@prodgator/report 1.12.0 → 3.5.0

package/README.md

@@ -8,6 +8,8 @@ Shared report client for the Prodgator GitHub action, GitLab component and Bitbu
 
 Options can be set as a CLI flag, a `PRODGATOR_`-prefixed environment variable, or (only with `--pipe`) an unprefixed pipe variable. A flag wins over a pipe variable, which wins over the `PRODGATOR_` variable, which wins over the default.
 
+On Azure Pipelines, a script step reads `PRODGATOR_URL` and `PRODGATOR_ALLOW_CUSTOM_URL` from pipeline variables, so do not make them settable at queue time. The Marketplace task ignores them and takes inputs only.
+
 | Option | CLI flag | Env (GitLab, any shell) | Pipe variable |
 |---|---|---|---|
 | prodgatorUrl | `--prodgator-url` | `PRODGATOR_URL` | `PRODGATOR_URL` |

package/dist/cli.js

@@ -7054,6 +7054,8 @@ async function postJson(url, body, audience, deps) {
         method: "POST",
         headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": deps.userAgent ?? "prodgator-report/1" },
         body: JSON.stringify(body),
+        // A redirect would carry the token to another address: never follow one.
+        redirect: "manual",
         signal: AbortSignal.timeout(3e4)
       });
     } catch (e) {
@@ -7061,6 +7063,9 @@ async function postJson(url, body, audience, deps) {
       last = new ReportError(0, "NETWORK", e.message, true);
       continue;
     }
+    if (res.type === "opaqueredirect" || res.status >= 300 && res.status < 400) {
+      throw new ReportError(res.status, "REDIRECT_REFUSED", "Prodgator answered with a redirect; the token is never sent to a redirected address. Check prodgator-url.", false);
+    }
     if (res.ok) return await res.clone().json();
     const payload2 = await res.clone().json().catch(() => ({}));
     const retryable = !(deps.fixedToken && payload2.code === "TOKEN_EXPIRED") && (payload2.retryable === true || RETRY_STATUS.has(res.status));
@@ -7076,8 +7081,8 @@ async function postJson(url, body, audience, deps) {
   }
   throw last;
 }
-var sendReport = (baseUrl, provider, req, audience, deps) => postJson(`${baseUrl}/api/ingest/${provider}/reports`, req, audience, deps);
-var completeReport = (baseUrl, provider, reportId, artifactIds, audience, deps) => postJson(`${baseUrl}/api/ingest/${provider}/reports/${encodeURIComponent(reportId)}/complete`, { artifactIds }, audience, deps);
+var sendReport = (baseUrl, provider, req, audience, deps, azure) => postJson(`${baseUrl}/api/ingest/${provider}/reports`, azure ? { ...req, azure } : req, audience, deps);
+var completeReport = (baseUrl, provider, reportId, artifactIds, audience, deps, azure) => postJson(`${baseUrl}/api/ingest/${provider}/reports/${encodeURIComponent(reportId)}/complete`, azure ? { artifactIds, azure } : { artifactIds }, audience, deps);
 
