@omega.js/desktop 0.50.0 → 0.52.0

package/dist/test/suites/build/resolve-icons.test.js

@@ -43,15 +43,15 @@ module.exports = defineCases({
       run: async (ctx) => {
         const { root, projectRoot, distRoot, emDefaultsRoot } = stage();
         try {
-          fakePng(path.join(emDefaultsRoot, 'icons', 'macos', 'icon.png'));
+          fakePng(path.join(emDefaultsRoot, 'icons', 'mac', 'icon.png'));
           fakePng(path.join(emDefaultsRoot, 'icons', 'windows', 'icon.png'));
 
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
-          ctx.expect(out.macos.app).toBe(path.join(distRoot, 'config', 'icons', 'macos', 'icon.png'));
+          ctx.expect(out.mac.app).toBe(path.join(distRoot, 'config', 'icons', 'mac', 'icon.png'));
           ctx.expect(out.windows.app).toBe(path.join(distRoot, 'config', 'icons', 'windows', 'icon.png'));
-          ctx.expect(jetpack.exists(out.macos.app)).toBeTruthy();
+          ctx.expect(jetpack.exists(out.mac.app)).toBeTruthy();
           ctx.expect(jetpack.exists(out.windows.app)).toBeTruthy();
         } finally {
           fs.rmSync(root, { recursive: true, force: true });
@@ -63,15 +63,15 @@ module.exports = defineCases({
       run: async (ctx) => {
         const { root, projectRoot, distRoot, emDefaultsRoot } = stage();
         try {
-          fakePng(path.join(emDefaultsRoot, 'icons', 'macos', 'icon.png'));
-          const consumerIcon = path.join(projectRoot, 'config', 'icons', 'macos', 'icon.png');
+          fakePng(path.join(emDefaultsRoot, 'icons', 'mac', 'icon.png'));
+          const consumerIcon = path.join(projectRoot, 'config', 'icons', 'mac', 'icon.png');
           fakePng(consumerIcon);
           fs.writeFileSync(consumerIcon, Buffer.from('consumer-bytes'));
 
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
-          const bytes = fs.readFileSync(out.macos.app);
+          const bytes = fs.readFileSync(out.mac.app);
           ctx.expect(bytes.toString()).toBe('consumer-bytes');
         } finally {
           fs.rmSync(root, { recursive: true, force: true });
@@ -84,7 +84,7 @@ module.exports = defineCases({
         const { root, projectRoot, distRoot, emDefaultsRoot } = stage();
         try {
           // Bundled defaults exist for all three platforms — but consumer-global wins.
-          fakePng(path.join(emDefaultsRoot, 'icons', 'macos', 'icon.png'));
+          fakePng(path.join(emDefaultsRoot, 'icons', 'mac', 'icon.png'));
           fakePng(path.join(emDefaultsRoot, 'icons', 'windows', 'icon.png'));
 
           // Consumer ships ONE file at the global path. All three platforms pick it up.
@@ -95,7 +95,7 @@ module.exports = defineCases({
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
-          for (const platform of ['macos', 'windows', 'linux']) {
+          for (const platform of ['mac', 'windows', 'linux']) {
             ctx.expect(out[platform].app).toBeDefined();
             const bytes = fs.readFileSync(out[platform].app);
             ctx.expect(bytes.toString()).toBe('global-bytes');
@@ -118,14 +118,14 @@ module.exports = defineCases({
           fs.writeFileSync(globalIcon, Buffer.from('global-bytes'));
 
           // Mac-specific override exists — should win for macOS.
-          const macIcon = path.join(projectRoot, 'config', 'icons', 'macos', 'icon.png');
+          const macIcon = path.join(projectRoot, 'config', 'icons', 'mac', 'icon.png');
           fakePng(macIcon);
           fs.writeFileSync(macIcon, Buffer.from('mac-specific-bytes'));
 
