@prodgator/report 1.8.0 → 1.10.0

package/README.md

@@ -22,6 +22,8 @@ Options can be set as a CLI flag, a `PRODGATOR_`-prefixed environment variable,
 | attestations | `--attestations` | `PRODGATOR_ATTESTATIONS` | `ATTESTATIONS` |
 | redactVariables | `--redact-variables` | `PRODGATOR_REDACT_VARIABLES` | `REDACT_VARIABLES` |
 | failOnError | `--fail-on-error` | `PRODGATOR_FAIL_ON_ERROR` | `FAIL_ON_ERROR` |
+| gate | `--gate` | `PRODGATOR_GATE` | `GATE` |
+| gateTimeoutMinutes | `--gate-timeout` | `PRODGATOR_GATE_TIMEOUT` | `GATE_TIMEOUT` |
 | tokenVariable | `--token-variable` | `PRODGATOR_TOKEN_VARIABLE` | (none) |
 
 GitLab CI example, reporting from its own short job:

package/dist/cli.js

@@ -5092,6 +5092,25 @@ async function uploadFile(slot, file, attempts = 2) {
   }
 }
 
+// src/core/gate.ts
+var openGate = (baseUrl, audience, deps) => postJson(`${baseUrl}/api/ingest/bitbucket/gates`, {}, audience, deps);
+async function readGate(baseUrl, gate, deps) {
+  let res;
+  try {
+    res = await (deps.fetch ?? fetch)(`${baseUrl}/api/ingest/bitbucket/gates/${encodeURIComponent(gate.gateId)}`, {
+      method: "GET",
+      headers: { authorization: `Bearer ${gate.pollToken}`, "user-agent": deps.userAgent ?? "prodgator-report/1" },
+      signal: AbortSignal.timeout(3e4)
+    });
+  } catch (e) {
+    throw new ReportError(0, "NETWORK", e.message, true);
+  }
+  if (res.ok) return await res.json();
+  const payload2 = await res.json().catch(() => ({}));
+  const retryable = res.status === 429 || res.status >= 500;
+  throw new ReportError(res.status, payload2.code ?? `HTTP_${res.status}`, payload2.error ?? res.statusText, retryable);
+}
+
 // src/cli/env.ts
 var CliError = class extends Error {
   constructor(message) {
@@ -5138,8 +5157,18 @@ var OPTION_NAMES = {
   attestations: { flag: "--attestations", env: "PRODGATOR_ATTESTATIONS", pipe: "ATTESTATIONS" },
   redactVariables: { flag: "--redact-variables", env: "PRODGATOR_REDACT_VARIABLES", pipe: "REDACT_VARIABLES" },
   failOnError: { flag: "--fail-on-error", env: "PRODGATOR_FAIL_ON_ERROR", pipe: "FAIL_ON_ERROR" },
-  tokenVariable: { flag: "--token-variable", env: "PRODGATOR_TOKEN_VARIABLE", pipe: null }
+  tokenVariable: { flag: "--token-variable", env: "PRODGATOR_TOKEN_VARIABLE", pipe: null },
+  gate: { flag: "--gate", env: "PRODGATOR_GATE", pipe: "GATE" },
+  gateTimeoutMinutes: { flag: "--gate-timeout", env: "PRODGATOR_GATE_TIMEOUT", pipe: "GATE_TIMEOUT" }
 };
+var DEFAULT_GATE_TIMEOUT_MINUTES = 60;
+var MAX_GATE_TIMEOUT_MINUTES = 720;
+function gateTimeout(raw) {
+  if (raw === null) return DEFAULT_GATE_TIMEOUT_MINUTES;
+  const n = Number(raw.trim());
+  if (!Number.isInteger(n) || n < 1 || n > MAX_GATE_TIMEOUT_MINUTES) throw new CliError(`gate-timeout must be a whole number of minutes from 1 to ${MAX_GATE_TIMEOUT_MINUTES}`);
+  return n;
+}
 var list = (v) => v ? v.split(/[\n,]/).map((s) => s.trim()).filter(Boolean) : [];
 function matrix(raw) {
   if (!raw) return null;
@@ -5162,6 +5191,10 @@ function parseOptions(argv, env) {
       pipe = true;
       continue;
     }
+    if (a === "--gate" && (argv[i + 1] === void 0 || argv[i + 1].startsWith("--"))) {
+      flags.set("--gate", "true");
+      continue;
+    }
     const eq = a.indexOf("=");
     if (a.startsWith("--") && eq > 0) {
       flags.set(a.slice(0, eq), a.slice(eq + 1));
@@ -5203,7 +5236,9 @@ function parseOptions(argv, env) {
     redactVariables: list(get("redactVariables")),
     failOnError: fail === "true",
     tokenVariable: get("tokenVariable")?.trim() ?? null,
-    pipe
+    pipe,
+    gate: (get("gate") ?? "false").trim().toLowerCase() === "true",
+    gateTimeoutMinutes: gateTimeout(get("gateTimeoutMinutes"))
   };
 }
 
