@oisincoveney/pipeline 3.24.2 → 4.0.0

package/dist/run-state/git-refs.js

@@ -1,257 +1,163 @@
+import { isStringValue } from "../schema-boundary.js";
+import "../safe-json.js";
 import { GitPorcelainService, GitPorcelainServiceLive } from "../runtime/services/git-porcelain-service.js";
-import { Effect } from "effect";
 import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, resolve } from "node:path";
+import { Effect, Option } from "effect";
 //#region src/run-state/git-refs.ts
 const DEFAULT_WORKSPACE_PATH = "/workspace";
 const DEFAULT_GIT_CREDENTIALS_DIR = "/etc/pipeline/git-credentials";
 const WRITABLE_GIT_CREDENTIAL_STORE = resolve(tmpdir(), "pipeline-git-credentials");
 const LS_REMOTE_FIELD_SEPARATOR_RE = /\s+/u;
 const SCP_LIKE_SSH_REMOTE_RE = /^[^@\s]+@[^:\s]+:.+/u;
-let preparedBasicAuthCredentialStore;
-function runnerGitRefs(payload, nodeId) {
+const MISSING_REMOTE_URL = Option.none();
+let preparedBasicAuthCredentialStore = Option.none();
+const runnerGitRefs = (payload, nodeId) => {
 	const prefix = `refs/heads/pipeline/runs/${payload.run.id}/${payload.workflow.id}`;
 	return {
 		finalRef: `${prefix}/final`,
 		nodeRef: `${prefix}/nodes/${nodeId}`,
 		prefix
 	};
-}
-async function prepareRunnerGitWorkspace(payload, options = {}) {
-	return await Effect.runPromise(Effect.provide(prepareRunnerGitWorkspaceEffect(payload, options), GitPorcelainServiceLive));
-}
-function prepareRunnerGitWorkspaceEffect(payload, options) {
-	return Effect.gen(function* () {
-		if (options.cwd) return resolve(options.cwd);
-		const worktreePath = options.workspacePath ?? DEFAULT_WORKSPACE_PATH;
-		yield* Effect.sync(() => mkdirSync(dirname(worktreePath), { recursive: true }));
-		yield* runGit(dirname(worktreePath), [
-			"clone",
-			"--no-tags",
-			payload.repository.url,
-			worktreePath
-		]);
-		yield* runGit(worktreePath, ["checkout", payload.repository.sha ?? `origin/${payload.repository.baseBranch}`]);
-		return worktreePath;
-	});
-}
-async function mergeDependencyRefs(input) {
-	return await Effect.runPromise(Effect.provide(mergeDependencyRefsEffect(input), GitPorcelainServiceLive));
-}
-function mergeDependencyRefsEffect(input) {
-	return Effect.gen(function* () {
-		yield* configureGitCommitter(input.worktreePath, input.committer);
-		yield* Effect.forEach(input.dependencyNodeIds, (nodeId) => mergeDependencyRef(input.worktreePath, runnerGitRefs(input.payload, nodeId).nodeRef));
-	});
-}
-function mergeDependencyRef(worktreePath, ref) {
-	return Effect.gen(function* () {
-		yield* runGit(worktreePath, [
-			"fetch",
-			"origin",
-			ref
-		]);
-		yield* runGit(worktreePath, [
-			"merge",
-			"--no-ff",
-			"--no-edit",
-			"FETCH_HEAD"
-		]);
-	});
-}
-async function commitAndPushNodeRef(input) {
-	return await Effect.runPromise(Effect.provide(commitAndPushNodeRefEffect(input), GitPorcelainServiceLive));
-}
-function commitAndPushNodeRefEffect(input) {
-	return Effect.gen(function* () {
-		yield* commitChangesIfNeeded(input.worktreePath, input.nodeId, input.committer);
-		const sha = yield* headSha(input.worktreePath);
-		yield* pushGeneratedRef(input.worktreePath, runnerGitRefs(input.payload, input.nodeId).nodeRef);
-		return sha;
-	});
-}
-/**
-* Run a single git command through the runner's authenticated path: per-command
-* credential-helper store (basic-auth from the mounted git-credentials) plus
-* GIT_TERMINAL_PROMPT=0 so a missing credential fails fast instead of blocking
-* forever on an interactive username prompt. This is the ONE git-auth primitive;
-* every runner git operation (node delivery, dependency merge, open-pull-request)
-* must route through it rather than spawning naked git.
