return '';
+    }
+}

package/dist/runner/externals.js

@@ -0,0 +1,175 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Externals = exports.EXTERNALS_MOUNT = exports.ExternalsError = void 0;
+exports.defaultExternalsDir = defaultExternalsDir;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const docker_1 = require("./docker");
+// JavaScript actions need a node interpreter inside the job's container.
+// GitHub's runner ships its own and mounts it in, which is why an image
+// without node still runs `actions/checkout`. We do the same, but only when
+// we have to: if the image already has a new enough node, that one is used,
+// and nothing is downloaded. Images built for CI almost always do.
+//
+// The downloaded builds are the official linux-x64/arm64 ones, which are
+// linked against glibc. An Alpine or other musl image therefore cannot use
+// them, and gets a clear message rather than a confusing loader error.
+class ExternalsError extends Error {
+}
+exports.ExternalsError = ExternalsError;
+// Pinned so a job's behavior does not change under it when upstream releases.
+const NODE_VERSIONS = {
+    16: '16.20.2',
+    20: '20.19.5',
+    24: '24.10.0',
+};
+exports.EXTERNALS_MOUNT = '/mochi/externals';
+function run(cmd, args) {
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.execFile)(cmd, args, { maxBuffer: 64 * 1024 * 1024 }, (err, stdout, stderr) => {
+            if (err)
+                reject(new ExternalsError((stderr || err.message).toString().trim()));
+            else
+                resolve(stdout.toString());
+        });
+    });
+}
+function defaultExternalsDir() {
+    const base = process.env.XDG_CACHE_HOME ?? path.join(os.homedir(), '.cache');
+    return path.join(base, 'mochi', 'externals');
+}
+function nodeArch() {
+    return process.arch === 'arm64' ? 'arm64' : 'x64';
+}
+class Externals {
+    dir;
+    // Tagged with the container it describes, not merely remembered: one
+    // Externals serves every job a runner takes, and consecutive jobs may ask
+    // for different images. An untagged field would answer job two with what was
+    // true of job one's image. A runner runs one job at a time, so one entry is
+    // all there is to keep.
+    containerNode = null;
+    constructor(dir = defaultExternalsDir()) {
+        this.dir = dir;
+    }
+    // The node binary to run an action with, as a path inside the container.
+    async nodeFor(containerId, major, onLine) {
+        const inImage = await this.imageNode(containerId);
+        // Action bundles are transpiled to a conservative target, so any node at
+        // or above the version the action asks for runs them. Rejecting an image
+        // whose node is merely newer would mean downloading for no reason.
+        if (inImage !== null && inImage.major >= major)
+            return inImage.path;
+        return this.provision(containerId, major, onLine);
+    }
+    async imageNode(containerId) {
+        if (this.containerNode === null || this.containerNode.id !== containerId) {
+            let out = '';
+            const handle = (0, docker_1.execInContainer)(containerId, ['sh', '-c', 'command -v node >/dev/null 2>&1 && node --version || true'], (line) => {
+                out += line;
+            });
+            await handle.done;
+            const m = out.match(/v(\d+)\./);
+            this.containerNode = { id: containerId, node: m ? m[1] : null };
+        }
+        const node = this.containerNode.node;
+        if (node === null)
+            return null;
+        return { path: 'node', major: parseInt(node, 10) };
+    }
+    async provision(containerId, major, onLine) {
+        // An action may name any nodeN; only the runtimes above are provisioned.
+        // Say so, since an action written for a newer one will otherwise fail
+        // somewhere deep inside itself with no hint of why.
+        const version = NODE_VERSIONS[major];
+        if (version === undefined) {
+            onLine(`No node ${major} runtime is available; using node ${NODE_VERSIONS[20]} instead`);
+        }
+        const resolved = version ?? NODE_VERSIONS[20];
+        const arch = nodeArch();
+        const name = `node-v${resolved}-linux-${arch}`;
+        const target = path.join(this.dir, name);
+        const bin = path.join(target, 'bin', 'node');
+        if (!fs.existsSync(bin)) {
+            onLine(`Providing node ${resolved} for JavaScript actions (the image has none)`);
+            await this.download(resolved, name, target);
+        }
+        const containerPath = `${exports.EXTERNALS_MOUNT}/${name}/bin/node`;
+        // Fail here, with an explanation, rather than letting the first action
+        // die with "no such file or directory" from a dynamic loader.