 // src/core/upload.ts
 var import_fs4 = require("fs");
@@ -7087,7 +7092,8 @@ function putOnce(slot, file) {
   return new Promise((resolve3, reject) => {
     const url = new URL(slot.url);
     const mod = url.protocol === "http:" ? http : https;
-    const req = mod.request(url, { method: "PUT", headers: slot.headers, timeout: 10 * 6e4 }, (res) => {
+    const headers = Object.fromEntries(Object.entries(slot.headers).filter(([k]) => !/^(proxy-)?authorization$|^cookie$/i.test(k)));
+    const req = mod.request(url, { method: "PUT", headers, timeout: 10 * 6e4 }, (res) => {
       let body = "";
       res.setEncoding("utf8");
       res.on("data", (c) => {
@@ -7131,11 +7137,15 @@ async function readGate(baseUrl, gate, deps) {
     res = await (deps.fetch ?? fetch)(`${baseUrl}/api/ingest/bitbucket/gates/${encodeURIComponent(gate.gateId)}`, {
       method: "GET",
       headers: { authorization: `Bearer ${gate.pollToken}`, "user-agent": deps.userAgent ?? "prodgator-report/1" },
+      redirect: "manual",
       signal: AbortSignal.timeout(3e4)
     });
   } catch (e) {
     throw new ReportError(0, "NETWORK", e.message, true);
   }
+  if (res.type === "opaqueredirect" || res.status >= 300 && res.status < 400) {
+    throw new ReportError(res.status, "REDIRECT_REFUSED", "Prodgator answered with a redirect; the token is never sent to a redirected address. Check prodgator-url.", false);
+  }
   if (res.ok) return await res.json();
   const payload2 = await res.json().catch(() => ({}));
   const retryable = res.status === 429 || res.status >= 500;
@@ -7149,7 +7159,42 @@ var CliError = class extends Error {
     this.name = "CliError";
   }
 };
-function detectCi(env, cwd) {
+var AZURE_TOKEN_HINT = 'Map the job token: add "env: SYSTEM_ACCESSTOKEN: $(System.AccessToken)" to this step, or use the Prodgator task.';
+function azureContext(env) {
+  const need = (name) => {
+    const v = env[name]?.trim();
+    if (!v) throw new CliError(`${name} is not set; run prodgator-report inside an Azure Pipelines job.`);
+    return v;
+  };
+  const sha = need("BUILD_SOURCEVERSION");
+  if (!/^[0-9a-f]{40}$/i.test(sha)) throw new CliError("BUILD_SOURCEVERSION is not a 40-character commit hash; Prodgator reports need a pipeline that builds a Git commit.");
+  const buildId = Number(need("BUILD_BUILDID"));
+  if (!Number.isInteger(buildId) || buildId < 1) throw new CliError("BUILD_BUILDID is not a build number.");
+  const jobId = need("SYSTEM_JOBID");
+  if (jobId.length > 64) throw new CliError("SYSTEM_JOBID is longer than 64 characters.");
+  const attempt = Number(env.SYSTEM_JOBATTEMPT);
+  return {
+    collectionUri: need("SYSTEM_COLLECTIONURI"),
+    projectId: need("SYSTEM_TEAMPROJECTID"),
+    buildId,
+    jobId,
+    attempt: Number.isInteger(attempt) && attempt >= 1 && attempt <= 999 ? attempt : 1,
+    sha: sha.toLowerCase()
+  };
+}
+function detectCi(env, cwd, tokenVariable) {
+  if (env.TF_BUILD === "True") {
+    const variable = tokenVariable ?? "SYSTEM_ACCESSTOKEN";
+    if (!env[variable]?.trim()) throw new CliError(variable === "SYSTEM_ACCESSTOKEN" ? AZURE_TOKEN_HINT : `No job token in ${variable}. ${AZURE_TOKEN_HINT}`);
+    return {
+      provider: "azure",
+      workspace: env.BUILD_SOURCESDIRECTORY || cwd,
+      jobName: env.SYSTEM_JOBDISPLAYNAME || "job",
+      runner: env.AGENT_NAME || null,
+      defaultTokenVariable: "SYSTEM_ACCESSTOKEN",
+      azure: azureContext(env)
+    };
+  }
   if (env.GITLAB_CI === "true") {
     return {
       provider: "gitlab",
@@ -7170,13 +7215,14 @@ function detectCi(env, cwd) {
     };
   }
   if (env.GITHUB_ACTIONS === "true") throw new CliError("On GitHub Actions use the prodgator/prodgator-action action instead of prodgator-report.");
-  throw new CliError("prodgator-report runs in GitLab CI or Bitbucket Pipelines (GITLAB_CI or BITBUCKET_BUILD_NUMBER is not set).");
+  throw new CliError("prodgator-report runs in GitLab CI, Bitbucket Pipelines or Azure Pipelines (GITLAB_CI, BITBUCKET_BUILD_NUMBER or TF_BUILD is not set).");
 }
 