-*/
-async function runAuthenticatedGit(cwd, args) {
-	return await Effect.runPromise(Effect.provide(runGit(cwd, args), GitPorcelainServiceLive));
-}
-async function promoteFinalRef(input) {
-	return await Effect.runPromise(Effect.provide(promoteFinalRefEffect(input), GitPorcelainServiceLive));
-}
-function promoteFinalRefEffect(input) {
-	return Effect.gen(function* () {
-		yield* mergeDependencyRefsEffect({
-			committer: input.committer,
-			dependencyNodeIds: input.sourceNodeIds,
-			payload: input.payload,
-			worktreePath: input.worktreePath
-		});
-		yield* commitChangesIfNeeded(input.worktreePath, "final", input.committer);
-		const sha = yield* headSha(input.worktreePath);
-		yield* pushGeneratedRef(input.worktreePath, runnerGitRefs(input.payload, "final").finalRef);
-		return sha;
-	});
-}
-function pushGeneratedRef(worktreePath, ref) {
-	return Effect.gen(function* () {
-		yield* runGit(worktreePath, [
-			"push",
-			`--force-with-lease=${ref}:${(yield* remoteHeadSha(worktreePath, ref)) ?? ""}`,
-			"origin",
-			`HEAD:${ref}`
-		]);
-	});
-}
-function remoteHeadSha(worktreePath, ref) {
-	return Effect.map(runGit(worktreePath, [
-		"ls-remote",
-		"--heads",
-		"origin",
-		ref
-	]), (stdout) => parseLsRemoteSha(stdout));
-}
-function parseLsRemoteSha(stdout) {
-	const firstLine = stdout.trim().split("\n")[0];
-	return firstLine ? firstLine.split(LS_REMOTE_FIELD_SEPARATOR_RE)[0] : void 0;
-}
-function headSha(worktreePath) {
-	return Effect.map(runGit(worktreePath, ["rev-parse", "HEAD"]), (sha) => sha.trim());
-}
-function runnerCommitMessage(nodeId) {
-	return `chore(pipeline): ${nodeId}`;
-}
-function commitChangesIfNeeded(worktreePath, nodeId, committer) {
-	return Effect.gen(function* () {
-		if ((yield* runGit(worktreePath, [
-			"status",
-			"--porcelain",
-			"--untracked-files=all"
-		])).trim().length === 0) return;
-		yield* runGit(worktreePath, ["add", "--all"]);
-		yield* configureGitCommitter(worktreePath, committer);
-		yield* runGit(worktreePath, [
-			"commit",
-			"-m",
-			runnerCommitMessage(nodeId)
-		]);
-	});
-}
-function configureGitCommitter(worktreePath, committer) {
-	return Effect.gen(function* () {
-		yield* runGit(worktreePath, [
-			"config",
-			"--local",
-			"user.name",
-			committer.name
-		]);
-		yield* runGit(worktreePath, [
-			"config",
-			"--local",
-			"user.email",
-			committer.email
-		]);
-	});
-}
-function runnerGitCommandArgs(args, remoteUrl) {
-	return [...gitCredentialConfigArgs(remoteUrl), ...args];
-}
-function runGit(cwd, args) {
-	return Effect.gen(function* () {
-		const remoteUrl = yield* remoteUrlFromGitArgs(cwd, args);
-		yield* Effect.try({
-			try: () => assertSshCredentialsAvailable(remoteUrl),
-			catch: (error) => error
-		});
-		const git = yield* GitPorcelainService;
-		const commandArgs = runnerGitCommandArgs(args, remoteUrl);
-		return yield* git.run(cwd, commandArgs, runnerGitEnv(remoteUrl));
+};
+const parseLsRemoteSha = (stdout) => {
+	const [firstLine = ""] = stdout.trim().split("\n");
+	if (firstLine.length === 0) return Option.none();
+	const [sha = ""] = firstLine.split(LS_REMOTE_FIELD_SEPARATOR_RE);
+	return Option.some(sha);