+        let ok = false;
+        const check = (0, docker_1.execInContainer)(containerId, ['sh', '-c', `"${containerPath}" --version >/dev/null 2>&1 && echo yes || true`], (line) => {
+            if (line.includes('yes'))
+                ok = true;
+        });
+        await check.done;
+        if (!ok) {
+            throw new ExternalsError(`the image cannot run the provided node binary, which is a glibc build. ` +
+                `Use an image that includes node (most CI images do), or one based on glibc rather than musl.`);
+        }
+        return containerPath;
+    }
+    async download(version, name, target) {
+        const url = `https://nodejs.org/dist/v${version}/${name}.tar.gz`;
+        let res;
+        try {
+            res = await fetch(url, { redirect: 'follow' });
+        }
+        catch (e) {
+            throw new ExternalsError(`could not download node ${version}: ${e instanceof Error ? e.message : e}`);
+        }
+        if (!res.ok)
+            throw new ExternalsError(`could not download node ${version}: ${url} answered ${res.status}`);
+        fs.mkdirSync(this.dir, { recursive: true });
+        const tmp = path.join(this.dir, `.tmp-${process.pid}`);
+        fs.rmSync(tmp, { recursive: true, force: true });
+        fs.mkdirSync(tmp);
+        const tarball = path.join(tmp, 'node.tar.gz');
+        fs.writeFileSync(tarball, Buffer.from(await res.arrayBuffer()));
+        const extracted = path.join(tmp, 'out');
+        fs.mkdirSync(extracted);
+        await run('tar', ['-xzf', tarball, '-C', extracted, '--strip-components=1']);
+        fs.rmSync(target, { recursive: true, force: true });
+        fs.renameSync(extracted, target);
+        fs.rmSync(tmp, { recursive: true, force: true });
+    }
+    hostDir() {
+        return this.dir;
+    }
+}
+exports.Externals = Externals;

package/dist/runner/job.js

@@ -0,0 +1,290 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseKeyValueFile = exports.parseWorkflowCommand = void 0;
+exports.runJob = runJob;
+exports.defaultWorkDir = defaultWorkDir;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const expr_1 = require("../ci/expr");
+const context_1 = require("./context");
+const docker_1 = require("./docker");
+const externals_1 = require("./externals");
+const steps_1 = require("./steps");
+// Step index -1 carries the runner's own setup, post-step, and teardown
+// output, so anything happening outside the workflow's steps still has
+// somewhere to be reported.
+const RUNNER_STEP = -1;
+function nowIso() {
+    return new Date().toISOString();
+}
+function execFileAsync(cmd, args, cwd) {
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.execFile)(cmd, args, { cwd, maxBuffer: 64 * 1024 * 1024 }, (err, stdout, stderr) => {
+            if (err)
+                reject(new Error((stderr || err.message).toString().trim()));
+            else
+                resolve(stdout.toString());
+        });
+    });
+}
+async function runJob(spec, ctx, hooks) {
+    const image = ctx.imageFor(spec.runsOn);
+    const masker = new context_1.Masker();
+    const env = (0, context_1.baseEnv)(spec);
+    const stepStates = spec.steps.map((s, i) => ({ name: (0, context_1.stepLabel)(s, i), status: 'pending' }));
+    const rt = { env: {}, extraPath: [], summaries: [], postHooks: [] };
+    const scope = (0, context_1.newScope)(0);
+    let currentStep = RUNNER_STEP;
+    let failed = false;
+    const log = (line) => hooks.log(currentStep, masker.apply(line));
+    // The work directory is made per job rather than once at startup. A runner
+    // is a long-lived process and its default work directory is under /tmp,
+    // where a tmp cleaner or an operator can remove it between jobs; recreating
+    // it here costs nothing and turns a run that failed before its first step
+    // with a bare ENOENT into one that simply runs.
+    fs.mkdirSync(ctx.workDir, { recursive: true });
+    const hostWork = fs.mkdtempSync(path.join(ctx.workDir, 'job-'));
+    const hostRepo = path.join(hostWork, 'workspace');
+    const hostTemp = path.join(hostWork, 'temp');
+    const hostFiles = path.join(hostWork, 'files');
+    const hostActions = path.join(hostWork, 'actions');
+    for (const d of [hostRepo, hostTemp, hostFiles, hostActions])
+        fs.mkdirSync(d, { recursive: true });
+    let containerId = null;
+    // `timeout-minutes` is enforced here rather than by the server: the lease
+    // sweep only notices a runner that has stopped heartbeating, and a job stuck
+    // inside a step heartbeats perfectly well. Cancellation is cooperative and
+    // checked between steps, so a deadline that only set the flag would never
+    // interrupt the step that is actually hanging; removing the container is what
+    // makes the in-flight exec fail and the loop unwind.