 // src/cli/options.ts
 var DEFAULT_PRODGATOR_URL = "https://api.prodgator.io";
 var OPTION_NAMES = {
   prodgatorUrl: { flag: "--prodgator-url", env: "PRODGATOR_URL", pipe: "PRODGATOR_URL" },
+  allowCustomUrl: { flag: "--allow-custom-url", env: "PRODGATOR_ALLOW_CUSTOM_URL", pipe: null },
   audience: { flag: "--audience", env: "PRODGATOR_AUDIENCE", pipe: "AUDIENCE" },
   summary: { flag: "--summary", env: "PRODGATOR_SUMMARY", pipe: "SUMMARY" },
   summaryFile: { flag: "--summary-file", env: "PRODGATOR_SUMMARY_FILE", pipe: "SUMMARY_FILE" },
@@ -7222,8 +7268,8 @@ function parseOptions(argv, env) {
       pipe = true;
       continue;
     }
-    if (a === "--gate" && (argv[i + 1] === void 0 || argv[i + 1].startsWith("--"))) {
-      flags.set("--gate", "true");
+    if ((a === "--gate" || a === "--allow-custom-url") && (argv[i + 1] === void 0 || argv[i + 1].startsWith("--"))) {
+      flags.set(a, "true");
       continue;
     }
     const eq = a.indexOf("=");
@@ -7266,6 +7312,7 @@ function parseOptions(argv, env) {
     attestations: get("attestations"),
     redactVariables: list(get("redactVariables")),
     failOnError: fail === "true",
+    allowCustomUrl: (get("allowCustomUrl") ?? "false").trim().toLowerCase() === "true",
     tokenVariable: get("tokenVariable")?.trim() ?? null,
     pipe,
     gate: (get("gate") ?? "false").trim().toLowerCase() === "true",
@@ -7276,11 +7323,12 @@ function parseOptions(argv, env) {
 // src/cli/token.ts
 var HOW = {
   gitlab: (v) => `Add "id_tokens: ${v}: aud: <Prodgator API origin>" to the job (the Prodgator component does this).`,
+  azure: () => AZURE_TOKEN_HINT,
   bitbucket: () => 'Add "oidc: audiences: [<Prodgator API origin>]" to the step that runs the pipe.'
 };
 function readToken(env, variable, provider) {
   const t = env[variable]?.trim();
-  if (!t) throw new CliError(`No OIDC token in ${variable}. ${HOW[provider](variable)}`);
+  if (!t) throw new CliError(`No ${provider === "azure" ? "job" : "OIDC"} token in ${variable}. ${HOW[provider](variable)}`);
   return t;
 }
 function payload(token) {
@@ -7293,6 +7341,7 @@ function payload(token) {
   }
 }
 function tokenProblem(token, audience, provider, variable, nowMs) {
+  if (provider === "azure") return token ? null : "The job token is empty.";
   const p = payload(token);
   if (!p) return null;
   const auds = [].concat(p.aud ?? []).filter((a) => typeof a === "string");
@@ -7305,10 +7354,30 @@ function tokenProblem(token, audience, provider, variable, nowMs) {
   return null;
 }
 