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
-          ctx.expect(fs.readFileSync(out.macos.app).toString()).toBe('mac-specific-bytes');
+          ctx.expect(fs.readFileSync(out.mac.app).toString()).toBe('mac-specific-bytes');
           ctx.expect(fs.readFileSync(out.windows.app).toString()).toBe('global-bytes');
           ctx.expect(fs.readFileSync(out.linux.app).toString()).toBe('global-bytes');
         } finally {
@@ -200,37 +200,37 @@ module.exports = defineCases({
       run: async (ctx) => {
         const { root, projectRoot, distRoot, emDefaultsRoot } = stage();
         try {
-          fakePng(path.join(emDefaultsRoot, 'icons', 'macos', 'icon.png'));
+          fakePng(path.join(emDefaultsRoot, 'icons', 'mac', 'icon.png'));
           // Input source files at retina (native) size. @omega.js/desktop should emit both @1x + @2x in dist.
           // Tray input is `tray.png`; @omega.js/desktop renames the dist output to `trayTemplate.png` (macOS magic).
-          await realPng(path.join(emDefaultsRoot, 'icons', 'macos', 'tray.png'), 32, 32);
-          await realPng(path.join(emDefaultsRoot, 'icons', 'macos', 'dmg.png'), 1080, 760);
+          await realPng(path.join(emDefaultsRoot, 'icons', 'mac', 'tray.png'), 32, 32);
+          await realPng(path.join(emDefaultsRoot, 'icons', 'mac', 'dmg.png'), 1080, 760);
 
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
           // Both @1x and @2x slots populated.
-          ctx.expect(out.macos.tray).toBeDefined();
-          ctx.expect(out.macos.tray2x).toBeDefined();
-          ctx.expect(out.macos.dmg).toBeDefined();
-          ctx.expect(out.macos.dmg2x).toBeDefined();
+          ctx.expect(out.mac.tray).toBeDefined();
+          ctx.expect(out.mac.tray2x).toBeDefined();
+          ctx.expect(out.mac.dmg).toBeDefined();
+          ctx.expect(out.mac.dmg2x).toBeDefined();
           // app slot has no retina flag.
-          ctx.expect(out.macos.app2x).toBeUndefined();
+          ctx.expect(out.mac.app2x).toBeUndefined();
 
           // Tray output filename is trayTemplate.png (renamed for macOS auto-inversion magic).
-          ctx.expect(path.basename(out.macos.tray)).toBe('trayTemplate.png');
-          ctx.expect(path.basename(out.macos.tray2x)).toBe('trayTemplate@2x.png');
+          ctx.expect(path.basename(out.mac.tray)).toBe('trayTemplate.png');
+          ctx.expect(path.basename(out.mac.tray2x)).toBe('trayTemplate@2x.png');
 
           // @1x derived at half the @2x dimensions.
-          const tray1xMeta = await sharp(out.macos.tray).metadata();
-          const tray2xMeta = await sharp(out.macos.tray2x).metadata();
+          const tray1xMeta = await sharp(out.mac.tray).metadata();
+          const tray2xMeta = await sharp(out.mac.tray2x).metadata();
           ctx.expect(tray1xMeta.width).toBe(16);
           ctx.expect(tray1xMeta.height).toBe(16);
           ctx.expect(tray2xMeta.width).toBe(32);
           ctx.expect(tray2xMeta.height).toBe(32);
 
-          const dmg1xMeta = await sharp(out.macos.dmg).metadata();
-          const dmg2xMeta = await sharp(out.macos.dmg2x).metadata();
+          const dmg1xMeta = await sharp(out.mac.dmg).metadata();
+          const dmg2xMeta = await sharp(out.mac.dmg2x).metadata();
           ctx.expect(dmg1xMeta.width).toBe(540);
           ctx.expect(dmg1xMeta.height).toBe(380);
           ctx.expect(dmg2xMeta.width).toBe(1080);
@@ -245,20 +245,20 @@ module.exports = defineCases({
       run: async (ctx) => {
         const { root, projectRoot, distRoot, emDefaultsRoot } = stage();
         try {
-          fakePng(path.join(emDefaultsRoot, 'icons', 'macos', 'icon.png'));
-          await realPng(path.join(emDefaultsRoot, 'icons', 'macos', 'tray.png'), 32, 32);
+          fakePng(path.join(emDefaultsRoot, 'icons', 'mac', 'icon.png'));
+          await realPng(path.join(emDefaultsRoot, 'icons', 'mac', 'tray.png'), 32, 32);
           // Consumer ships ONE file as `tray.png` (at @2x native size).
-          const consumerTray = path.join(projectRoot, 'config', 'icons', 'macos', 'tray.png');
+          const consumerTray = path.join(projectRoot, 'config', 'icons', 'mac', 'tray.png');
           await realPng(consumerTray, 32, 32);
 
