@magland/mochi 0.3.1

package/dist/runner/overrides.js

@@ -0,0 +1,554 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findOverride = findOverride;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const stream_1 = require("stream");
+const artifacts_1 = require("../ci/artifacts");
+const workflow_1 = require("../ci/workflow");
+function git(args, cwd) {
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.execFile)('git', args, { cwd, maxBuffer: 64 * 1024 * 1024 }, (err, stdout, stderr) => {
+            if (err)
+                reject(new Error((stderr || err.message).toString().trim()));
+            else
+                resolve(stdout.toString());
+        });
+    });
+}
+// ---- actions/checkout ----
+// mochi checks the repository out before the job starts, so this is usually
+// a no-op that reports what is already there. It does real work when the step
+// asks for something different: another repository, another ref, another
+// directory, full history, or submodules.
+const checkout = {
+    name: 'checkout',
+    async run({ ctx, inputs }) {
+        const wanted = (inputs.repository ?? '').trim();
+        const current = String(ctx.spec.github.repository ?? '');
+        const ref = (inputs.ref ?? '').trim();
+        const target = (inputs.path ?? '').trim();
+        const depthRaw = (inputs['fetch-depth'] ?? '1').trim();
+        const depth = Number.isFinite(Number(depthRaw)) ? Number(depthRaw) : 1;
+        const submodules = (inputs.submodules ?? '').trim().toLowerCase();
+        const sameRepo = wanted === '' || wanted === current;
+        const sameRef = ref === '' || ref === ctx.spec.sha || ref === ctx.spec.ref || ref === ctx.spec.refName;
+        const samePath = target === '' || target === '.' || target === './';
+        if (sameRepo && sameRef && samePath) {
+            ctx.log(`${current} is already checked out at ${ctx.spec.sha.slice(0, 8)} (mochi checks out before the job starts)`);
+            if (depth === 0) {
+                ctx.log('fetch-depth: 0 requested; fetching the full history');
+                try {
+                    await git(['fetch', '--quiet', '--unshallow', 'origin'], ctx.hostPaths.workspace);
+                }
+                catch {
+                    // Not a shallow clone; nothing to deepen.
+                }
+                try {
+                    await git(['fetch', '--quiet', '--tags', '--force', 'origin', '+refs/heads/*:refs/remotes/origin/*'], ctx.hostPaths.workspace);
+                }
+                catch (e) {
+                    ctx.log(`could not fetch the full history: ${e instanceof Error ? e.message : e}`);
+                    return { ok: false };
+                }
+            }
+            if (submodules !== '' && submodules !== 'false') {
+                const args = ['submodule', 'update', '--init'];
+                if (submodules === 'recursive')
+                    args.push('--recursive');
+                try {
+                    await git(args, ctx.hostPaths.workspace);
+                }
+                catch (e) {
+                    ctx.log(`could not initialize submodules: ${e instanceof Error ? e.message : e}`);
+                    return { ok: false };
+                }
+            }
+            return { ok: true, outputs: { ref: ctx.spec.ref, commit: ctx.spec.sha } };
+        }
+        // A different repository, ref, or directory: a real checkout. Note that
+        // `repository:` names a repository in this vault, since github.server_url
+        // is the vault; a workflow copied from GitHub that pulls in a second
+        // repository from github.com needs its own git commands.
+        const repoSpec = sameRepo ? current : wanted;
+        const [collection, name] = repoSpec.split('/');
+        if (!collection || !name) {
+            ctx.log(`repository: ${repoSpec} is not collection/repo`);
+            return { ok: false };
+        }
+        const dest = samePath ? ctx.hostPaths.workspace : path.join(ctx.hostPaths.workspace, target);
+        const real = path.resolve(dest);
+        if (real !== path.resolve(ctx.hostPaths.workspace) && !real.startsWith(path.resolve(ctx.hostPaths.workspace) + path.sep)) {
+            ctx.log(`path: ${target} resolves outside the workspace`);
+            return { ok: false };
+        }
+        const url = ctx.cloneUrl(collection, name);
+        ctx.log(`Checking out ${repoSpec}${ref ? `@${ref}` : ''} into ${samePath ? '.' : target}`);
+        try {
+            fs.rmSync(dest, { recursive: true, force: true });
+            fs.mkdirSync(dest, { recursive: true });
+            await git(['init', '--quiet', dest]);
+            await git(['remote', 'add', 'origin', url], dest);
+            const fetchArgs = ['fetch', '--quiet'];
+            if (depth > 0)
+                fetchArgs.push('--depth', String(depth));
+            fetchArgs.push('origin', ref === '' ? ctx.spec.sha : ref);
+            await git(fetchArgs, dest);
+            await git(['checkout', '--quiet', 'FETCH_HEAD'], dest);
+            if (submodules !== '' && submodules !== 'false') {
+                const args = ['submodule', 'update', '--init'];
+                if (submodules === 'recursive')
+                    args.push('--recursive');
+                await git(args, dest);
+            }
+            const sha = (await git(['rev-parse', 'HEAD'], dest)).trim();
+            return { ok: true, outputs: { ref: ref || ctx.spec.ref, commit: sha } };
+        }
+        catch (e) {
+            const msg = e instanceof Error ? e.message : String(e);
+            ctx.log(`checkout failed: ${msg}`);
+            // A workflow copied from GitHub is the common way to arrive here, and
+            // its author read `repository:` as naming something on github.com. The
+            // vault cannot know which they meant, but "not found" plus a repository
+            // this vault does not have is worth explaining rather than leaving as a
+            // bare git error.
