@oisincoveney/pipeline 2.0.0 → 2.0.1

package/dist/argo-workflow.js

@@ -303,25 +303,6 @@ function runnerWorkflowStorage(options, tasks) {
 			name: "runner-git-credentials",
 			secret: {
 				defaultMode: 256,
-				items: [
-					{
-						key: "username",
-						path: "username"
-					},
-					{
-						key: "password",
-						path: "password"
-					},
-					{
-						key: "identity",
-						path: "identity"
-					},
-					{
-						key: "known_hosts",
-						path: "known_hosts"
-					}
-				],
-				optional: true,
 				secretName: options.gitCredentialsSecretName
 			}
 		});

package/dist/cli/program.d.ts

@@ -26,6 +26,7 @@ interface DoctorResult {
 interface DoctorFlags {
   cluster?: boolean | string;
   kubeContext?: string;
+  kubeconfig?: string;
 }
 declare function createCliProgram(): Command;
 declare function runCli(argv: string[]): Promise<void>;

package/dist/cli/program.js

@@ -5,6 +5,7 @@ import { createOrchestratorLaunchPlan, createRunnerLaunchPlan } from "../runner.
 import { compileWorkflowPlan } from "../workflow-planner.js";
 import { compileScheduleArtifact, generateScheduleArtifact, parseScheduleArtifact } from "../schedule/planner.js";
 import "../schedule-planner.js";
+import { loadMokaGlobalConfig } from "../moka-global-config.js";
 import { defaultClusterDoctorNamespace, runClusterDoctor } from "../cluster-doctor.js";
 import { formatCodexAuthSyncResult, syncLocalCodexAuth } from "../codex-auth-sync.js";
 import { registerConfiguredEntrypointCommands } from "../commands/pipeline-command.js";
@@ -133,7 +134,7 @@ function createCliProgram() {
 		const config = loadPipelineConfig(cwd, { allowMissingLintFileReferences: true });
 		console.log(formatSelectedWorkflowPlan(config, cwd, flags));
 	});
-	program.command("doctor").description("Check local prerequisites for pipeline init and execution").option("--cluster [namespace]", "also check runner-job Kubernetes prerequisites").option("--kube-context <context>", "kubectl context for cluster checks").action(async (flags) => {
+	program.command("doctor").description("Check local prerequisites for pipeline init and execution").option("--cluster [namespace]", "also check runner-job Kubernetes prerequisites").option("--kube-context <context>", "kubectl context for cluster checks").option("--kubeconfig <path>", "kubeconfig path for cluster checks").action(async (flags) => {
 		const result = await runDoctor(process.env.PIPELINE_TARGET_PATH ?? process.cwd(), flags);
 		console.log(formatDoctorResult(result));
 		if (!result.passed) throw new Error("Doctor checks failed.");
@@ -241,9 +242,11 @@ async function runDoctor(cwd, options = {}) {
 		checkCommand("fallow", ["--version"], cwd)
 	]);
 	const configCheck = checkPipelineConfig(cwd);
+	const globalConfig = loadMokaGlobalConfig();
 	const clusterResult = options.cluster ? await runClusterDoctor({
 		kubeContext: options.kubeContext,
-		namespace: clusterNamespace(options.cluster)
+		kubeconfigPath: options.kubeconfig ?? globalConfig?.momokaya.kubernetes.kubeconfig,
+		namespace: clusterNamespace(options.cluster, globalConfig?.momokaya.kubernetes.namespace)
 	}) : { checks: [] };
 	const checks = [
 		...commandChecks,
@@ -255,8 +258,8 @@ async function runDoctor(cwd, options = {}) {
 		passed: checks.every((check) => check.passed)
 	};
 }
-function clusterNamespace(value) {
-	return typeof value === "string" && value.length > 0 ? value : defaultClusterDoctorNamespace();
+function clusterNamespace(value, configuredNamespace) {
+	return typeof value === "string" && value.length > 0 ? value : configuredNamespace ?? defaultClusterDoctorNamespace();
 }
 function checkCommand(name, args, cwd) {
 	return checkCommandWithRunner(name, name, args, cwd);

