@platforma-sdk/package-builder-lib 1.1.0

package/src/core/docker.ts

@@ -0,0 +1,300 @@
+import { spawnSync } from "node:child_process";
+import * as defaults from "../defaults";
+import type * as artifacts from "./schemas/artifacts";
+import * as util from "./util";
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+
+/**
+ * To allow entrypoint keep both docker and binary package at the same time, we create virtual entrypoint with ':docker' suffix,
+ * as entrypoints could not keep two different artifacts at the same time.
+ */
+export function entrypointName(name: string): string {
+  return name + ":docker";
+}
+
+export function isVirtualDockerEntrypointName(name: string): boolean {
+  return name.endsWith(":docker");
+}
+
+export function entrypointNameToOrigin(name: string): string {
+  if (!isVirtualDockerEntrypointName(name)) {
+    return name;
+  }
+  return name.substring(0, name.length - ":docker".length);
+}
+
+export function getImageHash(tag: string): string {
+  const result = spawnSync(
+    "docker",
+    ["image", "ls", "--filter=reference=" + tag, "--format={{.ID}}"],
+    {
+      stdio: "pipe",
+      env: {
+        ...process.env, // PATH variable from parent process affects execution
+        HOME: process.env.HOME || os.homedir(), // Ensure HOME is set
+      },
+    },
+  );
+
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    throw util.CLIError(`local docker image check failed with status ${result.status}`);
+  }
+
+  const output = result.stdout.toString().trim();
+  if (output.split("\n").length > 1) {
+    throw util.CLIError(
+      `package-builder internal logic error: more than one image found by exact tag match: ${output}`,
+    );
+  }
+
+  return output;
+}
+
+export function getImageEntrypoint(tag: string): string[] {
+  const result = spawnSync(
+    "docker",
+    ["image", "inspect", tag, "--format", "{{ .Config.Entrypoint | json }}"],
+    {
+      stdio: "pipe",
+      env: {
+        ...process.env, // PATH variable from parent process affects execution
+        HOME: process.env.HOME || os.homedir(), // Ensure HOME is set
+      },
+    },
+  );
+
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    throw util.CLIError(`'docker image inspect' failed with status ${result.status}`);
+  }
+
+  const output = result.stdout.toString().trim(); // 'null' or '[<string>, ...]' in JSON format
+  return (JSON.parse(output) ?? []) as string[];
+}
+
+export function localImageExists(tag: string): boolean {
+  return getImageHash(tag) !== "";
+}
+
+export function remoteImageExists(tag: string): boolean {
+  const result = spawnSync("docker", ["manifest", "inspect", tag], {
+    stdio: "pipe",
+    env: {
+      ...process.env, // PATH variable from parent process affects execution
+      HOME: process.env.HOME || os.homedir(), // Ensure HOME is set
+    },
+  });
+
+  if (result.error || result.status !== 0) {
+    return false;
+  }
+
+  return true;
+}
+
+export function build(
+  context: string,
+  dockerfile: string,
+  tag: string,
+  softwarePackage: string,
+  softwareVersion: string | undefined,
+) {
+  const result = spawnSync(
+    "docker",
+    [
+      "build",
+      // Pin platform so Platforma's linux/amd64 K8s nodes can run the image
+      // regardless of host arch (cross-compile via qemu on non-x64 hosts).
+      "--platform",
+      defaults.DOCKER_BUILD_PLATFORM,
+      // Disable buildkit's SLSA provenance + SBOM attestations. They embed
+      // build-time timestamps into the manifest list, which produces a fresh
+      // image digest on every build of identical source. That breaks the
+      // content-addressable tag scheme (every dev rebuild re-pushes a new
+      // tag) and defeats publishDockerImage's `remoteImageExists` smart-skip.