+            if (/not found|does not exist|could not read/i.test(msg) && !sameRepo) {
+                ctx.log(`Note: on mochi, repository: ${repoSpec} names a repository in this vault, not on github.com.`);
+                ctx.log(`If you meant github.com, check it out with git instead:  run: git clone --depth 1${ref ? ` --branch ${ref}` : ''} https://github.com/${repoSpec}.git ${target || '.'}`);
+            }
+            return { ok: false };
+        }
+    },
+};
+// ---- artifacts ----
+// GitHub's upload-artifact and download-artifact are clients for its
+// artifact service. These do the same job against the vault: the runner
+// builds a tar of the requested paths and PUTs it to the run's artifact
+// endpoint, authorized by the job's lease.
+function splitPaths(input) {
+    const include = [];
+    const exclude = [];
+    for (const raw of (input ?? '').split('\n')) {
+        const line = raw.trim();
+        if (line === '')
+            continue;
+        if (line.startsWith('!'))
+            exclude.push(line.slice(1));
+        else
+            include.push(line);
+    }
+    return { include, exclude };
+}
+// Expand one path, which may contain * and **, against the workspace. The
+// glob dialect is the one workflow filters use, so there is one answer in the
+// codebase to what a pattern means.
+function expandPattern(rootDir, pattern, unreadable) {
+    const normalized = pattern.replace(/^\.\//, '').replace(/\/+$/, '');
+    const absolute = path.isAbsolute(normalized);
+    const full = absolute ? normalized : path.join(rootDir, normalized);
+    if (!/[*?[]/.test(normalized)) {
+        return fs.existsSync(full) ? [full] : [];
+    }
+    // Start from the deepest directory the pattern names literally. Walking
+    // from the filesystem root instead would be both slow and wrong.
+    const segments = full.split('/');
+    const firstGlob = segments.findIndex((s) => /[*?[]/.test(s));
+    const start = segments.slice(0, firstGlob).join('/') || '/';
+    const rx = (0, workflow_1.filterPatternToRegExp)(absolute ? full : normalized);
+    const out = [];
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch (e) {
+            // A directory that is there but closed to us is not the same as one
+            // that is not there, and the caller says so rather than reporting an
+            // empty match.
+            if (e.code === 'EACCES')
+                unreadable?.push(dir);
+            return;
+        }
+        for (const e of entries) {
+            const child = path.join(dir, e.name);
+            const candidate = absolute ? child : path.relative(rootDir, child);
+            if (rx.test(candidate))
+                out.push(child);
+            if (e.isDirectory())
+                walk(child);
+        }
+    };
+    walk(start);
+    return out;
+}
+// Every file the pattern set selects, with the directory their paths are
+// relative to. GitHub uses the least common ancestor of the matched paths as
+// that root, so `path: dist` uploads dist's contents rather than a dist/
+// prefix; this reproduces that.
+function collectArtifactFiles(ctx, input) {
+    const unreadable = [];
+    const workspace = ctx.hostPaths.workspace;
+    const { include, exclude } = splitPaths(input);
+    // A path in a workflow or an action is written as the step sees it inside
+    // the container, so it is translated before touching the host filesystem.