+};
+const runnerCommitMessage = (nodeId) => `chore(pipeline): ${nodeId}`;
+const gitCredentialsDir = () => process.env.PIPELINE_GIT_CREDENTIALS_DIR ?? DEFAULT_GIT_CREDENTIALS_DIR;
+const writableGitCredentialStore = () => process.env.PIPELINE_WRITABLE_GIT_CREDENTIAL_STORE ?? WRITABLE_GIT_CREDENTIAL_STORE;
+const writeGitCredentialStore = (credentials, writablePath, host) => {
+	mkdirSync(dirname(writablePath), { recursive: true });
+	writeFileSync(writablePath, `https://${encodeURIComponent(credentials.username)}:${encodeURIComponent(credentials.password)}@${host}\n`, { mode: 384 });
+	chmodSync(writablePath, 384);
+};
+const existingPreparedBasicAuthCredentialStore = (writablePath) => Option.isSome(preparedBasicAuthCredentialStore) && preparedBasicAuthCredentialStore.value.path === writablePath ? Option.some(writablePath) : Option.none();
+const isPreparedBasicAuthCredentialStore = (writablePath, host) => Option.isSome(preparedBasicAuthCredentialStore) && preparedBasicAuthCredentialStore.value.path === writablePath && preparedBasicAuthCredentialStore.value.host === host;
+const errorCode = (error) => error instanceof Error && "code" in error && isStringValue(error.code) ? Option.some(error.code) : Option.none();
+const isReadOnlyFileSystemError = (error) => Option.contains("EROFS")(errorCode(error));
+const isOwnerReadOnly = (path) => {
+	const permissions = statSync(path).mode.toString(8).slice(-3);
+	return [
+		"4",
+		"5",
+		"6",
+		"7"
+	].includes(permissions[0]) && permissions.slice(1) === "00";
+};
+const ensureSshIdentityPermissions = (identityPath) => {
+	try {
+		chmodSync(identityPath, 256);
+		return;
+	} catch (error) {
+		if (!(isReadOnlyFileSystemError(error) && isOwnerReadOnly(identityPath))) throw error;
+	}
+};
+const readCredentialFile = (path) => readFileSync(path, "utf-8").trim();
+const availableBasicAuthCredentials = () => {
+	const credentialsDir = gitCredentialsDir();
+	const usernamePath = resolve(credentialsDir, "username");
+	const passwordPath = resolve(credentialsDir, "password");
+	if (!(existsSync(usernamePath) && existsSync(passwordPath))) return Option.none();
+	return Option.some({
+		password: readCredentialFile(passwordPath),
+		username: readCredentialFile(usernamePath)
 	});
-}
-function assertSshCredentialsAvailable(remoteUrl) {
-	if (!(remoteUrl && isSshRemote(remoteUrl))) return;
+};
+const remoteArgFromGitArgs = (args) => Option.fromUndefinedOr(args.slice(1).find((arg) => !arg.startsWith("-")));
+const gitRemoteUrl = (cwd, remoteName) => Effect.gen(function* effectBody() {
+	const trimmed = (yield* (yield* GitPorcelainService).run(cwd, [
+		"remote",
+		"get-url",
+		remoteName
+	], {
+		...process.env,
+		GIT_TERMINAL_PROMPT: "0"
+	})).trim();
+	return trimmed.length > 0 ? Option.some(trimmed) : Option.none();
+});
+const remoteUrlForName = (cwd, remoteName) => Option.isSome(remoteName) ? gitRemoteUrl(cwd, remoteName.value) : Effect.succeed(MISSING_REMOTE_URL);
+const isHttpRemote = (value) => value.startsWith("http://") || value.startsWith("https://");
+const isScpLikeSshRemote = (value) => SCP_LIKE_SSH_REMOTE_RE.test(value);