+      "--provenance=false",
+      "--sbom=false",
+      "-t",
+      tag,
+      context,
+      "-f",
+      dockerfile,
+      "--label",
+      "com.milaboratories.package-builder.software=true",
+      "--label",
+      "com.milaboratories.package-builder.software.package=" + softwarePackage,
+      "--label",
+      "com.milaboratories.package-builder.software.version=" + softwareVersion,
+    ],
+    {
+      stdio: "inherit",
+      env: {
+        ...process.env, // PATH variable from parent process affects execution
+        HOME: process.env.HOME || os.homedir(), // Ensure HOME is set
+      },
+    },
+  );
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    throw util.CLIError(`'docker build' failed with status ${result.status}`);
+  }
+}
+
+export function push(tag: string) {
+  const result = spawnSync("docker", ["push", tag], {
+    stdio: "inherit",
+    env: {
+      ...process.env, // PATH variable from parent process affects execution
+      HOME: process.env.HOME || os.homedir(), // Ensure HOME is set
+    },
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    const registry = tag.split("/")[0];
+    throw util.CLIError(
+      `'docker push ${tag}' failed with status ${result.status}.\n` +
+        `If the error above mentions authentication or denied access, log in first:\n` +
+        `  aws sso login --profile research-poweruser <YOUR_PROFILE:research-poweruser?> \n` +
+        `Then login in docker:` +
+        `  aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin ${registry}\n` +
+        `(for a private ECR use 'aws ecr' and your region instead of 'ecr-public'/us-east-1).`,
+    );
+  }
+}
+
+export function addTag(imageIdOrTag: string, newTag: string) {
+  const result = spawnSync("docker", ["image", "tag", imageIdOrTag, newTag], {
+    stdio: "inherit",
+    env: {
+      ...process.env, // PATH variable from parent process affects execution
+      HOME: process.env.HOME || os.homedir(), // Ensure HOME is set
+    },
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    throw util.CLIError(`'docker tag' failed with status ${result.status}`);
+  }
+}
+
+export function removeTag(imageTag: string) {
+  const result = spawnSync("docker", ["image", "rm", imageTag], {
+    stdio: "inherit",
+    env: {
+      ...process.env, // PATH variable from parent process affects execution
+      HOME: process.env.HOME || os.homedir(), // Ensure HOME is set
+    },
+  });
+  if (result.error) {
+    throw result.error;
+  }
+  if (result.status !== 0) {
+    throw util.CLIError(`'docker image rm' failed with status ${result.status}`);
+  }
+}
+
+/**
+ * Generate unique content-addressable image tag
+ * @param artifactName: artifact name generated from package name and artifact ID (or explicitly set for artifact in .name field)
+ * @param imageID: unique image content hash (docker image ID in docker ls)
+ * @param registry: custom registry and repository to use for this image
+ * @returns full image tag in format: <registry>/repository:<artifactName>.<imageID>
+ */
+export function generateRemoteTagName(
+  artifactName: string,
+  imageID: string,
+  registry?: string,
+): string {
+  return dockerTag(artifactName, imageID, registry);
+}
+
+/**
+ * Generate unique content-addressable image tag out of directories and Dockerfile.
+ * @param packageRoot: package root path from where to resolve artifact's paths (context, Dockerfile, ...)
+ * @param artifact: docker artifact configuration
+ * @returns full image tag in format: <registry>/repository:<artifactName>.<contentHash>
+ */
+export function generateLocalTagName(packageRoot: string, artifact: artifacts.dockerType): string {
+  const dockerfile = dockerfileAbsPath(packageRoot, artifact);
+  const context = contextAbsPath(packageRoot, artifact);
+  const hash = contentHash(context, dockerfile);
+
+  return dockerTag("local-image", hash);
+}
+
+/**
+ * Absolute path to autogenerated Dockerfile for given artifact.
+ * @param packageRoot: package root path from where to resolve artifact's paths (context, Dockerfile, ...)
+ * @param artifactID: artifact ID
+ * @returns absolute path to autogenerated Dockerfile
+ */
+export function dockerfileAutogenPath(packageRoot: string, artifactID: string): string {
+  return path.resolve(packageRoot, "dist", "docker", `Dockerfile-${artifactID}`);
+}
+
+/**
+ * Resolve path to Dockerfile.
+ * @param packageRoot: package root path from where to resolve artifact's paths (context, Dockerfile, ...)
