@redwoodjs/agent-ci 0.1.0

package/dist/runner/directory-setup.js

@@ -0,0 +1,98 @@
+import path from "path";
+import fs from "fs";
+import { getWorkingDirectory } from "../output/working-directory.js";
+import { computeLockfileHash, repairWarmCache } from "../output/cleanup.js";
+import { config } from "../config.js";
+import { findRepoRoot } from "./metadata.js";
+import { debugRunner } from "../output/debug.js";
+// ─── Directory creation ───────────────────────────────────────────────────────
+/**
+ * Create all per-run and shared-cache directories, returning the paths.
+ *
+ * Also verifies warm-cache integrity and ensures world-writable permissions
+ * for DinD scenarios.
+ */
+export function createRunDirectories(opts) {
+    const { runDir, githubRepo, workflowPath } = opts;
+    const workDir = getWorkingDirectory();
+    // Per-run dirs
+    const containerWorkDir = path.resolve(runDir, "work");
+    const shimsDir = path.resolve(runDir, "shims");
+    const signalsDir = path.resolve(runDir, "signals");
+    const diagDir = path.resolve(runDir, "diag");
+    // Shared caches
+    const repoSlug = (githubRepo || config.GITHUB_REPO).replace("/", "-");
+    const toolCacheDir = path.resolve(workDir, "cache", "toolcache");
+    const pnpmStoreDir = path.resolve(workDir, "cache", "pnpm-store", repoSlug);
+    const npmCacheDir = path.resolve(workDir, "cache", "npm-cache", repoSlug);
+    const bunCacheDir = path.resolve(workDir, "cache", "bun-cache", repoSlug);
+    const playwrightCacheDir = path.resolve(workDir, "cache", "playwright", repoSlug);
+    // Warm node_modules: keyed by the lockfile hash (any supported PM)
+    let lockfileHash = "no-lockfile";
+    try {
+        const repoRoot = workflowPath ? findRepoRoot(workflowPath) : undefined;
+        if (repoRoot) {
+            lockfileHash = computeLockfileHash(repoRoot);
+        }
+    }
+    catch {
+        // Best-effort; fall back to "no-lockfile"
+    }
+    const warmModulesDir = path.resolve(workDir, "cache", "warm-modules", repoSlug, lockfileHash);
+    // Workspace path
+    const repoName = (githubRepo || config.GITHUB_REPO).split("/").pop() || "repo";
+    const workspaceDir = path.resolve(containerWorkDir, repoName, repoName);
+    // Create all directories
+    const allDirs = [
+        workspaceDir,
+        containerWorkDir,
+        shimsDir,
+        signalsDir,
+        diagDir,
+        toolCacheDir,
+        pnpmStoreDir,
+        npmCacheDir,
+        bunCacheDir,
+        playwrightCacheDir,
+        warmModulesDir,
+    ];
+    for (const dir of allDirs) {
+        fs.mkdirSync(dir, { recursive: true, mode: 0o777 });
+    }
+    // Verify warm cache integrity
+    const cacheStatus = repairWarmCache(warmModulesDir);
+    if (cacheStatus === "repaired") {
+        debugRunner(`Repaired corrupted warm cache: ${warmModulesDir}`);
+    }
+    // Ensure world-writable for DinD scenarios
+    ensureWorldWritable(allDirs);
+    return {
+        containerWorkDir,
+        shimsDir,
+        signalsDir,
+        diagDir,
+        toolCacheDir,
+        pnpmStoreDir,
+        npmCacheDir,
+        bunCacheDir,
+        playwrightCacheDir,
+        warmModulesDir,
+        workspaceDir,
+        repoSlug,
+    };
+}
+// ─── Permissions helper ───────────────────────────────────────────────────────
+/**
+ * Ensure all directories are world-writable (0o777).
+ * Errors are ignored (non-critical).
+ */
+export function ensureWorldWritable(dirs) {
+    try {
+        for (const dir of dirs) {
+            fs.chmodSync(dir, 0o777);
+        }
+    }
+    catch {
+        // Ignore chmod errors (non-critical)
+    }
+}