+    let timedOut = false;
+    let deadline = null;
+    const cancelled = () => hooks.cancelled() || timedOut;
+    const finish = async (conclusion) => {
+        currentStep = RUNNER_STEP;
+        if (deadline)
+            clearTimeout(deadline);
+        if (containerId) {
+            log('Cleaning up the job container');
+            await (0, docker_1.removeContainer)(containerId);
+        }
+        try {
+            fs.rmSync(hostWork, { recursive: true, force: true });
+        }
+        catch {
+            // a leftover directory is not worth failing the job over
+        }
+        return {
+            conclusion,
+            steps: stepStates,
+            outputs: resolveJobOutputs(spec, scope, conclusion === 'failure', conclusion === 'cancelled'),
+            summaries: rt.summaries,
+        };
+    };
+    try {
+        // mochi checks the repository out before the job starts, rather than
+        // leaving an empty workspace for actions/checkout to fill. See the README:
+        // it makes run: steps useful on their own, and it means checkout is a
+        // re-sync rather than the first clone.
+        log(`Job ${spec.name} on ${spec.runsOn.join(', ')}`);
+        log(`Checking out ${spec.github.repository} at ${spec.sha.slice(0, 8)}`);
+        // A private repository's job carries an ephemeral token for it, which
+        // rides in the remote URL the way actions/checkout persists credentials:
+        // steps that fetch or pull from origin then work unchanged. It expires
+        // with the job either way.
+        const url = ctx.cloneUrl(spec.address.collection, spec.address.repo);
+        const remote = spec.cloneToken
+            ? url.replace('://', `://x-job:${encodeURIComponent(spec.cloneToken)}@`)
+            : url;
+        await execFileAsync('git', ['init', '--quiet', hostRepo]);
+        await execFileAsync('git', ['-C', hostRepo, 'remote', 'add', 'origin', remote]);
+        await execFileAsync('git', ['-C', hostRepo, 'fetch', '--quiet', '--depth', '1', 'origin', spec.sha]);
+        await execFileAsync('git', ['-C', hostRepo, 'checkout', '--quiet', 'FETCH_HEAD']);
+        fs.writeFileSync(path.join(hostTemp, 'event.json'), JSON.stringify(spec.github.event ?? {}, null, 1));
+        if (!(await (0, docker_1.imagePresent)(image))) {
+            log(`Pulling ${image}`);
+            await (0, docker_1.pullImage)(image, log);
+        }
+        const externalsDir = ctx.externals.hostDir();
+        fs.mkdirSync(externalsDir, { recursive: true });
+        containerId = await (0, docker_1.startContainer)({
+            image,
+            name: containerName(spec),
+            binds: [
+                { host: hostRepo, container: context_1.WORKSPACE },
+                { host: hostTemp, container: context_1.RUNNER_TEMP },
+                { host: hostFiles, container: context_1.FILE_COMMAND_DIR },
+                { host: hostActions, container: context_1.ACTIONS_MOUNT },
+                // Read-only: the provided node binaries are shared by every job on
+                // this runner, so nothing a job does may change them.
+                { host: externalsDir, container: externals_1.EXTERNALS_MOUNT, readonly: true },
+            ],
+            env,
+            workdir: context_1.WORKSPACE,
+            network: ctx.network,
+        });
+        await (0, docker_1.execInContainer)(containerId, ['mkdir', '-p', context_1.RUNNER_TOOL_CACHE], () => { }).done;
+        log(`Container started from ${image}`);
+        const id = containerId;
+        // A runner and its server are separate long-running processes and need not
+        // be the same version, so a spec that carries no usable timeout falls back
+        // to GitHub's six hours rather than to NaN, which setTimeout would treat as
+        // zero and fire against every job immediately.
+        const minutes = Number(spec.timeoutMinutes);
+        const limit = Number.isFinite(minutes) && minutes > 0 ? minutes : 360;
+        // setTimeout counts in a signed 32-bit millisecond field and fires at once
+        // on anything larger, so an absurd timeout-minutes has to be capped rather
+        // than passed through: uncapped, it would do the opposite of what it asks.