+    const onHost = (p) => (path.isAbsolute(p) ? ctx.hostPath(p) : p);
+    const matched = new Set();
+    for (const p of include) {
+        const mapped = onHost(p);
+        if (mapped === null) {
+            ctx.log(`WARNING: ${p} is not inside the workspace or the runner temp directory; ignoring it`);
+            continue;
+        }
+        for (const m of expandPattern(workspace, mapped, unreadable))
+            matched.add(m);
+    }
+    const excluded = new Set();
+    for (const p of exclude) {
+        const mapped = onHost(p);
+        if (mapped === null)
+            continue;
+        for (const m of expandPattern(workspace, mapped))
+            excluded.add(m);
+    }
+    const files = [];
+    const addFile = (p) => {
+        if (excluded.has(p))
+            return;
+        if ([...excluded].some((e) => p.startsWith(e + path.sep)))
+            return;
+        files.push(p);
+    };
+    const walk = (dir) => {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch (e) {
+            if (e.code === 'EACCES')
+                unreadable.push(dir);
+            return;
+        }
+        for (const e of entries) {
+            const full = path.join(dir, e.name);
+            if (e.isDirectory())
+                walk(full);
+            else
+                addFile(full);
+        }
+    };
+    for (const m of matched) {
+        try {
+            if (fs.statSync(m).isDirectory())
+                walk(m);
+            else
+                addFile(m);
+        }
+        catch (e) {
+            // A file that vanished between matching and reading is not worth
+            // reporting; one we are not allowed to read is.
+            if (e.code === 'EACCES')
+                unreadable.push(m);
+        }
+    }
+    if (files.length === 0)
+        return { root: workspace, files: [], unreadable };
+    let root = path.dirname(files[0]);
+    for (const f of files.slice(1)) {
+        const dir = path.dirname(f);
+        while (root !== dir && !dir.startsWith(root + path.sep)) {
+            const parent = path.dirname(root);
+            if (parent === root)
+                break;
+            root = parent;
+        }
+    }
+    return { root, files, unreadable };
+}
+function tar(args, cwd) {
+    return new Promise((resolve, reject) => {
+        (0, child_process_1.execFile)('tar', args, { cwd, maxBuffer: 32 * 1024 * 1024 }, (err, stdout, stderr) => {
+            if (err)
+                reject(new Error((stderr || err.message).toString().trim()));
+            else
+                resolve(stdout.toString());
+        });
+    });
+}
+function artifactUrl(ctx, name) {
+    const a = ctx.spec.address;
+    const base = `${ctx.serverUrl}/api/runner/jobs/${encodeURIComponent(a.collection)}/${encodeURIComponent(a.repo)}/${a.run}/${encodeURIComponent(a.job)}/artifacts`;
+    return name === undefined ? base : `${base}/${encodeURIComponent(name)}`;
+}
+const uploadArtifact = {
+    name: 'upload-artifact',
+    async run({ ctx, inputs }) {
+        const name = (inputs.name ?? 'artifact').trim() || 'artifact';
+        if (!(0, artifacts_1.isValidArtifactName)(name)) {
+            ctx.log(`artifact name "${name}" is not usable as a file name`);
+            return { ok: false };
+        }
+        const { root, files, unreadable } = collectArtifactFiles(ctx, inputs.path);
+        // Nothing collected because nothing could be read is a different answer
+        // from nothing collected because nothing is there, and it is not one
+        // `if-no-files-found` is about: the step asked for files that exist. It
+        // happens when the job's container writes as root onto a filesystem whose
+        // permissions leave the runner's own user unable to walk back in, and it
+        // would otherwise be a green build that shipped an empty artifact.
+        if (files.length === 0 && unreadable.length > 0) {
+            ctx.log(`ERROR: cannot read ${unreadable[0]}: permission denied`);
+            ctx.log('The job wrote it as another user; nothing was uploaded.');
+            return { ok: false };
+        }
+        if (unreadable.length > 0) {
+            ctx.log(`WARNING: leaving out ${unreadable.length} path(s) this runner may not read, starting with ${unreadable[0]}`);
+        }
+        if (files.length === 0) {
+            const behavior = (inputs['if-no-files-found'] ?? 'warn').trim().toLowerCase();
+            const message = `no files matched ${JSON.stringify((inputs.path ?? '').trim())}`;
+            if (behavior === 'error') {
+                ctx.log(`ERROR: ${message}`);
+                return { ok: false };
+            }
+            if (behavior !== 'ignore')
+                ctx.log(`WARNING: ${message}`);
+            return { ok: true, outputs: { 'artifact-id': '', 'artifact-url': '' } };
+        }
+        const listFile = path.join(ctx.hostPaths.temp, `artifact-${name}.list`);
+        fs.writeFileSync(listFile, files.map((f) => path.relative(root, f)).join('\n') + '\n');
+        const tarFile = path.join(ctx.hostPaths.temp, `artifact-${name}.tar`);
+        try {
+            await tar(['-cf', tarFile, '-C', root, '--files-from', listFile]);
+            const size = fs.statSync(tarFile).size;
+            ctx.log(`Uploading artifact ${name} (${files.length} file${files.length === 1 ? '' : 's'}, ${size} bytes)`);
+            // Streamed rather than read into memory: an artifact may be hundreds of
+            // megabytes, and the runner is somebody's laptop.
