@norskvideo/ctl-dev-kit 0.1.84 → 0.1.86

package/conventions/workflow-shell.ts

@@ -25,3 +25,139 @@ export function bashBlockLines(yaml: string): Set<number> {
   });
   return inside;
 }
+
+/** The `run: |` steps that pipe into `tee` without `pipefail` set on the
+ *  block's first non-comment line — each reported at its `run: |` line. The
+ *  default `bash -e {0}` has no pipefail, so such a step exits with TEE's
+ *  status and a dead suite reads green; `set -euo pipefail` inside a nested
+ *  `bash -c '...'` body cannot reach the pipeline one shell up. Read from the
+ *  raw text, not a YAML parse: what matters is the ORDER of lines in the script
+ *  the runner executes. */
+export function teeWithoutPipefail(yaml: string): { line: number; text: string }[] {
+  const out: { line: number; text: string }[] = [];
+  const lines = yaml.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const head = lines[i] as string;
+    if (!/^\s*run: \|\s*$/.test(head)) continue;
+    const indent = (lines[i + 1] ?? "").match(/^\s*/)?.[0].length ?? 0;
+    const body: string[] = [];
+    for (let j = i + 1; j < lines.length; j++) {
+      const line = lines[j] as string;
+      if (line.trim() === "") continue;
+      if ((line.match(/^\s*/)?.[0].length ?? 0) < indent) break;
+      body.push(line.trim());
+    }
+    if (!body.some((l) => /\|\s*tee\b/.test(l))) continue;
+    const first = body.find((l) => !l.startsWith("#"));
+    const pipefailFirst =
+      first !== undefined && /^set\s+(-[a-zA-Z]*o\s+pipefail|-euo\s+pipefail|-o\s+pipefail)/.test(first);
+    if (!pipefailFirst) out.push({ line: i + 1, text: head });
+  }
+  return out;
+}
+
+/** The step every convention workflow runs before `actions/checkout`, named so
+ *  the guard below can find it. */
+export const TEST_TEMP_STEP = "Route test-temp out of the workspace";
+
+// What that step must do, and what breaks when it doesn't. All four were learned
+// the hard way over three months on the shared DooD runners:
+//
+//   route  -- THE fix. These runners are docker-outside-of-docker, so the daemon
+//             a launch talks to is the HOST's, and a bind-mount source it has not
+//             seen is created by dockerd as ROOT on the host. --container-user
+//             does not help: it governs what the container WRITES, not what the
+//             daemon CREATES. Leave the harness on its repo-local default and
+//             every run seeds the checkout with root-owned dirs. The override
+//             must therefore point outside $GITHUB_WORKSPACE.
+//   reap   -- rm cannot unlink a live mountpoint even as ROOT (EBUSY), and a
+//             RESTARTING leaked container re-creates the path as root seconds
+//             after any clean. The holders are untracked by construction (a
+//             killed run labels nothing), so they are found by mount SOURCE.
+//   base   -- clearing only the CONTENTS leaves the base dir itself, and an
+//             empty-but-root-owned base still EACCESes a later mkdtemp.
+//   verify -- the old form swallowed every failure into `2>/dev/null || true`,
+//             so a clean that removed nothing looked identical to one that
+//             worked. The checkout then died with a bare "EACCES rmdir" and no
+//             clue what held the path. It stayed that way for a week.
+// The exported base must TRACE to $RUNNER_TEMP. Checking only that the export
+// exists would pass a step that dutifully exports the workspace path it was
+// already defaulting to, which is the whole bug.