package/dist/cluster-doctor.js

@@ -13,33 +13,38 @@ const DEFAULT_RESOURCES = {
 	queueName: "pipeline-runner",
 	serviceAccountName: "pipeline-runner"
 };
+const FORBIDDEN_RE = /forbidden/i;
 async function runClusterDoctor(options = {}) {
 	const resources = clusterResources();
 	const namespace = options.namespace ?? DEFAULT_NAMESPACE;
+	const kubectlOptions = {
+		kubeContext: options.kubeContext,
+		kubeconfigPath: options.kubeconfigPath
+	};
 	const checks = await Promise.all([
-		checkKubectlNamespace(namespace, options.kubeContext),
-		...secretChecks(namespace, options.kubeContext, resources),
-		checkExternalSecret(namespace, resources.eventAuthExternalSecretName, resources.externalSecretRemoteRef, options.kubeContext),
-		checkClusterSecretStore("openbao", options.kubeContext),
-		checkServiceAccount(namespace, resources.serviceAccountName, options.kubeContext),
-		checkServiceAccountPermission(namespace, resources.serviceAccountName, {
-			kubeContext: options.kubeContext,
+		checkKubectlNamespace(namespace, kubectlOptions),
+		...secretChecks(namespace, kubectlOptions, resources),
+		checkExternalSecret(namespace, resources.eventAuthExternalSecretName, resources.externalSecretRemoteRef, kubectlOptions),
+		checkClusterSecretStore("openbao", kubectlOptions),
+		checkServiceAccount(namespace, resources.serviceAccountName, kubectlOptions),
+		checkWorkflowSubmitPermission(namespace, {
 			resource: "workflows.argoproj.io",
-			verb: "create"
+			verb: "create",
+			...kubectlOptions
 		}),
-		checkLocalQueue(namespace, resources.queueName, options.kubeContext),
+		checkLocalQueue(namespace, resources.queueName, kubectlOptions),
 		checkClusterResource("argo-workflow-crd", [
 			"get",
 			"crd",
 			"workflows.argoproj.io"
-		], options.kubeContext),
+		], kubectlOptions),
 		checkClusterResource("argo-workflow-controller", [
 			"get",
 			"pods",
 			"-A",
 			"-l",
 			"app=workflow-controller"
-		], options.kubeContext)
+		], kubectlOptions)
 	]);
 	return {
 		checks,
@@ -62,7 +67,7 @@ function clusterResources() {
 		serviceAccountName: configured.serviceAccountName
 	} : DEFAULT_RESOURCES;
 }
-function secretChecks(namespace, kubeContext, resources) {
+function secretChecks(namespace, kubectlOptions, resources) {
 	return [
 		[resources.eventAuthSecretName, eventAuthMissingDetail(namespace)],
 		[resources.imagePullSecretName, `Secret ${resources.imagePullSecretName} missing in ${namespace}; expected imagePullSecret for ghcr.io/oisin-ee/pipeline-runner.`],
@@ -75,30 +80,31 @@ function secretChecks(namespace, kubeContext, resources) {
 		name,
 		"-n",
 		namespace
-	], missingDetail, kubeContext));
+	], missingDetail, kubectlOptions));
 }
 function eventAuthMissingDetail(namespace) {
 	return `Secret pipeline-runner-event-auth missing in ${namespace}; expected ExternalSecret pipeline-runner-event-auth to sync it from agent-runtime/pipeline-runner/event-auth.`;
 }
-function checkKubectlNamespace(namespace, kubeContext) {
+function checkKubectlNamespace(namespace, kubectlOptions) {
 	return checkNamespacedResource(`namespace/${namespace}`, [
 		"get",
 		"namespace",
 		namespace
-	], `Namespace ${namespace} missing or inaccessible.`, kubeContext);
+	], `Namespace ${namespace} missing or inaccessible.`, kubectlOptions);
 }
-async function checkNamespacedResource(name, args, missingDetail, kubeContext) {
-	return (await kubectl(args, kubeContext)).ok ? {