+// src/cli/url-policy.ts
+var PRODGATOR_DOMAINS = ["prodgator.io", "prodgator.dev"];
+var LOCAL_HOSTS = ["localhost", "127.0.0.1"];
+var isProdgatorHost = (host) => PRODGATOR_DOMAINS.some((d) => host === d || host.endsWith(`.${d}`));
+function checkTokenDestination(prodgatorUrl, provider, allowCustomUrl) {
+  if (provider !== "azure") return null;
+  const u = new URL(prodgatorUrl);
+  const optIn = "To send the job token to another server on purpose, set allow-custom-url (--allow-custom-url, PRODGATOR_ALLOW_CUSTOM_URL=true, or the task input allowCustomUrl).";
+  if (u.username || u.password) throw new CliError(`prodgator-url must not carry a user name or password (host ${u.hostname}).`);
+  if (u.protocol === "https:" && !u.port && isProdgatorHost(u.hostname)) return null;
+  if (!allowCustomUrl) {
+    throw new CliError(`Refusing to send the Azure Pipelines job token to ${u.host}: it is not prodgator.io or prodgator.dev over https. ${optIn}`);
+  }
+  if (u.protocol === "http:" && !LOCAL_HOSTS.includes(u.hostname)) {
+    throw new CliError(`Refusing to send the Azure Pipelines job token to ${u.host} over plain http; only localhost and 127.0.0.1 may use http.`);
+  }
+  return `Sending the Azure Pipelines job token to ${u.host}, which is not a Prodgator address. allow-custom-url is on.`;
+}
+
 // src/cli/redact.ts
 var ALWAYS_REDACT = Object.freeze([
   "PRODGATOR_ID_TOKEN",
   "BITBUCKET_STEP_OIDC_TOKEN",
+  "SYSTEM_ACCESSTOKEN",
   "CI_JOB_TOKEN",
   "CI_JOB_JWT",
   "CI_JOB_JWT_V1",
@@ -7377,7 +7446,7 @@ function decided(view) {
   return `${by}${note}`;
 }
 async function runGate(ci, opts, client, deps) {
-  if (ci.provider !== "bitbucket") throw new CliError("Gate mode runs in Bitbucket Pipelines only. On GitLab, use protected environment approvals.");
+  if (ci.provider !== "bitbucket") throw new CliError("Gate mode runs in Bitbucket Pipelines only. On GitLab, use protected environment approvals. On Azure Pipelines, use environment approvals and checks.");
   const { log } = deps;
   const deadline = deps.nowMs() + opts.timeoutMinutes * 6e4;
   const gate = await openGate(opts.prodgatorUrl, opts.audience, { ...client, maxAttempts: 10 });
@@ -7451,7 +7520,7 @@ async function run(deps = {}) {
   const argv = deps.argv ?? process.argv.slice(2);
   const log = deps.log ?? { info: (m) => console.log(m), warn: (m) => console.log(`Warning: ${m}`), error: (m) => console.error(m) };
   if (argv.includes("--version")) {
-    log.info("1.12.0");
+    log.info("3.5.0");
     return 0;
   }
   let failOnError = false;
@@ -7461,13 +7530,15 @@ async function run(deps = {}) {
     const opts = parseOptions(argv, env);
     failOnError = opts.failOnError;
     gate = opts.gate;
-    const ci = detectCi(env, deps.cwd ?? process.cwd());
+    const ci = detectCi(env, deps.cwd ?? process.cwd(), opts.tokenVariable ?? void 0);
     const variable = opts.tokenVariable ?? ci.defaultTokenVariable;
+    const custom = checkTokenDestination(opts.prodgatorUrl, ci.provider, opts.allowCustomUrl);
+    if (custom) log.warn(custom);
     const token = readToken(env, variable, ci.provider);
     const problem = tokenProblem(token, opts.audience, ci.provider, variable, (deps.nowMs ?? Date.now)());
     if (problem) throw new CliError(problem);
     if (opts.gate) {
-      const client2 = { getToken: async () => token, fetch: deps.fetch, sleep: deps.sleep, fixedToken: true, userAgent: `prodgator-report/${"1.12.0"} (${ci.provider}; gate)` };
+      const client2 = { getToken: async () => token, fetch: deps.fetch, sleep: deps.sleep, fixedToken: true, userAgent: `prodgator-report/${"3.5.0"} (${ci.provider}; gate)` };
       return await runGate(ci, { prodgatorUrl: opts.prodgatorUrl, audience: opts.audience, timeoutMinutes: opts.gateTimeoutMinutes }, client2, {
         sleep: deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
         nowMs: deps.nowMs ?? Date.now,
@@ -7490,10 +7561,10 @@ async function run(deps = {}) {
       fetch: deps.fetch,
       sleep: deps.sleep,
       fixedToken: true,
-      userAgent: `prodgator-report/${"1.12.0"} (${ci.provider})`
+      userAgent: `prodgator-report/${"3.5.0"} (${ci.provider})`
     };
     const request = buildIngestRequest({ job: { name: opts.jobName ?? ci.jobName, matrix: opts.matrix, runner: ci.runner }, name: opts.name, summary, attestations, files });
-    const res = await sendReport(opts.prodgatorUrl, ci.provider, request, opts.audience, client);
+    const res = await sendReport(opts.prodgatorUrl, ci.provider, request, opts.audience, client, ci.azure);
     for (const w of res.warnings) log.warn(WARNINGS[w] ?? w);
     for (const s of res.skipped) if (s.reason !== "already_uploaded") log.warn(`${s.path} was not uploaded: ${SKIPPED[s.reason] ?? s.reason}`);
     if (!res.trusted) log.info("Prodgator stored this report as coming from an untrusted source (fork merge request or external pull request); release policies ignore it by default.");
@@ -7509,10 +7580,11 @@ async function run(deps = {}) {
       }
     }
     if (uploaded.length) {
-      const done = await completeReport(opts.prodgatorUrl, ci.provider, res.reportId, uploaded, opts.audience, client);
+      const done = await completeReport(opts.prodgatorUrl, ci.provider, res.reportId, uploaded, opts.audience, client, ci.azure);
       for (const r of done.results.filter((r2) => r2.status !== "uploaded")) log.warn(`artifact ${r.artifactId} was ${r.status}${r.reason ? `: ${r.reason}` : ""}`);
     }
     log.info(`Prodgator report: ${res.url}`);
+    deps.onOutcome?.("sent");
     return 0;
   } catch (e) {
     const msg2 = e instanceof ReportError ? `${e.code}: ${e.message}` : e.message;
@@ -7525,6 +7597,7 @@ async function run(deps = {}) {
       return 1;
     }
     log.warn(`Prodgator report was not sent: ${msg2}`);
+    deps.onOutcome?.("not_sent");
     return 0;
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prodgator/report",
-  "version": "1.12.0",
+  "version": "3.5.0",
   "description": "Send CI job summaries, test results, attestations and artifacts to Prodgator, authenticated with the CI system's OIDC token",
   "license": "MIT",
   "homepage": "https://docs.prodgator.io/pipelines/run-reports",
@@ -20,6 +20,7 @@
     "build": "node scripts/build.mjs",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
+    "build:azure-task": "node scripts/build-azure-task.mjs",
     "release:prepare": "node scripts/prepare-release.mjs"
   },
   "dependencies": {
@@ -28,6 +29,7 @@
   },
   "devDependencies": {
     "@types/node": "^22.20.5",
+    "azure-pipelines-task-lib": "^5.281.0",
     "esbuild": "^0.25.0",
     "typescript": "^5.9.3",
     "vitest": "^4.1.11",