+const isRemoteUrl = (value) => value.startsWith("http://") || value.startsWith("https://") || value.startsWith("ssh://") || isScpLikeSshRemote(value);
+const literalRemoteUrlFromGitArgs = (args) => {
+	if (args[0] === "clone") return Option.fromUndefinedOr(args.find((arg) => isRemoteUrl(arg)));
+	if (args[0] === "fetch" || args[0] === "push" || args[0] === "ls-remote") {
+		const remoteArg = remoteArgFromGitArgs(args);
+		if (Option.isSome(remoteArg) && isRemoteUrl(remoteArg.value)) return remoteArg;
+	}
+	return Option.none();
+};
+const remoteNameFromGitArgs = (args) => {
+	if (args[0] === "fetch" || args[0] === "push" || args[0] === "ls-remote") {
+		const remoteArg = remoteArgFromGitArgs(args);
+		if (Option.isSome(remoteArg) && !isRemoteUrl(remoteArg.value)) return remoteArg;
+	}
+	return Option.none();
+};
+const remoteUrlFromGitArgs = (cwd, args) => Effect.gen(function* effectBody() {
+	const literalRemoteUrl = literalRemoteUrlFromGitArgs(args);
+	if (Option.isSome(literalRemoteUrl)) return literalRemoteUrl;
+	const remoteName = remoteNameFromGitArgs(args);
+	return yield* remoteUrlForName(cwd, remoteName);
+});
+const isSshRemote = (value) => value.startsWith("ssh://") || isScpLikeSshRemote(value);
+const assertSshCredentialsAvailable = (remoteUrl) => {
+	if (Option.isNone(remoteUrl) || !isSshRemote(remoteUrl.value)) return;
 	const credentialsDir = gitCredentialsDir();
 	const missing = [["identity", resolve(credentialsDir, "identity")], ["known_hosts", resolve(credentialsDir, "known_hosts")]].filter(([, filePath]) => !existsSync(filePath)).map(([name]) => name);
 	if (missing.length === 0) return;
-	throw new Error(`SSH git remote ${remoteUrl} requires mounted git credential file(s): ${missing.join(", ")}`);
-}
-function gitCredentialConfigArgs(remoteUrl) {
+	throw new Error(`SSH git remote ${remoteUrl.value} requires mounted git credential file(s): ${missing.join(", ")}`);
+};
+const credentialHost = (remoteUrl) => {
+	try {
+		const { host } = new URL(remoteUrl);
+		return host.length > 0 ? Option.some(host) : Option.none();
+	} catch {
+		return Option.none();
+	}
+};
+const prepareBasicAuthCredentialStore = (credentials, writablePath, remoteUrl) => {
+	const host = Option.isSome(remoteUrl) ? credentialHost(remoteUrl.value) : Option.none();
+	if (Option.isNone(host)) return existingPreparedBasicAuthCredentialStore(writablePath);
+	if (isPreparedBasicAuthCredentialStore(writablePath, host.value)) return Option.some(writablePath);
+	writeGitCredentialStore(credentials, writablePath, host.value);
+	preparedBasicAuthCredentialStore = Option.some({
+		host: host.value,
+		path: writablePath
+	});
+	return Option.some(writablePath);
+};
+const prepareWritableGitCredentialStore = (remoteUrl) => {
+	if (Option.isNone(remoteUrl)) return existingPreparedBasicAuthCredentialStore(writableGitCredentialStore());
+	if (!isHttpRemote(remoteUrl.value)) return Option.none();
+	const writablePath = writableGitCredentialStore();
+	const basicAuth = availableBasicAuthCredentials();
+	if (Option.isSome(basicAuth)) return prepareBasicAuthCredentialStore(basicAuth.value, writablePath, remoteUrl);
+	return Option.none();
+};