+async function checkNamespacedResource(name, args, missingDetail, kubectlOptions) {
+	const result = await kubectl(args, kubectlOptions);
+	return result.ok ? {
 		detail: "present",
 		name,
 		passed: true
 	} : {
-		detail: missingDetail,
+		detail: inaccessibleOrMissingDetail(name, missingDetail, result),
 		name,
 		passed: false
 	};
 }
-async function checkExternalSecret(namespace, name, remoteRef, kubeContext) {
+async function checkExternalSecret(namespace, name, remoteRef, kubectlOptions) {
 	const result = await kubectl([
 		"get",
 		"externalsecret",
@@ -107,76 +113,79 @@ async function checkExternalSecret(namespace, name, remoteRef, kubeContext) {
 		namespace,
 		"-o",
 		"json"
-	], kubeContext);
-	if (!result.ok) return {
-		detail: `ExternalSecret ${name} missing in ${namespace}; expected it to sync ${remoteRef}.`,
-		name: `externalsecret/${name}`,
-		passed: false
-	};
+	], kubectlOptions);
+	if (!result.ok) {
+		const missingDetail = `ExternalSecret ${name} missing in ${namespace}; expected it to sync ${remoteRef}.`;
+		return {
+			detail: inaccessibleOrMissingDetail(`externalsecret/${name}`, missingDetail, result),
+			name: `externalsecret/${name}`,
+			passed: false
+		};
+	}
 	return readyConditionCheck(`externalsecret/${name}`, result.stdout);
 }
-async function checkClusterSecretStore(name, kubeContext) {
+async function checkClusterSecretStore(name, kubectlOptions) {
 	const result = await kubectl([
 		"get",
 		"clustersecretstore",
 		name,
 		"-o",
 		"json"
-	], kubeContext);
-	if (!result.ok) return {
-		detail: `ClusterSecretStore/${name} missing or inaccessible; OpenBao/ESO readiness is an external prerequisite.`,
-		name: `clustersecretstore/${name}`,
-		passed: false
-	};
+	], kubectlOptions);
+	if (!result.ok) {
+		const missingDetail = `ClusterSecretStore/${name} missing or inaccessible; OpenBao/ESO readiness is an external prerequisite.`;
+		return {
+			detail: inaccessibleOrMissingDetail(`clustersecretstore/${name}`, missingDetail, result),
+			name: `clustersecretstore/${name}`,
+			passed: false
+		};
+	}
 	return readyConditionCheck(`clustersecretstore/${name}`, result.stdout);
 }
-function checkServiceAccount(namespace, name, kubeContext) {
+function checkServiceAccount(namespace, name, kubectlOptions) {
 	return checkNamespacedResource(`serviceaccount/${name}`, [
 		"get",
 		"serviceaccount",
 		name,
 		"-n",
 		namespace
-	], `ServiceAccount ${name} missing in ${namespace}; runner pods must use this account for workflow execution.`, kubeContext);
+	], `ServiceAccount ${name} missing in ${namespace}; runner pods must use this account for workflow execution.`, kubectlOptions);
 }
-async function checkServiceAccountPermission(namespace, serviceAccountName, options) {
-	const subject = `system:serviceaccount:${namespace}:${serviceAccountName}`;
+async function checkWorkflowSubmitPermission(namespace, options) {
 	return (await kubectl([
 		"auth",
 		"can-i",
 		options.verb,
 		options.resource,
-		"--as",
-		subject,
 		"-n",
 		namespace
-	], options.kubeContext)).stdout.trim() === "yes" ? {
-		detail: `${subject} can ${options.verb} ${options.resource}`,
+	], options)).stdout.trim() === "yes" ? {
+		detail: `current kube identity can ${options.verb} ${options.resource}`,
 		name: "rbac/workflow-create",
 		passed: true
 	} : {
-		detail: `${subject} cannot ${options.verb} ${options.resource}; check runner ServiceAccount RBAC.`,
