@olivervea/pipelines 2.0.0-beta.27 → 2.0.0-beta.29

package/src/describe/triggers.ts

@@ -0,0 +1,72 @@
+import { STEP_NAME } from '../core/steps.ts';
+import type { TriggerNode } from '../builder/pipeline.ts';
+import type { TriggerT } from './manifest-schema.ts';
+import type { DescribeContext } from './context.ts';
+
+export function describeTriggers(
+  ctx: DescribeContext,
+  triggers: readonly TriggerNode[],
+): TriggerT[] {
+  const names = new Set<string>();
+  return triggers.map((t) => {
+    if (names.has(t.name))
+      ctx.problems.push(
+        `duplicate trigger '${t.name}'${t.kind === 'push' ? ' (onPush may be used once)' : ' (give each onPoll and onWebhook a distinct name)'}`,
+      );
+    names.add(t.name);
+    if (t.kind === 'push') return { kind: 'push', name: 'push' };
+    if (t.kind === 'webhook') return describeWebhook(ctx, t);
+    return describePoll(ctx, t);
+  });
+}
+
+function describeWebhook(
+  ctx: DescribeContext,
+  t: Extract<TriggerNode, { kind: 'webhook' }>,
+): TriggerT {
+  if (!STEP_NAME.test(t.name))
+    ctx.problems.push(`webhook trigger name '${t.name}' must be lower-case kebab`);
+  const secret = ctx.useSecret(t.verify.secret, `webhook '${t.name}'`);
+  if (t.verify.scheme === 'bearer')
+    return { kind: 'webhook', name: t.name, verify: { scheme: 'bearer', secret } };
+  if (!t.verify.header)
+    ctx.problems.push(`webhook '${t.name}': the signature header must not be empty`);
+  return {
+    kind: 'webhook',
+    name: t.name,
+    verify: {
+      scheme: 'hmac-sha256',
+      secret,
+      header: t.verify.header,
+      prefix: t.verify.prefix,
+    },
+  };
+}
+
+function describePoll(
+  ctx: DescribeContext,
+  t: Extract<TriggerNode, { kind: 'poll' }>,
+): TriggerT {
+  const problems = ctx.problems;
+  if (!STEP_NAME.test(t.name))
+    problems.push(`poll trigger name '${t.name}' must be lower-case kebab`);
+  if (!(Number.isInteger(t.intervalSeconds) && t.intervalSeconds > 0))
+    problems.push(`poll '${t.name}': intervalSeconds must be a positive integer`);
+  const declared = new Set(t.secrets.map((s) => ctx.useSecret(s, `poll '${t.name}'`)));
+  for (const [h, v] of Object.entries(t.headers)) {
+    for (const m of v.matchAll(/\$SECRET:([A-Za-z0-9_]+)/g))
+      if (!declared.has(m[1]!))
+        problems.push(
+          `poll '${t.name}': header '${h}' references secret '${m[1]}', which is not in the poll's secrets`,
+        );
+  }
+  return {
+    kind: 'poll',
+    name: t.name,
+    url: t.url,
+    headers: { ...t.headers },
+    secrets: [...declared].sort(),
+    valuePath: t.valuePath,
+    intervalSeconds: t.intervalSeconds,
+  };
+}

package/src/library/image-build.ts

@@ -101,6 +101,12 @@ export interface ImageBuildDef<N extends string, K extends string = never> {
    * Used for kaniko's push, base image and cache pulls from that registry, and the `contentTag` lookup.
    */
   registryAuth?: RegistryAuth<K> | ConfigRef<RegistryAuthConfig | undefined>;
+  /**
+   * kaniko's layer cache: a repository it reuses unchanged layers from and pushes new ones to. Default
+   * `<repository>/cache` when pushing, none for a tarball build; `false` turns it off. Login and plain
+   * HTTP apply when it is on `repository`'s registry. An unreachable cache is skipped, never a failure.
+   */
+  cacheRepo?: Configurable<string | false | undefined>;
   /** The registry of `repository` speaks plain HTTP (a local `registry:2`). */
   insecureRegistry?: Configurable<boolean | undefined>;
   /** Secrets a config-referenced `registryAuth` may name (the step declares them). */
@@ -197,6 +203,22 @@ export async function reachableMirrors(
   return reachable;
 }
 
+/** The layer cache repository when its registry answers, else nothing (logged). */
+export async function reachableCache(
+  ctx: Pick<Ctx, 'http' | 'log' | 'signal'>,
+  cacheRepo: string | false,
+  insecureHosts: readonly string[] = [],
+): Promise<string | undefined> {
+  if (!cacheRepo) return undefined;
+  const host = registryHost(cacheRepo);
+  if (
+    await registryUp(ctx.http, host, ctx.signal, undefined, insecureHosts.includes(host))
+  )
+    return cacheRepo;
+  ctx.log(`${host} unreachable; building without the layer cache`);
+  return undefined;
+}
+
 /** Default `retries`: a stalled or flaky build gets two fresh attempts before the run fails. */
 export const DEFAULT_RETRIES = 2;
 
@@ -446,6 +468,7 @@ export function imageBuild<const N extends string, const K extends string = neve
       ...(push ? { push: true } : {}),
       ...(contentTag ? { contentTag: true } : {}),
       ...(mapped ? { registryMap } : {}),
+      ...(def.cacheRepo !== undefined ? { cacheRepo: def.cacheRepo } : {}),
       ...(authSecret
         ? {
             registryAuth: {
@@ -468,6 +491,7 @@ export function imageBuild<const N extends string, const K extends string = neve
       {
         repository: def.repository,
         registryMap: def.registryMap,
+        cacheRepo: def.cacheRepo,
         insecureRegistry: def.insecureRegistry,
         registryAuth: def.registryAuth,
         enabled: def.enabled,
@@ -520,6 +544,12 @@ export function imageBuild<const N extends string, const K extends string = neve
       (d.registryMap as Record<string, string> | undefined) ?? DEFAULT_REGISTRY_MAP,
       insecure ? [host] : [],
     );
+    const cache = await reachableCache(
+      ctx,
+      (d.cacheRepo as string | false | undefined) ??
+        (push ? `${repository}/cache` : false),
+      insecure ? [host] : [],
+    );
     await ctx.exec(['mkdir', '-p', KANIKO_CONTEXT]);
     await ctx.exec(['cp', '-r', `${tree}/.`, KANIKO_CONTEXT]);
     const kanikoContext = context ? `${KANIKO_CONTEXT}/${context}` : KANIKO_CONTEXT;
@@ -543,6 +573,7 @@ export function imageBuild<const N extends string, const K extends string = neve
         `--destination=${repository}:${tag}`,
         ...(insecure ? ['--insecure', `--insecure-registry=${host}`] : []),
         ...KANIKO_BUILD_FLAGS,
+        ...(cache ? ['--cache=true', `--cache-repo=${cache}`] : []),
         ...Object.entries(mirrors).map(([from, to]) => `--registry-map=${from}=${to}`),
       ],
       { idleTimeoutSeconds: def.stallTimeoutSeconds ?? DEFAULT_STALL_TIMEOUT_SECONDS },