+const gitCredentialConfigArgs = (remoteUrl) => {
 	const writablePath = prepareWritableGitCredentialStore(remoteUrl);
-	if (!writablePath) return [];
+	if (Option.isNone(writablePath)) return [];
 	return [
 		"-c",
 		"credential.helper=",
 		"-c",
-		`credential.helper=store --file=${writablePath}`
+		`credential.helper=store --file=${writablePath.value}`
 	];
-}
-function prepareWritableGitCredentialStore(remoteUrl) {
-	if (!remoteUrl) return existingPreparedBasicAuthCredentialStore(writableGitCredentialStore());
-	if (!isHttpRemote(remoteUrl)) return;
-	const writablePath = writableGitCredentialStore();
-	const basicAuth = availableBasicAuthCredentials();
-	if (basicAuth) return prepareBasicAuthCredentialStore(basicAuth, writablePath, remoteUrl);
-}
-function availableBasicAuthCredentials() {
-	const credentialsDir = gitCredentialsDir();
-	const usernamePath = resolve(credentialsDir, "username");
-	const passwordPath = resolve(credentialsDir, "password");
-	if (!(existsSync(usernamePath) && existsSync(passwordPath))) return;
-	return {
-		password: readCredentialFile(passwordPath),
-		username: readCredentialFile(usernamePath)
-	};
-}
-function gitCredentialsDir() {
-	return process.env.PIPELINE_GIT_CREDENTIALS_DIR ?? DEFAULT_GIT_CREDENTIALS_DIR;
-}
-function writableGitCredentialStore() {
-	return process.env.PIPELINE_WRITABLE_GIT_CREDENTIAL_STORE ?? WRITABLE_GIT_CREDENTIAL_STORE;
-}
-function writeGitCredentialStore(credentials, writablePath, host) {
-	mkdirSync(dirname(writablePath), { recursive: true });
-	writeFileSync(writablePath, `https://${encodeURIComponent(credentials.username)}:${encodeURIComponent(credentials.password)}@${host}\n`, { mode: 384 });
-	chmodSync(writablePath, 384);
-}
-function prepareBasicAuthCredentialStore(credentials, writablePath, remoteUrl) {
-	const host = remoteUrl ? credentialHost(remoteUrl) : void 0;
-	if (!host) return existingPreparedBasicAuthCredentialStore(writablePath);
-	if (isPreparedBasicAuthCredentialStore(writablePath, host)) return writablePath;
-	writeGitCredentialStore(credentials, writablePath, host);
-	preparedBasicAuthCredentialStore = {
-		host,
-		path: writablePath
-	};
-	return writablePath;
-}
-function existingPreparedBasicAuthCredentialStore(writablePath) {
-	return preparedBasicAuthCredentialStore?.path === writablePath ? writablePath : void 0;
-}
-function isPreparedBasicAuthCredentialStore(writablePath, host) {
-	return preparedBasicAuthCredentialStore?.path === writablePath && preparedBasicAuthCredentialStore.host === host;
-}
-function runnerGitEnv(remoteUrl) {
-	const env = {
-		...process.env,
-		GIT_TERMINAL_PROMPT: "0"
-	};
-	const sshCommand = gitSshCommand();
-	if (sshCommand && remoteUrl && isSshRemote(remoteUrl)) env.GIT_SSH_COMMAND = sshCommand;
-	return env;
-}
-function gitSshCommand() {
+};
+const runnerGitCommandArgs = (args, remoteUrl) => [...gitCredentialConfigArgs(remoteUrl), ...args];
+const shellQuote = (value) => `'${value.replaceAll("'", `'\\''`)}'`;
+const gitSshCommand = () => {
 	const credentialsDir = gitCredentialsDir();
 	const identityPath = resolve(credentialsDir, "identity");