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
-          ctx.expect(out.macos.tray).toBeDefined();
-          ctx.expect(out.macos.tray2x).toBeDefined();
+          ctx.expect(out.mac.tray).toBeDefined();
+          ctx.expect(out.mac.tray2x).toBeDefined();
           // Output is still trayTemplate.png regardless of input name.
-          ctx.expect(path.basename(out.macos.tray)).toBe('trayTemplate.png');
-          const tray1xMeta = await sharp(out.macos.tray).metadata();
+          ctx.expect(path.basename(out.mac.tray)).toBe('trayTemplate.png');
+          const tray1xMeta = await sharp(out.mac.tray).metadata();
           ctx.expect(tray1xMeta.width).toBe(16);
         } finally {
           fs.rmSync(root, { recursive: true, force: true });
@@ -270,7 +270,7 @@ module.exports = defineCases({
       run: async (ctx) => {
         const { root, projectRoot, distRoot, emDefaultsRoot } = stage();
         try {
-          fakePng(path.join(emDefaultsRoot, 'icons', 'macos', 'icon.png'));
+          fakePng(path.join(emDefaultsRoot, 'icons', 'mac', 'icon.png'));
           fakePng(path.join(emDefaultsRoot, 'icons', 'windows', 'icon.png'));
 
           // Consumer ships ONE tray file under global/.
@@ -279,13 +279,13 @@ module.exports = defineCases({
           const { resolveAndCopy } = require(path.join(__dirname, '..', '..', '..', 'lib', 'sign-helpers', 'resolve-icons.js'));
           const out = await resolveAndCopy({ config: {}, projectRoot, distRoot, emDefaultsRoot });
 
-          ctx.expect(out.macos.tray).toBeDefined();
-          ctx.expect(out.macos.tray2x).toBeDefined();
+          ctx.expect(out.mac.tray).toBeDefined();
+          ctx.expect(out.mac.tray2x).toBeDefined();
           ctx.expect(out.windows.tray).toBeDefined();
           ctx.expect(out.linux.tray).toBeDefined();
 
           // macOS @1x derived at half size from the global @2x source.
-          const macTrayMeta = await sharp(out.macos.tray).metadata();
+          const macTrayMeta = await sharp(out.mac.tray).metadata();
           ctx.expect(macTrayMeta.width).toBe(16);
         } finally {
           fs.rmSync(root, { recursive: true, force: true });