@@ -5303,6 +5338,55 @@ function workspaceGlob(workspace, warn) {
   };
 }
 
+// src/cli/gate.ts
+var MAX_POLL_FAILURES = 30;
+function decided(view) {
+  const by = view.decidedBy ? ` by ${view.decidedBy}` : "";
+  const note = view.note ? `: ${view.note}` : "";
+  return `${by}${note}`;
+}
+async function runGate(ci, opts, client, deps) {
+  if (ci.provider !== "bitbucket") throw new CliError("Gate mode runs in Bitbucket Pipelines only. On GitLab, use protected environment approvals.");
+  const { log } = deps;
+  const deadline = deps.nowMs() + opts.timeoutMinutes * 6e4;
+  const gate = await openGate(opts.prodgatorUrl, opts.audience, { ...client, maxAttempts: 10 });
+  log.info(`Prodgator gate for ${gate.environment}: ${gate.url}`);
+  let view = gate;
+  let failures = 0;
+  let announced = false;
+  for (; ; ) {
+    if (view.decision === "approved") {
+      log.info(`Approved in Prodgator${decided(view)}. Deploying to ${view.environment}.`);
+      return 0;
+    }
+    if (view.decision === "rejected") {
+      log.error(`Rejected in Prodgator${decided(view)}. The deployment to ${view.environment} is stopped.`);
+      return 1;
+    }
+    if (view.decision === "closed") {
+      log.error(`The Prodgator gate for ${view.environment} is closed (deployment ${view.status}). Run the step again to open a new gate.`);
+      return 1;
+    }
+    if (!announced) {
+      log.info(`Waiting for approval in Prodgator (up to ${opts.timeoutMinutes} minutes).`);
+      announced = true;
+    }
+    const waitMs = Math.max(5, view.pollAfterSeconds || 10) * 1e3;
+    if (deps.nowMs() + waitMs > deadline) {
+      log.error(`No decision in Prodgator after ${opts.timeoutMinutes} minutes. The deployment to ${view.environment} is stopped; run the step again to wait again.`);
+      return 1;
+    }
+    await deps.sleep(waitMs);
+    try {
+      view = await readGate(opts.prodgatorUrl, gate, client);
+      failures = 0;
+    } catch (e) {
+      if (!(e instanceof ReportError) || !e.retryable || ++failures > MAX_POLL_FAILURES) throw e;
+      log.warn(`Could not read the gate (${e.code}); trying again.`);
+    }
+  }
+}
+
 // src/cli/main.ts
 var WARNINGS = {
   REPORT_REPLACED_BY_OTHER_RUNNER: "Another job with the same job and report name replaced this report. Give each job its own name input."
@@ -5336,18 +5420,29 @@ async function run(deps = {}) {
   const argv = deps.argv ?? process.argv.slice(2);
   const log = deps.log ?? { info: (m) => console.log(m), warn: (m) => console.log(`Warning: ${m}`), error: (m) => console.error(m) };
   if (argv.includes("--version")) {
-    log.info("1.8.0");
+    log.info("1.10.0");
     return 0;
   }
   let failOnError = false;
+  const truthy = (v) => v?.trim().toLowerCase() === "true";
+  let gate = argv.some((a) => a === "--gate" || a === "--gate=true") || truthy(env.PRODGATOR_GATE) || argv.includes("--pipe") && truthy(env.GATE);
   try {
     const opts = parseOptions(argv, env);
     failOnError = opts.failOnError;
+    gate = opts.gate;
     const ci = detectCi(env, deps.cwd ?? process.cwd());
     const variable = opts.tokenVariable ?? ci.defaultTokenVariable;
     const token = readToken(env, variable, ci.provider);
     const problem = tokenProblem(token, opts.audience, ci.provider, variable, (deps.nowMs ?? Date.now)());
     if (problem) throw new CliError(problem);
+    if (opts.gate) {
+      const client2 = { getToken: async () => token, fetch: deps.fetch, sleep: deps.sleep, fixedToken: true, userAgent: `prodgator-report/${"1.10.0"} (${ci.provider}; gate)` };
+      return await runGate(ci, { prodgatorUrl: opts.prodgatorUrl, audience: opts.audience, timeoutMinutes: opts.gateTimeoutMinutes }, client2, {
+        sleep: deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms))),
+        nowMs: deps.nowMs ?? Date.now,
+        log
+      });
+    }
     const secrets = secretValues(env, [variable, ...opts.redactVariables]);
     const glob2 = workspaceGlob(ci.workspace, (w) => log.warn(w));
     const rawSummary = await readSummary(ci.workspace, opts.summary, opts.summaryFile, (m) => log.info(m));
@@ -5364,7 +5459,7 @@ async function run(deps = {}) {
       fetch: deps.fetch,
       sleep: deps.sleep,
       fixedToken: true,
-      userAgent: `prodgator-report/${"1.8.0"} (${ci.provider})`
+      userAgent: `prodgator-report/${"1.10.0"} (${ci.provider})`
     };
     const request = buildIngestRequest({ job: { name: opts.jobName ?? ci.jobName, matrix: opts.matrix, runner: ci.runner }, name: opts.name, summary, attestations, files });
     const res = await sendReport(opts.prodgatorUrl, ci.provider, request, opts.audience, client);
@@ -5390,6 +5485,10 @@ async function run(deps = {}) {
     return 0;
   } catch (e) {
     const msg2 = e instanceof ReportError ? `${e.code}: ${e.message}` : e.message;
+    if (gate) {
+      log.error(`Prodgator gate failed: ${msg2}`);
+      return 1;
+    }
     if (failOnError) {
       log.error(`Prodgator report failed: ${msg2}`);
       return 1;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@prodgator/report",
-  "version": "1.8.0",
+  "version": "1.10.0",
   "description": "Send CI job summaries, test results, attestations and artifacts to Prodgator, authenticated with the CI system's OIDC token",
   "license": "MIT",
   "homepage": "https://docs.prodgator.io/pipelines/run-reports",