package/dist/runner/directory-setup.test.js

@@ -0,0 +1,31 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+// ── ensureWorldWritable ───────────────────────────────────────────────────────
+describe("ensureWorldWritable", () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "dirsetup-test-"));
+    });
+    afterEach(() => {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it("sets all directories to 0o777", async () => {
+        const { ensureWorldWritable } = await import("./directory-setup.js");
+        const dir1 = path.join(tmpDir, "a");
+        const dir2 = path.join(tmpDir, "b");
+        fs.mkdirSync(dir1);
+        fs.mkdirSync(dir2);
+        // Start with restrictive permissions
+        fs.chmodSync(dir1, 0o700);
+        fs.chmodSync(dir2, 0o700);
+        ensureWorldWritable([dir1, dir2]);
+        expect(fs.statSync(dir1).mode & 0o777).toBe(0o777);
+        expect(fs.statSync(dir2).mode & 0o777).toBe(0o777);
+    });
+    it("does not throw on non-existent directories", async () => {
+        const { ensureWorldWritable } = await import("./directory-setup.js");
+        expect(() => ensureWorldWritable(["/nonexistent/path"])).not.toThrow();
+    });
+});

package/dist/runner/git-shim.js

@@ -0,0 +1,92 @@
+import path from "path";
+import fs from "fs";
+// ─── Fake SHA computation ─────────────────────────────────────────────────────
+/**
+ * Resolve which SHA the git shim should return for ls-remote / rev-parse.
+ * Uses the real SHA if provided, otherwise falls back to a deterministic fake.
+ */
+export function computeFakeSha(headSha) {
+    return headSha && headSha !== "HEAD" ? headSha : "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+}
+// ─── Git shim script ──────────────────────────────────────────────────────────
+/**
+ * Write the bash git shim to `<shimsDir>/git`.
+ *
+ * The shim intercepts git commands inside the runner container to make
+ * actions/checkout work against the pre-populated local workspace instead
+ * of fetching from a real remote.
+ */
+export function writeGitShim(shimsDir, fakeSha) {
+    const gitShimPath = path.join(shimsDir, "git");
+    fs.writeFileSync(gitShimPath, `#!/bin/bash
+
+# Log every call for debugging
+echo "git $*" >> /home/runner/_diag/agent-ci-git-calls.log
+
+# actions/checkout probes the remote URL via config.
+# It computes the expected URL using URL.origin, which strips the default port 80.
+# So we must return the URL WITHOUT :80 to match.
+if [[ "$*" == *"config --local --get remote.origin.url"* || "$*" == *"config --get remote.origin.url"* ]]; then
+  echo "https://github.com/\${GITHUB_REPOSITORY}"
+  exit 0
+fi
+
+# actions/checkout probes ls-remote to find the target SHA.
+# Return the same SHA that github.sha uses in the job definition.
+if [[ "$*" == *"ls-remote"* ]]; then
+  echo "${fakeSha}\\tHEAD"
+  echo "${fakeSha}\\trefs/heads/main"
+  exit 0
+fi
+
+# Intercept fetch - we don't have a real git server, so fetch is a no-op.
+# But we must create refs/remotes/origin/main so checkout's post-fetch validation passes.
+if [[ "$*" == *"fetch"* ]]; then
+  echo "[Agent CI Shim] Intercepted 'fetch' - workspace is pre-populated."
+  # If this is a fresh git init (no commits), create a seed commit
+  # so HEAD is valid and we can create branches from it.
+  if ! /usr/bin/git.real rev-parse HEAD >/dev/null 2>&1; then
+    /usr/bin/git.real config user.name "agent-ci" 2>/dev/null
+    /usr/bin/git.real config user.email "agent-ci@example.com" 2>/dev/null
+    /usr/bin/git.real add -A 2>/dev/null
+    /usr/bin/git.real commit --allow-empty -m "workspace" 2>/dev/null
+  fi
+  /usr/bin/git.real update-ref refs/remotes/origin/main HEAD 2>/dev/null || true
+  exit 0
+fi
+
+# Redirect: git checkout ... refs/remotes/origin/main -> create local main from HEAD.
+# Note: actions/checkout deletes the local 'main' branch before fetching, so we cannot
+# checkout the local branch - instead we recreate it from the current HEAD commit.
+if [[ "$*" == *"checkout"* && "$*" == *"refs/remotes/origin/"* ]]; then
+  echo "[Agent CI Shim] Redirecting remote checkout - recreating main from HEAD."
+  /usr/bin/git.real checkout -B main HEAD
+  exit $?
+fi
+
+# Intercept clean and rm which can destroy workspace files
+if [[ "$1" == "clean" || "$1" == "rm" ]]; then
+  echo "[Agent CI Shim] Intercepted '$1' to protect local files."
+  exit 0
+fi
+
+# Intercept rev-parse for HEAD/refs/heads/main so the SHA matches github.sha
+# actions/checkout validates that refs/heads/main == github.sha after checkout
+if [[ "$1" == "rev-parse" ]]; then
+  for arg in "$@"; do
+    if [[ "$arg" == "HEAD" || "$arg" == "refs/heads/main" || "$arg" == "refs/remotes/origin/main" ]]; then
+      echo "${fakeSha}"
+      exit 0
+    fi
+  done
+  # Fall through for other rev-parse calls (e.g. rev-parse --show-toplevel)
+fi
+
+# Pass through all other git commands (checkout, reset, log, init, config, etc.)
+echo "git $@ (pass-through)" >> /home/runner/_diag/agent-ci-git-calls.log
+/usr/bin/git.real "$@"
+EXIT_CODE=$?
+echo "git $@ exited with $EXIT_CODE" >> /home/runner/_diag/agent-ci-git-calls.log
+exit $EXIT_CODE
+`, { mode: 0o755 });
+}