+		detail: `current kube identity cannot ${options.verb} ${options.resource}; check submitter RBAC for Workflow creation.`,
 		name: "rbac/workflow-create",
 		passed: false
 	};
 }
-function checkLocalQueue(namespace, queueName, kubeContext) {
+function checkLocalQueue(namespace, queueName, kubectlOptions) {
 	return checkNamespacedResource(`localqueue/${queueName}`, [
 		"get",
 		"localqueue",
 		queueName,
 		"-n",
 		namespace
-	], `Kueue LocalQueue ${queueName} missing in ${namespace}; runner Workflow pods cannot be admitted to the expected queue.`, kubeContext);
+	], `Kueue LocalQueue ${queueName} missing in ${namespace}; runner Workflow pods cannot be admitted to the expected queue.`, kubectlOptions);
 }
-async function checkClusterResource(name, args, kubeContext) {
-	const result = await kubectl(args, kubeContext);
+async function checkClusterResource(name, args, kubectlOptions) {
+	const result = await kubectl(args, kubectlOptions);
 	return result.ok ? {
 		detail: "present",
 		name,
 		passed: true
 	} : {
-		detail: result.stderr || "missing or inaccessible",
+		detail: isForbidden(result) ? inaccessibleDetail(name, result) : result.stderr || "missing or inaccessible",
 		name,
 		passed: false
 	};
@@ -193,9 +202,12 @@ function readyConditionCheck(name, source) {
 		passed: false
 	};
 }
-async function kubectl(args, kubeContext) {
+async function kubectl(args, options) {
 	try {
-		const result = await execa("kubectl", kubectlArgs(args, kubeContext), { stdin: "ignore" });
+		const result = await execa("kubectl", kubectlArgs(args, options.kubeContext), {
+			env: options.kubeconfigPath ? { KUBECONFIG: options.kubeconfigPath } : void 0,
+			stdin: "ignore"
+		});
 		return {
 			ok: true,
 			stderr: result.stderr,
@@ -217,6 +229,15 @@ function kubectlArgs(args, kubeContext) {
 		...args
 	] : args;
 }
+function inaccessibleOrMissingDetail(name, missingDetail, result) {
+	return isForbidden(result) ? inaccessibleDetail(name, result) : missingDetail;
+}
+function inaccessibleDetail(name, result) {
+	return `${name} inaccessible with the current kube identity: ${result.stderr}`;
+}
+function isForbidden(result) {
+	return FORBIDDEN_RE.test(result.stderr);
+}
 function parseJson(source) {
 	try {
 		return JSON.parse(source);

package/dist/config/schemas.d.ts

@@ -310,6 +310,7 @@ declare const configSchema: z.ZodObject<{
     skills: z.ZodOptional<z.ZodArray<z.ZodString>>;
     timeout_ms: z.ZodOptional<z.ZodNumber>;
     tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+      task: "task";
       read: "read";
       list: "list";
       grep: "grep";
@@ -317,7 +318,6 @@ declare const configSchema: z.ZodObject<{
       bash: "bash";
       edit: "edit";
       write: "write";
-      task: "task";
     }>>>;
   }, z.core.$strict>>>;
   runner_command: z.ZodDefault<z.ZodObject<{
@@ -369,6 +369,7 @@ declare const configSchema: z.ZodObject<{
       rules: z.ZodOptional<z.ZodBoolean>;
       skills: z.ZodOptional<z.ZodBoolean>;
       tools: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+        task: "task";
         read: "read";
         list: "list";
         grep: "grep";
@@ -376,7 +377,6 @@ declare const configSchema: z.ZodObject<{
         bash: "bash";
         edit: "edit";
         write: "write";
-        task: "task";
       }>>>;
     }, z.core.$strict>;
     command: z.ZodOptional<z.ZodString>;