+        const delay = Math.min(limit * 60_000, 2 ** 31 - 1);
+        deadline = setTimeout(() => {
+            timedOut = true;
+            log(`Job exceeded its timeout of ${limit} minute${limit === 1 ? '' : 's'}`);
+            void (0, docker_1.removeContainer)(id);
+        }, delay);
+        const exec = {
+            containerId,
+            spec,
+            env,
+            rt,
+            masker,
+            actions: ctx.actions,
+            externals: ctx.externals,
+            hostPaths: { workspace: hostRepo, temp: hostTemp, files: hostFiles, actions: hostActions },
+            cloneUrl: ctx.cloneUrl,
+            serverUrl: ctx.serverUrl,
+            runnerToken: ctx.runnerToken,
+            hostPath: (p) => {
+                if (!path.isAbsolute(p))
+                    return path.resolve(hostRepo, p);
+                for (const [mount, host] of [
+                    [context_1.WORKSPACE, hostRepo],
+                    [context_1.RUNNER_TEMP, hostTemp],
+                    [context_1.FILE_COMMAND_DIR, hostFiles],
+                    [context_1.ACTIONS_MOUNT, hostActions],
+                ]) {
+                    if (p === mount)
+                        return host;
+                    if (p.startsWith(mount + '/'))
+                        return path.join(host, p.slice(mount.length + 1));
+                }
+                return null;
+            },
+            log: (line) => log(line),
+            status: () => ({ failed, cancelled: cancelled() }),
+        };
+        const result = await (0, steps_1.runSteps)(spec.steps, scope, exec, {
+            onStart: (i, label) => {
+                currentStep = i;
+                stepStates[i].status = 'running';
+                stepStates[i].startedAt = nowIso();
+                stepStates[i].name = label;
+                hooks.progress(stepStates);
+                log(`▸ ${label}`);
+            },
+            onEnd: (i, outcome) => {
+                const state = stepStates[i];
+                state.status = 'completed';
+                state.completedAt = state.completedAt ?? nowIso();
+                state.conclusion = outcome.skipped ? 'skipped' : outcome.failed ? 'failure' : 'success';
+                if (outcome.failed)
+                    failed = true;
+                currentStep = RUNNER_STEP;
+                hooks.progress(stepStates);
+            },
+            checkCancelled: () => cancelled(),
+        });
+        failed = failed || result.failed;
+        // Post steps run even when the job failed or was cancelled, which is what
+        // makes them useful for cleanup. A timeout is the exception: the container
+        // they would run in is the thing that was torn down to stop the job, so
+        // attempting them would only add a failure for each one to the log.
+        if (rt.postHooks.length && !timedOut) {
+            currentStep = RUNNER_STEP;
+            await (0, steps_1.runPostHooks)(exec, failed);
+        }
+        // A job that ran out of time is a failure, as it is on GitHub; only the
+        // server asking for the job back is a cancellation.
+        if (timedOut)
+            return await finish('failure');
+        if (result.cancelled || hooks.cancelled())
+            return await finish('cancelled');
+        return await finish(failed ? 'failure' : 'success');
+    }
+    catch (e) {
+        currentStep = RUNNER_STEP;
+        log(`Job failed to run: ${e instanceof Error ? e.message : String(e)}`);
+        return await finish(!timedOut && hooks.cancelled() ? 'cancelled' : 'failure');
+    }
+}
+function containerName(spec) {
+    const raw = `mochi-${spec.address.collection}-${spec.address.repo}-${spec.runNumber}-${spec.address.job}-${crypto
+        .randomBytes(4)
+        .toString('hex')}`;
+    return raw.toLowerCase().replace(/[^a-z0-9_.-]/g, '-');
+}
+function resolveJobOutputs(spec, scope, jobFailed, jobCancelled) {
+    const out = {};
+    if (Object.keys(spec.outputsTemplate).length === 0)
+        return out;
+    // The job's own outcome, not a placeholder: an output written as
+    // `${{ success() && ... }}` is a common way to hand a downstream job
+    // something only when this one worked, and a hardcoded success() would
+    // hand it over after a failure too.
+    const env = {
+        contexts: (0, context_1.contextsFor)({ spec, scope, stepEnv: {}, jobFailed, jobCancelled }),
+        functions: (0, context_1.statusFunctions)(jobFailed, jobCancelled),
+    };
+    for (const [k, template] of Object.entries(spec.outputsTemplate)) {
+        try {
+            out[k] = (0, expr_1.render)(template, env);
+        }
+        catch {
+            out[k] = '';
+        }
+    }
+    return out;
+}
+function defaultWorkDir() {
+    const dir = path.join(os.tmpdir(), 'mochi-runner');
+    fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+var context_2 = require("./context");
+Object.defineProperty(exports, "parseWorkflowCommand", { enumerable: true, get: function () { return context_2.parseWorkflowCommand; } });
+Object.defineProperty(exports, "parseKeyValueFile", { enumerable: true, get: function () { return context_2.parseKeyValueFile; } });