+function routesOutOfWorkspace(body: string): boolean {
+  const exported = body.match(/NORSK_CTL_TEST_TMP=(\$\{?\w+\}?|[^\s"]+)[^\n]*>> "\$GITHUB_ENV"/);
+  if (!exported) return false;
+  const value = exported[1] ?? "";
+  if (value.startsWith("$RUNNER_TEMP")) return true;
+  const name = value.replace(/^\$\{?/, "").replace(/\}$/, "");
+  return name.length > 0 && new RegExp(`\\b${name}="\\$RUNNER_TEMP/`).test(body);
+}
+
+const TEST_TEMP_REQUIREMENTS: { name: string; ok: (body: string) => boolean }[] = [
+  { name: "route", ok: (b) => routesOutOfWorkspace(b) },
+  { name: "reap", ok: (b) => /\.Mounts\b/.test(b) && /docker rm -f/.test(b) },
+  { name: "base", ok: (b) => /rm -rf [^\n]*\/test-temp(?![\w/*])/.test(b) },
+  { name: "verify", ok: (b) => /\[ -e "\$tt" \]/.test(b) && /\bexit 1\b/.test(b) },
+];
+
+/** The `run: |` body of the step starting at `nameLine`, de-indented. */
+function stepBody(lines: string[], nameLine: number): string {
+  const runAt = lines.findIndex((l, i) => i > nameLine && /^\s*run: \|\s*$/.test(l));
+  if (runAt < 0) return "";
+  const indent = (lines[runAt + 1] ?? "").match(/^\s*/)?.[0].length ?? 0;
+  const body: string[] = [];
+  for (let j = runAt + 1; j < lines.length; j++) {
+    const line = lines[j] as string;
+    if (line.trim() === "") continue;
+    if ((line.match(/^\s*/)?.[0].length ?? 0) < indent) break;
+    body.push(line.trim());
+  }
+  return body.join("\n");
+}
+
+/** Pre-checkout test-temp steps that would leave the checkout exposed, each
+ *  reported at its `- name:` line with the requirements it does not meet. */
+export function testTempStepProblems(yaml: string): { line: number; missing: string[] }[] {
+  const lines = yaml.split("\n");
+  const out: { line: number; missing: string[] }[] = [];
+  lines.forEach((text, i) => {
+    if (!text.includes(`- name: ${TEST_TEMP_STEP}`)) return;
+    const body = stepBody(lines, i);
+    const missing = TEST_TEMP_REQUIREMENTS.filter((r) => !r.ok(body)).map((r) => r.name);
+    if (missing.length > 0) out.push({ line: i + 1, missing });
+  });
+  return out;
+}
+
+/** Jobs that check out without a {@link TEST_TEMP_STEP} of their own.
+ *
+ *  The per-step guard above can only inspect steps it finds BY NAME, so
+ *  deleting the step -- or renaming it back -- reads as "no problems". This is
+ *  the presence half. It is per JOB because both halves of the step are
+ *  per-job: `$GITHUB_ENV` does not cross jobs, and neither does the runner's
+ *  workspace state. Job ids are read off the two-space indent under `jobs:`
+ *  rather than a YAML parse, to stay consistent with the line-oriented guards
+ *  here and to keep reporting real line numbers. */
+export function jobsMissingTestTempStep(yaml: string): string[] {
+  const lines = yaml.split("\n");
+  const bad: string[] = [];
+  let job: string | undefined;
+  let checkouts = 0;
+  let steps = 0;
+  const settle = () => {
+    if (job !== undefined && checkouts > steps) bad.push(job);
+  };
+  for (const line of lines) {
+    const head = line.match(/^ {2}([A-Za-z_][\w-]*):\s*$/);
+    if (head) {
+      settle();
+      job = head[1];
+      checkouts = 0;
+      steps = 0;
+      continue;
+    }
+    if (/^\s*-?\s*uses: actions\/checkout@/.test(line)) checkouts++;
+    if (line.includes(`- name: ${TEST_TEMP_STEP}`)) steps++;
+  }
+  settle();
+  return bad;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-dev-kit",
-  "version": "0.1.84",
+  "version": "0.1.86",
   "type": "module",
   "exports": {
     "./create-product": "./create-product/create-product.ts",