+            const res = await fetch(artifactUrl(ctx, name), {
+                method: 'PUT',
+                headers: {
+                    authorization: `Bearer ${ctx.runnerToken}`,
+                    'x-mochi-lease': ctx.spec.lease,
+                    'content-type': 'application/x-tar',
+                    'content-length': String(size),
+                },
+                body: stream_1.Readable.toWeb(fs.createReadStream(tarFile)),
+                duplex: 'half',
+            });
+            if (!res.ok) {
+                const err = (await res.json().catch(() => ({})));
+                ctx.log(`uploading the artifact failed: ${err.error ?? res.status}`);
+                return { ok: false };
+            }
+            return {
+                ok: true,
+                outputs: { 'artifact-id': name, 'artifact-url': artifactUrl(ctx, name) },
+            };
+        }
+        catch (e) {
+            ctx.log(`uploading the artifact failed: ${e instanceof Error ? e.message : e}`);
+            return { ok: false };
+        }
+        finally {
+            fs.rmSync(listFile, { force: true });
+            fs.rmSync(tarFile, { force: true });
+        }
+    },
+};
+const downloadArtifact = {
+    name: 'download-artifact',
+    async run({ ctx, inputs }) {
+        const name = (inputs.name ?? '').trim();
+        const target = (inputs.path ?? '').trim();
+        const mapped = target === '' ? ctx.hostPaths.workspace : ctx.hostPath(target);
+        if (mapped === null) {
+            ctx.log(`path: ${target} is not inside the workspace or the runner temp directory`);
+            return { ok: false };
+        }
+        const dest = path.resolve(mapped);
+        const wsReal = path.resolve(ctx.hostPaths.workspace);
+        const tmpReal = path.resolve(ctx.hostPaths.temp);
+        const inside = (base) => dest === base || dest.startsWith(base + path.sep);
+        if (!inside(wsReal) && !inside(tmpReal)) {
+            ctx.log(`path: ${target} resolves outside the workspace`);
+            return { ok: false };
+        }
+        const headers = { authorization: `Bearer ${ctx.runnerToken}`, 'x-mochi-lease': ctx.spec.lease };
+        let names;
+        if (name !== '') {
+            names = [name];
+        }
+        else {
+            const res = await fetch(artifactUrl(ctx), { headers });
+            if (!res.ok) {
+                ctx.log(`could not list the run's artifacts: ${res.status}`);
+                return { ok: false };
+            }
+            const body = (await res.json());
+            names = (body.artifacts ?? []).map((a) => a.name);
+            if (names.length === 0) {
+                ctx.log('this run has no artifacts to download');
+                return { ok: true };
+            }
+        }
+        for (const one of names) {
+            const res = await fetch(artifactUrl(ctx, one), { headers });
+            if (!res.ok) {
+                const err = (await res.json().catch(() => ({})));
+                ctx.log(`could not download artifact ${one}: ${err.error ?? res.status}`);
+                return { ok: false };
+            }
+            // With no name given, each artifact lands in its own subdirectory, as
+            // download-artifact does.
+            const into = name === '' ? path.join(dest, one) : dest;
+            fs.mkdirSync(into, { recursive: true });
+            const tmp = path.join(ctx.hostPaths.temp, `download-${one}.tar`);
+            if (res.body) {
+                await new Promise((resolve, reject) => {
+                    const out = fs.createWriteStream(tmp);
+                    out.on('error', reject);
+                    out.on('finish', () => resolve());
+                    stream_1.Readable.fromWeb(res.body).on('error', reject).pipe(out);
+                });
+            }
+            else {
+                fs.writeFileSync(tmp, Buffer.from(await res.arrayBuffer()));
+            }
+            try {
+                await tar(['-xf', tmp, '-C', into, '--no-same-owner']);
+                ctx.log(`Downloaded artifact ${one} into ${path.relative(wsReal, into) || '.'}`);
+            }
+            catch (e) {
+                ctx.log(`could not unpack artifact ${one}: ${e instanceof Error ? e.message : e}`);
+                return { ok: false };
+            }
+            finally {
+                fs.rmSync(tmp, { force: true });
+            }
+        }
+        return { ok: true, outputs: { 'download-path': dest } };
+    },
+};
+// ---- the site ----
+//
+// These two keep GitHub's spelling in their `uses:` keys and in the
+// `github-pages` artifact name, because those are somebody else's interface.