+ * @param artifact: docker artifact configuration
+ * @returns absolute path to Dockerfile
+ */
+function dockerfileAbsPath(packageRoot: string, artifact: artifacts.dockerType): string {
+  return path.resolve(packageRoot, artifact.dockerfile ?? "Dockerfile");
+}
+
+/**
+ * Resolve path to docker build context directory.
+ * @param packageRoot: package root path from where to resolve artifact's paths (context, Dockerfile, ...)
+ * @param artifact: docker artifact configuration
+ * @returns absolute path to docker build context directory
+ */
+function contextAbsPath(packageRoot: string, artifact: artifacts.dockerType): string {
+  if (artifact.context === "./" || artifact.context === ".") {
+    throw util.CLIError(
+      `Invalid Docker context: "${artifact.context}". Context cannot be "./" or "." - use absolute path or relative path without "./" prefix`,
+    );
+  }
+  return path.resolve(packageRoot, artifact.context ?? ".");
+}
+
+/**
+ * Calculate cummulative hash of docker build context directory context and Dockerfile.
+ * To speedup hash calculation, we do not read contents of each item in context dir but
+ * use metadata (size, mtime, ...).
+ *
+ * @param contextFullPath: abs path to docker build context
+ * @param dockerfileFullPath: abs path to Dockerfile
+ * @returns hash of what the keep
+ */
+function contentHash(contextFullPath: string, dockerfileFullPath: string): string {
+  if (!fs.existsSync(dockerfileFullPath)) {
+    throw util.CLIError(`Dockerfile '${dockerfileFullPath}' not found`);
+  }
+
+  if (!fs.existsSync(contextFullPath)) {
+    throw util.CLIError(`Context '${contextFullPath}' not found`);
+  }
+
+  const contextHash = util.hashDirMetaSync(contextFullPath);
+  const dockerfileContent = fs.readFileSync(dockerfileFullPath, "utf8");
+  contextHash.update(dockerfileContent);
+
+  return contextHash.digest("hex").slice(0, 12);
+}
+
+function dockerTag(packageName: string, contentHash: string, registry?: string): string {
+  const dockerRegistry = registry ?? defaults.DOCKER_REGISTRY;
+  return `${dockerRegistry}:${packageName.replaceAll("/", ".")}.${contentHash}`;
+}

package/src/core/envs.ts

@@ -0,0 +1,31 @@
+export const PL_PKG_VERSION = "PL_PKG_VERSION";
+export const PL_PKG_OS = "PL_PKG_OS";
+export const PL_PKG_ARCH = "PL_PKG_ARCH";
+
+export const PL_PKG_CONTENT_ROOT = "PL_PKG_CONTENT_ROOT";
+export const PL_PKG_ARCHIVE = "PL_PKG_ARCHIVE";
+export const PL_PKG_STORAGE_URL = "PL_PKG_STORAGE_URL";
+
+export const PL_PKG_DEV = "PL_PKG_DEV";
+export const PL_PKG_FULL_HASH = "PL_PKG_FULL_HASH";
+
+export const PL_CONDA_BUILD = "PL_CONDA_BUILD";
+export const PL_CONDA_NO_BUILD = "PL_CONDA_NO_BUILD";
+
+export const PL_DOCKER_REGISTRY = "PL_DOCKER_REGISTRY";
+export const PL_DOCKER_REGISTRY_PUSH_TO = "PL_DOCKER_REGISTRY_PUSH_TO";
+
+export const PL_DOCKER_BUILD = "PL_DOCKER_BUILD";
+export const PL_DOCKER_NO_BUILD = "PL_DOCKER_NO_BUILD";
+export const PL_DOCKER_AUTOPUSH = "PL_DOCKER_AUTOPUSH";
+export const PL_DOCKER_NO_AUTOPUSH = "PL_DOCKER_NO_AUTOPUSH";
+
+export const CI = "CI";
+export const RUNNER_DEBUG = "RUNNER_DEBUG";
+
+export function isCI(): boolean {
+  return process.env[CI] === "true";
+}
+export function isRunnerDebug(): boolean {
+  return process.env[RUNNER_DEBUG] === "true" || process.env[RUNNER_DEBUG] === "1";