 	const knownHostsPath = resolve(credentialsDir, "known_hosts");
-	if (!(existsSync(identityPath) && existsSync(knownHostsPath))) return;
+	if (!(existsSync(identityPath) && existsSync(knownHostsPath))) return Option.none();
 	ensureSshIdentityPermissions(identityPath);
-	return [
+	return Option.some([
 		"ssh",
 		"-i",
 		shellQuote(identityPath),
@@ -261,90 +167,135 @@ function gitSshCommand() {
 		`UserKnownHostsFile=${shellQuote(knownHostsPath)}`,
 		"-o",
 		"StrictHostKeyChecking=yes"
-	].join(" ");
-}
-function ensureSshIdentityPermissions(identityPath) {
-	try {
-		chmodSync(identityPath, 256);
-		return;
-	} catch (error) {
-		if (!(isReadOnlyFileSystemError(error) && isOwnerReadOnly(identityPath))) throw error;
-	}
-}
-function isReadOnlyFileSystemError(error) {
-	return error instanceof Error && "code" in error && error.code === "EROFS";
-}
-function isOwnerReadOnly(path) {
-	const permissions = statSync(path).mode.toString(8).slice(-3);
-	return [
-		"4",
-		"5",
-		"6",
-		"7"
-	].includes(permissions[0] ?? "") && permissions.slice(1) === "00";
-}
-function readCredentialFile(path) {
-	return readFileSync(path, "utf8").trim();
-}
-function remoteUrlFromGitArgs(cwd, args) {
-	return Effect.gen(function* () {
-		const literalRemoteUrl = literalRemoteUrlFromGitArgs(args);
-		if (literalRemoteUrl) return literalRemoteUrl;
-		return yield* remoteUrlForName(cwd, remoteNameFromGitArgs(args));
+	].join(" "));
+};
+const runnerGitEnv = (remoteUrl) => {
+	const env = {
+		...process.env,
+		GIT_TERMINAL_PROMPT: "0"
+	};
+	const sshCommand = gitSshCommand();
+	if (Option.isSome(sshCommand) && Option.isSome(remoteUrl) && isSshRemote(remoteUrl.value)) env.GIT_SSH_COMMAND = sshCommand.value;
+	return env;
+};
+const runGit = (cwd, args) => Effect.gen(function* effectBody() {
+	const remoteUrl = yield* remoteUrlFromGitArgs(cwd, args);
+	yield* Effect.try({
+		catch: (error) => error,
+		try: () => {
+			assertSshCredentialsAvailable(remoteUrl);
+		}
 	});
-}
-function remoteUrlForName(cwd, remoteName) {
-	return remoteName ? gitRemoteUrl(cwd, remoteName) : Effect.succeed(void 0);
-}
-function literalRemoteUrlFromGitArgs(args) {
-	if (args[0] === "clone") return args.find((arg) => isRemoteUrl(arg));
-	if (args[0] === "fetch" || args[0] === "push" || args[0] === "ls-remote") {
-		const remoteArg = remoteArgFromGitArgs(args);
-		return remoteArg && isRemoteUrl(remoteArg) ? remoteArg : void 0;
-	}
-}
-function remoteNameFromGitArgs(args) {
-	if (args[0] === "fetch" || args[0] === "push" || args[0] === "ls-remote") {
-		const remoteArg = remoteArgFromGitArgs(args);
-		if (remoteArg && !remoteArg.startsWith("-") && !isRemoteUrl(remoteArg)) return remoteArg;
-	}
-}
-function remoteArgFromGitArgs(args) {
-	return args.slice(1).find((arg) => !arg.startsWith("-"));
-}
-function gitRemoteUrl(cwd, remoteName) {
-	return Effect.gen(function* () {
-		return (yield* (yield* GitPorcelainService).run(cwd, [
-			"remote",
-			"get-url",
-			remoteName
-		], {
-			...process.env,
-			GIT_TERMINAL_PROMPT: "0"
-		})).trim() || void 0;
+	const git = yield* GitPorcelainService;
+	const commandArgs = runnerGitCommandArgs(args, remoteUrl);