package/dist/test/suites/build/runner-job-guard.test.js

@@ -0,0 +1,182 @@
+// The self-hosted signer's job guard
+// ([#875](https://github.com/Omega-JS-Stack/omega/issues/875)): the hook the
+// runner runs before a job's first step, and the three files the runner install
+// writes beside the runner so it has an allow list to read.
+//
+// The hook is run here the way the runner runs it (a node process with the
+// job's environment and nothing else), because the EXIT CODE is the whole
+// mechanism: nonzero and the job dies with the script's output, before the
+// checkout, before npm, before signtool ever sees the token.
+//
+// Nothing in this file touches a real box: every write goes to a scratch home
+// under the OS temp dir, and no verb of `commands/runner.js` is called at all.
+
+const path = require('path');
+const fs   = require('fs');
+const os   = require('os');
+const { spawnSync } = require('child_process');
+const defineCases = require('../../../vendor/devkit/test/define-cases.js');
+
+const guard = require('../../../utils/runner-job-guard.js');
+const hook  = require('../../../runner/job-started.js');
+const { ensureRunnerDirEnv } = require('../../../utils/runner-env.js');
+
+const scratchHome = () => fs.mkdtempSync(path.join(os.tmpdir(), 'omega-job-guard-'));
+
+// One job, as the runner delivers it: the three names the hook reads, and no
+// inherited GITHUB_* (a run of this suite inside a job carries its own).
+function runHook(hookPath, job) {
+  return spawnSync(process.execPath, [hookPath], {
+    env: { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot || '', ...job },
+    encoding: 'utf8',
+  });
+}
+
+module.exports = defineCases({
+  type: 'suite',
+  layer: 'build',
+  description: 'runner job guard (#875): the box refuses any job that is not a trusted dispatch',
+  tests: [
+    {
+      name: 'a dispatch from a listed repo by a listed actor is allowed, and every other job is refused with one line naming the check and the value',
+      run: (ctx) => {
+        const home = scratchHome();
+        const { hook: hookPath } = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+
+        // The passing case, on the ONE trusted event (#923).
+        const ok = runHook(hookPath, { GITHUB_EVENT_NAME: 'workflow_dispatch', GITHUB_REPOSITORY: 'Omega-JS-Stack/omega-omega', GITHUB_ACTOR: 'ianwieds' });
+        ctx.expect(ok.status).toBe(0);
+        ctx.expect(ok.stdout.trim()).toBe('Allowing this job: workflow_dispatch on Omega-JS-Stack/omega-omega by ianwieds.');
+
+        // Each failing check: nonzero, and ONE line carrying the env name that
+        // failed and the value seen.
+        const cases = [
+          [{ GITHUB_EVENT_NAME: 'pull_request', GITHUB_REPOSITORY: 'Omega-JS-Stack/omega-omega', GITHUB_ACTOR: 'ianwieds' }, 'GITHUB_EVENT_NAME', 'pull_request'],
+          [{ GITHUB_EVENT_NAME: 'repository_dispatch', GITHUB_REPOSITORY: 'Omega-JS-Stack/omega-omega', GITHUB_ACTOR: 'ianwieds' }, 'GITHUB_EVENT_NAME', 'repository_dispatch'],
+          [{ GITHUB_EVENT_NAME: 'push', GITHUB_REPOSITORY: 'Omega-JS-Stack/omega-omega', GITHUB_ACTOR: 'ianwieds' }, 'GITHUB_EVENT_NAME', 'push'],
+          [{ GITHUB_EVENT_NAME: 'workflow_dispatch', GITHUB_REPOSITORY: 'someone-else/their-app', GITHUB_ACTOR: 'ianwieds' }, 'GITHUB_REPOSITORY', 'someone-else/their-app'],
+          [{ GITHUB_EVENT_NAME: 'workflow_dispatch', GITHUB_REPOSITORY: 'Omega-JS-Stack/omega-omega', GITHUB_ACTOR: 'mallory' }, 'GITHUB_ACTOR', 'mallory'],
+        ];
+
+        for (const [job, name, value] of cases) {
+          const refused = runHook(hookPath, job);
+          ctx.expect(refused.status).toBe(1);
+          ctx.expect(refused.stdout.trim().split('\n').length).toBe(1);
+          ctx.expect(refused.stdout).toContain(name);
+          ctx.expect(refused.stdout).toContain(value);
+        }
+
+        fs.rmSync(home, { recursive: true, force: true });
+      },
+    },
+    {
+      name: 'a job with no environment at all is refused, and so is one whose allow list is missing',
+      run: (ctx) => {
+        const home = scratchHome();
+        const { hook: hookPath, repos } = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+
+        // The runner always sets these; a hook run without them is a hook run
+        // that cannot answer the question, which is a refusal.
+        ctx.expect(runHook(hookPath, {}).status).toBe(1);
+
+        // An allow list that is not there allows nothing: the guard never opens
+        // the box up by failing to read its own configuration.
+        fs.rmSync(repos, { force: true });
+        const refused = runHook(hookPath, { GITHUB_EVENT_NAME: 'workflow_dispatch', GITHUB_REPOSITORY: 'Omega-JS-Stack/omega-omega', GITHUB_ACTOR: 'ianwieds' });
+        ctx.expect(refused.status).toBe(1);
+        ctx.expect(refused.stdout).toContain('allowed-repos.txt');
+
+        fs.rmSync(home, { recursive: true, force: true });
+      },
+    },
+    {