+}

package/src/core/package-info.test.ts

@@ -0,0 +1,82 @@
+import { PackageInfo } from "./package-info";
+import * as testArtifacts from "./schemas/test-artifacts";
+import { createLogger } from "./util";
+import { test, expect } from "vitest";
+
+test("PackageInfo loads correctly for single binary package", () => {
+  const l = createLogger("error");
+
+  const i = new PackageInfo(l, {
+    pkgJsonData: testArtifacts.SingleBinaryackageJson,
+  });
+
+  const binary = i.getArtifact(testArtifacts.EPNameBinary, "binary");
+  expect(i.artifactName(binary)).toEqual(
+    testArtifacts.PackageNameNoAt + "/" + testArtifacts.EPNameBinary,
+  );
+  expect(i.artifactVersion(binary)).toEqual(testArtifacts.PackageVersion);
+});
+
+test("PackageInfo loads correctly for multi-package", () => {
+  const l = createLogger("error");
+
+  const i = new PackageInfo(l, {
+    pkgJsonData: testArtifacts.PackageJson,
+  });
+
+  const asset = i.getArtifact(testArtifacts.EPNameAsset, "asset");
+  let registry = i.artifactRegistrySettings(asset);
+  expect(registry.name).toEqual(testArtifacts.BinaryRegistry);
+  expect(i.artifactName(asset)).toEqual(testArtifacts.PackageNameNoAt + "/pAsset");
+  expect(i.artifactVersion(asset)).toEqual(testArtifacts.PackageVersion);
+  expect(asset.root).toEqual("./src");
+
+  const binary = i.getArtifact(testArtifacts.EPNameCustomName, "binary");
+  registry = i.artifactRegistrySettings(binary);
+  expect(registry.name).toEqual(testArtifacts.BinaryRegistry);
+  expect(i.artifactName(binary)).toEqual(testArtifacts.BinaryCustomName1);
+  expect(i.artifactVersion(binary)).toEqual(testArtifacts.BinaryCustomVersion);
+
+  const environment = i.getArtifact(testArtifacts.EPNameJavaEnvironment, "environment");
+  registry = i.artifactRegistrySettings(environment);
+  expect(registry.name).toEqual(testArtifacts.BinaryRegistry);
+  expect(i.artifactName(environment)).toEqual(
+    testArtifacts.PackageNameNoAt + "/" + testArtifacts.EPNameJavaEnvironment,
+  );
+  expect(i.artifactVersion(environment)).toEqual(testArtifacts.PackageVersion);
+});
+
+test("Limited list of supported platforms", () => {
+  const l = createLogger("error");
+
+  const i = new PackageInfo(l, {
+    pkgJsonData: testArtifacts.PackageJson,
+  });
+
+  const binary = i.getArtifact(testArtifacts.EPNameLimitedPlatformsBinary, "binary");
+  const platforms = i.artifactPlatforms(binary);
+  expect(platforms).toEqual(["linux-x64", "macosx-aarch64"]);
+});
+
+test("PackageInfo considers version override", () => {
+  const l = createLogger("error");
+
+  const i = new PackageInfo(l, {
+    pkgJsonData: testArtifacts.PackageJson,
+  });
+
+  const customVersion = "my-custom-version";
+  i.version = customVersion;
+
+  const asset = i.getArtifact("pAsset", "asset");
+  expect(i.artifactVersion(asset)).toEqual(customVersion);
+
+  const binary = i.getArtifact(testArtifacts.EPNameCustomName, "binary");
+  expect(i.artifactVersion(binary)).toEqual(customVersion);
+
+  const environment = i.getArtifact(testArtifacts.EPNameJavaEnvironment, "environment");
+  expect(i.artifactVersion(environment)).toEqual(customVersion);
+
+  const java = i.getArtifact(testArtifacts.EPNameJava, "java");
+  expect(i.artifactVersion(java)).toEqual(customVersion);
+});