+	return yield* git.run(cwd, commandArgs, runnerGitEnv(remoteUrl));
+});
+const prepareRunnerGitWorkspaceEffect = (payload, options) => Effect.gen(function* effectBody() {
+	if (options.cwd !== void 0 && options.cwd.length > 0) return resolve(options.cwd);
+	const worktreePath = options.workspacePath ?? DEFAULT_WORKSPACE_PATH;
+	yield* Effect.sync(() => mkdirSync(dirname(worktreePath), { recursive: true }));
+	yield* runGit(dirname(worktreePath), [
+		"clone",
+		"--no-tags",
+		payload.repository.url,
+		worktreePath
+	]);
+	yield* runGit(worktreePath, ["checkout", payload.repository.sha ?? `origin/${payload.repository.baseBranch}`]);
+	return worktreePath;
+});
+const prepareRunnerGitWorkspace = async (payload, options = {}) => await Effect.runPromise(Effect.provide(prepareRunnerGitWorkspaceEffect(payload, options), GitPorcelainServiceLive));
+const mergeDependencyRef = (worktreePath, ref) => Effect.gen(function* effectBody() {
+	yield* runGit(worktreePath, [
+		"fetch",
+		"origin",
+		ref
+	]);
+	yield* runGit(worktreePath, [
+		"merge",
+		"--no-ff",
+		"--no-edit",
+		"FETCH_HEAD"
+	]);
+});
+/**
+* Run a single git command through the runner's authenticated path: per-command
+* credential-helper store (basic-auth from the mounted git-credentials) plus
+* GIT_TERMINAL_PROMPT=0 so a missing credential fails fast instead of blocking
+* forever on an interactive username prompt. This is the ONE git-auth primitive;
+* every runner git operation (node delivery, dependency merge, open-pull-request)
+* must route through it rather than spawning naked git.
+*/
+const runAuthenticatedGit = async (cwd, args) => await Effect.runPromise(Effect.provide(runGit(cwd, args), GitPorcelainServiceLive));
+const remoteHeadSha = (worktreePath, ref) => Effect.map(runGit(worktreePath, [
+	"ls-remote",
+	"--heads",
+	"origin",
+	ref
+]), (stdout) => parseLsRemoteSha(stdout));
+const pushGeneratedRef = (worktreePath, ref) => Effect.gen(function* effectBody() {
+	const expectedSha = yield* remoteHeadSha(worktreePath, ref);
+	yield* runGit(worktreePath, [
+		"push",
+		`--force-with-lease=${ref}:${Option.getOrElse(expectedSha, () => "")}`,
+		"origin",
+		`HEAD:${ref}`
+	]);
+});
+const headSha = (worktreePath) => Effect.map(runGit(worktreePath, ["rev-parse", "HEAD"]), (sha) => sha.trim());
+const configureGitCommitter = (worktreePath, committer) => Effect.gen(function* effectBody() {
+	yield* runGit(worktreePath, [
+		"config",
+		"--local",
+		"user.name",
+		committer.name
+	]);
+	yield* runGit(worktreePath, [
+		"config",
+		"--local",
+		"user.email",
+		committer.email
+	]);
+});
+const mergeDependencyRefsEffect = (input) => Effect.gen(function* effectBody() {
+	yield* configureGitCommitter(input.worktreePath, input.committer);
+	yield* Effect.forEach(input.dependencyNodeIds, (nodeId) => mergeDependencyRef(input.worktreePath, runnerGitRefs(input.payload, nodeId).nodeRef));
+});
+const mergeDependencyRefs = async (input) => {
+	await Effect.runPromise(Effect.provide(mergeDependencyRefsEffect(input), GitPorcelainServiceLive));
+};
+const commitChangesIfNeeded = (worktreePath, nodeId, committer) => Effect.gen(function* effectBody() {