+// mochi's own noun for what they publish is a site.
+function siteUrls(ctx) {
+    const a = ctx.spec.address;
+    // The vault says where the site will be, because only it knows whether a
+    // sites hostname is configured; a site served on one has an origin of its
+    // own and sits at its root, which no amount of arithmetic on the server URL
+    // would reveal. The fallback is the path shape, which is what a vault older
+    // than this field serves.
+    const baseUrl = (ctx.spec.site?.url ?? `${ctx.serverUrl.replace(/\/+$/, '')}/${a.collection}/${a.repo}/site/`).replace(/\/+$/, '');
+    const basePath = ctx.spec.site?.basePath ?? `/${a.collection}/${a.repo}/site`;
+    let origin = baseUrl;
+    let host = baseUrl;
+    try {
+        const u = new URL(baseUrl);
+        origin = u.origin;
+        host = u.host;
+    }
+    catch {
+        // keep the whole string if it is not a URL
+    }
+    return { origin, basePath, baseUrl, host };
+}
+// configure-pages exists to tell the rest of a workflow where the site will
+// live. The real one asks GitHub's API; this answers with what the vault said
+// when it handed out the job. Note the shape differs from GitHub's, and
+// differs between vaults: a site is served at /<collection>/<repo>/site/, or
+// at the root of an origin of its own where a sites hostname is configured,
+// but never at <owner>.github.io/<repo>/. A generator that computes its own
+// base path instead of reading base_path will be wrong on both, and needs the
+// path passed to it explicitly.
+const configurePages = {
+    name: 'configure-pages',
+    async run({ ctx }) {
+        const u = siteUrls(ctx);
+        ctx.log(`This site will be served at ${u.baseUrl}/`);
+        ctx.rt.env.MOCHI_SITE_BASE_PATH = u.basePath;
+        // The former name of the same variable, kept so workflows written against
+        // it keep working; remove it once they have moved.
+        ctx.rt.env.MOCHI_PAGES_BASE_PATH = u.basePath;
+        return {
+            ok: true,
+            outputs: { base_url: u.baseUrl, origin: u.origin, host: u.host, base_path: u.basePath },
+        };
+    },
+};
+// deploy-pages publishes the artifact that upload-pages-artifact produced.
+// The server unpacks it, since the site directory is vault state.
+const deployPages = {
+    name: 'deploy-pages',
+    async run({ ctx, inputs }) {
+        const artifact = (inputs.artifact_name ?? 'github-pages').trim() || 'github-pages';
+        const a = ctx.spec.address;
+        const url = `${ctx.serverUrl}/api/runner/jobs/${encodeURIComponent(a.collection)}/${encodeURIComponent(a.repo)}/${a.run}/${encodeURIComponent(a.job)}/site`;
+        const res = await fetch(url, {
+            method: 'POST',
+            headers: {
+                authorization: `Bearer ${ctx.runnerToken}`,
+                'x-mochi-lease': ctx.spec.lease,
+                'content-type': 'application/json',
+            },
+            body: JSON.stringify({ artifact }),
+        });
+        const body = (await res.json().catch(() => ({})));
+        if (!res.ok) {
+            ctx.log(`deploying the site failed: ${body.error ?? res.status}`);
+            return { ok: false };
+        }
+        ctx.log(`Deployed ${body.files} file${body.files === 1 ? '' : 's'} to ${body.url}`);
+        return { ok: true, outputs: { page_url: body.url ?? siteUrls(ctx).baseUrl + '/' } };
+    },
+};
+// ---- the registry ----
+// Matched on owner/repo, ignoring the ref, since the point is to substitute
+// every version of these actions.
+const OVERRIDES = {
+    'actions/checkout': checkout,
+    'actions/upload-artifact': uploadArtifact,
+    'actions/download-artifact': downloadArtifact,
+    'actions/configure-pages': configurePages,
+    'actions/deploy-pages': deployPages,
+};
+function findOverride(ref) {
+    if (ref.kind !== 'repo')
+        return null;
+    const key = `${ref.owner}/${ref.repo}${ref.subpath ? '/' + ref.subpath : ''}`.toLowerCase();
+    return OVERRIDES[key] ?? null;
+}