+      name: 'the allow list reads `owner/*` and single repos alike, case-insensitively, and comments and blanks are not entries',
+      run: (ctx) => {
+        const lists = { repos: ['Omega-JS-Stack/*', 'other-org/one-app'], actors: ['ianwieds'], reposFile: 'allowed-repos.txt', actorsFile: 'allowed-actors.txt' };
+        const dispatch = (repository) => hook.checkJob({ GITHUB_EVENT_NAME: 'workflow_dispatch', GITHUB_REPOSITORY: repository, GITHUB_ACTOR: 'IanWieds' }, lists).allowed;
+
+        ctx.expect(dispatch('omega-js-stack/anything')).toBe(true);
+        ctx.expect(dispatch('other-org/one-app')).toBe(true);
+        ctx.expect(dispatch('other-org/another-app')).toBe(false);
+        // `owner/*` is one owner, never a prefix of another owner's name.
+        ctx.expect(dispatch('Omega-JS-Stack-evil/app')).toBe(false);
+
+        const home = scratchHome();
+        const file = path.join(home, 'allowed-repos.txt');
+        fs.writeFileSync(file, '# a comment\n\n  Omega-JS-Stack/omega-omega  # trailing\n');
+        ctx.expect(hook.readList(file)).toEqual(['Omega-JS-Stack/omega-omega']);
+
+        fs.rmSync(home, { recursive: true, force: true });
+      },
+    },
+    {
+      name: 'the setup writes the hook and both allow lists beside the runner, and rerunning writes the same bytes',
+      run: (ctx) => {
+        const home = scratchHome();
+        const first = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+
+        ctx.expect(first.hook).toBe(path.join(home, 'job-started.js'));
+        ctx.expect(first.repos).toBe(path.join(home, 'allowed-repos.txt'));
+        ctx.expect(first.actors).toBe(path.join(home, 'allowed-actors.txt'));
+        ctx.expect(first.added.repos).toEqual(['Omega-JS-Stack/*']);
+        ctx.expect(first.added.actors).toEqual(['ianwieds']);
+
+        // The hook on the box is this package's file, so a framework update
+        // reaches the box on its next install or start.
+        ctx.expect(fs.readFileSync(first.hook, 'utf8')).toBe(fs.readFileSync(path.join(__dirname, '..', '..', '..', 'runner', 'job-started.js'), 'utf8'));
+
+        const bytes = () => [first.hook, first.repos, first.actors].map((file) => fs.readFileSync(file, 'utf8'));
+        const before = bytes();
+        const again = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+        ctx.expect(again.added).toEqual({ repos: [], actors: [] });
+        ctx.expect(bytes()).toEqual(before);
+
+        // A second org registered later gets its line; the first one is not
+        // duplicated and the file the operator reads keeps its header.
+        const third = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack', 'ITW-Creative-Works'], actor: 'ianwieds' });
+        ctx.expect(third.added.repos).toEqual(['ITW-Creative-Works/*']);
+        ctx.expect(hook.readList(third.repos)).toEqual(['Omega-JS-Stack/*', 'ITW-Creative-Works/*']);
+        ctx.expect(fs.readFileSync(third.repos, 'utf8').startsWith('# The repositories this box will sign for')).toBe(true);
+
+        fs.rmSync(home, { recursive: true, force: true });
+      },
+    },
+    {
+      name: 'an allow list narrowed by hand is never widened back by a later setup',
+      run: (ctx) => {
+        const home = scratchHome();
+        const { repos } = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+
+        // The operator narrows the org wildcard to the one repo that signs.
+        fs.writeFileSync(repos, '# mine\nOmega-JS-Stack/omega-omega\n');
+        const again = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+
+        ctx.expect(again.added.repos).toEqual([]);
+        ctx.expect(hook.readList(repos)).toEqual(['Omega-JS-Stack/omega-omega']);
+
+        fs.rmSync(home, { recursive: true, force: true });
+      },
+    },
+    {
+      name: "the hook path reaches the listener through the runner dir's own .env, beside HOME",
+      run: (ctx) => {
+        const home = scratchHome();
+        const runnerDir = path.join(home, 'actions-runner-omega-js-stack');
+        const { hook: hookPath } = guard.ensureRunnerJobGuard(home, { orgs: ['Omega-JS-Stack'], actor: 'ianwieds' });
+
+        // The file GitHub documents for runner env, which the listener reads at
+        // startup and applies to every job: the same one the private HOME
+        // travels in (#807), written once for both.
+        const file = ensureRunnerDirEnv(runnerDir, { HOME: path.join(home, 'home'), ACTIONS_RUNNER_HOOK_JOB_STARTED: hookPath });
+        const lines = fs.readFileSync(file, 'utf8').trim().split(/\r?\n/);
+
+        ctx.expect(lines).toContain(`ACTIONS_RUNNER_HOOK_JOB_STARTED=${hookPath}`);
+        ctx.expect(lines).toContain(`HOME=${path.join(home, 'home')}`);
+        // Bare, never quoted: the listener takes the rest of the line verbatim.
+        ctx.expect(fs.readFileSync(file, 'utf8')).not.toContain('"');
+
+        fs.rmSync(home, { recursive: true, force: true });
+      },
+    },
+  ],
+});