+	if ((yield* runGit(worktreePath, [
+		"status",
+		"--porcelain",
+		"--untracked-files=all"
+	])).trim().length === 0) return;
+	yield* runGit(worktreePath, ["add", "--all"]);
+	yield* configureGitCommitter(worktreePath, committer);
+	yield* runGit(worktreePath, [
+		"commit",
+		"-m",
+		runnerCommitMessage(nodeId)
+	]);
+});
+const commitAndPushNodeRefEffect = (input) => Effect.gen(function* effectBody() {
+	yield* commitChangesIfNeeded(input.worktreePath, input.nodeId, input.committer);
+	const sha = yield* headSha(input.worktreePath);
+	yield* pushGeneratedRef(input.worktreePath, runnerGitRefs(input.payload, input.nodeId).nodeRef);
+	return sha;
+});
+const commitAndPushNodeRef = async (input) => await Effect.runPromise(Effect.provide(commitAndPushNodeRefEffect(input), GitPorcelainServiceLive));
+const promoteFinalRefEffect = (input) => Effect.gen(function* effectBody() {
+	yield* mergeDependencyRefsEffect({
+		committer: input.committer,
+		dependencyNodeIds: input.sourceNodeIds,
+		payload: input.payload,
+		worktreePath: input.worktreePath
 	});
-}
-function isRemoteUrl(value) {
-	return value.startsWith("http://") || value.startsWith("https://") || value.startsWith("ssh://") || isScpLikeSshRemote(value);
-}
-function isSshRemote(value) {
-	return value.startsWith("ssh://") || isScpLikeSshRemote(value);
-}
-function isHttpRemote(value) {
-	return value.startsWith("http://") || value.startsWith("https://");
-}
-function isScpLikeSshRemote(value) {
-	return SCP_LIKE_SSH_REMOTE_RE.test(value);
-}
-function credentialHost(remoteUrl) {
-	try {
-		return new URL(remoteUrl).host || void 0;
-	} catch {
-		return;
-	}
-}
-function shellQuote(value) {
-	return `'${value.replaceAll("'", `'\\''`)}'`;
-}
+	yield* commitChangesIfNeeded(input.worktreePath, "final", input.committer);
+	const sha = yield* headSha(input.worktreePath);
+	yield* pushGeneratedRef(input.worktreePath, runnerGitRefs(input.payload, "final").finalRef);
+	return sha;
+});
+const promoteFinalRef = async (input) => await Effect.runPromise(Effect.provide(promoteFinalRefEffect(input), GitPorcelainServiceLive));
 //#endregion
 export { commitAndPushNodeRef, mergeDependencyRefs, prepareRunnerGitWorkspace, promoteFinalRef, runAuthenticatedGit, runnerCommitMessage };

package/dist/runner/opencode-excludes.js

@@ -9,15 +9,15 @@ const OPENCODE_EXCLUDES = [
 	"build/",
 	"coverage/"
 ];
-const LINE_RE = /\r?\n/;
-function ensureOpencodeGitExcludes(worktreePath) {
+const LINE_RE = /\r?\n/u;
+const ensureOpencodeGitExcludes = (worktreePath) => {
 	const excludePath = join(worktreePath, ".git", "info", "exclude");
 	if (!existsSync(excludePath)) return;
-	const existing = readFileSync(excludePath, "utf8");
+	const existing = readFileSync(excludePath, "utf-8");
 	const missing = OPENCODE_EXCLUDES.filter((entry) => !existing.split(LINE_RE).includes(entry));
 	if (missing.length === 0) return;
 	mkdirSync(join(worktreePath, ".git", "info"), { recursive: true });
 	appendFileSync(excludePath, `${existing.endsWith("\n") ? "" : "\n"}# oisin-pipeline opencode excludes\n${missing.join("\n")}\n`);
-}
+};
 //#endregion
 export { ensureOpencodeGitExcludes };