package/dist/runner/git-shim.test.js

@@ -0,0 +1,57 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+// ── computeFakeSha ────────────────────────────────────────────────────────────
+describe("computeFakeSha", () => {
+    it("returns the headSha when it is a real SHA", async () => {
+        const { computeFakeSha } = await import("./git-shim.js");
+        expect(computeFakeSha("abc123def456")).toBe("abc123def456");
+    });
+    it("returns the deterministic fake when headSha is HEAD", async () => {
+        const { computeFakeSha } = await import("./git-shim.js");
+        expect(computeFakeSha("HEAD")).toBe("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
+    });
+    it("returns the deterministic fake when headSha is undefined", async () => {
+        const { computeFakeSha } = await import("./git-shim.js");
+        expect(computeFakeSha(undefined)).toBe("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
+    });
+});
+// ── writeGitShim ──────────────────────────────────────────────────────────────
+describe("writeGitShim", () => {
+    let tmpDir;
+    beforeEach(() => {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "shim-test-"));
+    });
+    afterEach(() => {
+        fs.rmSync(tmpDir, { recursive: true, force: true });
+    });
+    it("creates an executable git shim with the correct SHA", async () => {
+        const { writeGitShim } = await import("./git-shim.js");
+        const sha = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef";
+        writeGitShim(tmpDir, sha);
+        const shimPath = path.join(tmpDir, "git");
+        expect(fs.existsSync(shimPath)).toBe(true);
+        const content = fs.readFileSync(shimPath, "utf-8");
+        expect(content).toContain("#!/bin/bash");
+        expect(content).toContain(sha);
+        expect(content).toContain("ls-remote");
+        expect(content).toContain("git.real");
+        // Check executable permission
+        const stat = fs.statSync(shimPath);
+        expect(stat.mode & 0o755).toBe(0o755);
+    });
+    it("includes all required interception clauses", async () => {
+        const { writeGitShim } = await import("./git-shim.js");
+        writeGitShim(tmpDir, "abc");
+        const content = fs.readFileSync(path.join(tmpDir, "git"), "utf-8");
+        // All key interception points
+        expect(content).toContain("config --local --get remote.origin.url");
+        expect(content).toContain("ls-remote");
+        expect(content).toContain("fetch");
+        expect(content).toContain("rev-parse");
+        expect(content).toContain("clean");
+        expect(content).toContain("checkout");
+        expect(content).toContain("pass-through");
+    });
+});