@secureci/cli 0.0.0-stage → 0.1.0

package/dist/runner/github-context.js

@@ -0,0 +1,235 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tryGit = tryGit;
+exports.parseRepositoryFromRemote = parseRepositoryFromRemote;
+exports.payloadString = payloadString;
+exports.buildGithubContext = buildGithubContext;
+exports.declaredInputDefaults = declaredInputDefaults;
+exports.typedInputs = typedInputs;
+exports.workflowCallOutputs = workflowCallOutputs;
+exports.workflowTriggers = workflowTriggers;
+exports.loadEvent = loadEvent;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+/**
+ * Best-effort local git lookup, used to populate `github.sha` / `github.ref`.
+ * Returns undefined if git isn't available or the directory isn't a repo.
+ */
+function tryGit(command, cwd) {
+    try {
+        return (0, child_process_1.execSync)(command, { cwd, stdio: ['ignore', 'pipe', 'ignore'] })
+            .toString()
+            .trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * `owner/repo` from a git remote URL (`git@host:o/r.git`,
+ * `https://host/o/r`, `ssh://git@host/o/r.git`); undefined for local paths.
+ */
+function parseRepositoryFromRemote(url) {
+    const match = url
+        .trim()
+        .match(/^(?:[\w.-]+@[\w.-]+:|(?:https?|ssh|git):\/\/(?:[^@/]+@)?[^/]+\/)([^/]+)\/([^/]+?)(?:\.git)?\/?$/);
+    return match ? `${match[1]}/${match[2]}` : undefined;
+}
+function payloadString(payload, ...keys) {
+    let value = payload;
+    for (const key of keys) {
+        if (!value || typeof value !== 'object')
+            return undefined;
+        value = value[key];
+    }
+    return typeof value === 'string' && value ? value : undefined;
+}
+/**
+ * Build a (best-effort, local-only) `github.*` context object. Real GitHub
+ * Actions populates this from the live Actions run; locally we fall back to
+ * `GITHUB_*` environment variables (if the user has set them), the event
+ * payload, and local git state (HEAD, branch, `origin` remote), matching
+ * act's approach of approximating the context for local runs.
+ */
+function buildGithubContext(workflowName, jobId, cwd, event = { name: 'workflow_dispatch', payload: {} }, token = '', runId = '') {
+    const env = process.env;
+    const sha = env.GITHUB_SHA || tryGit('git rev-parse HEAD', cwd) || '';
+    const ref = env.GITHUB_REF ||
+        payloadString(event.payload, 'ref') ||
+        (() => {
+            const branch = tryGit('git rev-parse --abbrev-ref HEAD', cwd);
+            return branch ? `refs/heads/${branch}` : '';
+        })();
+    const refName = env.GITHUB_REF_NAME || ref.replace(/^refs\/(heads|tags)\//, '');
+    const remote = tryGit('git config --get remote.origin.url', cwd);
+    const repository = env.GITHUB_REPOSITORY ||
+        payloadString(event.payload, 'repository', 'full_name') ||
+        (remote && parseRepositoryFromRemote(remote)) ||
+        path.basename(cwd);
+    return {
+        workflow: workflowName,
+        job: jobId,
+        sha,
+        ref,
+        ref_name: refName,
+        event_name: event.name,
+        event: event.payload,
+        actor: env.GITHUB_ACTOR || os.userInfo().username,
+        repository,
+        repository_owner: env.GITHUB_REPOSITORY_OWNER ||
+            payloadString(event.payload, 'repository', 'owner', 'login') ||
+            (repository.includes('/') ? repository.split('/')[0] : ''),
+        run_id: runId || env.GITHUB_RUN_ID || String(Date.now()),
+        run_number: env.GITHUB_RUN_NUMBER || '1',
+        run_attempt: env.GITHUB_RUN_ATTEMPT || '1',
+        workspace: env.GITHUB_WORKSPACE || cwd,
+        server_url: env.GITHUB_SERVER_URL || 'https://github.com',
+        api_url: env.GITHUB_API_URL || 'https://api.github.com',
+        // Only what the user passed as secrets.GITHUB_TOKEN: a local token is
+        // never picked up implicitly, since every action in the run could read it.
+        token
+    };
+}
+/**
+ * Defaults declared for `on.workflow_dispatch.inputs` / `on.workflow_call.
+ * inputs`, which populate the `inputs` context when not passed explicitly.
+ */
+function declaredInputDefaults(on) {
+    const defaults = {};
+    if (!on || typeof on !== 'object' || Array.isArray(on))
+        return defaults;
+    for (const trigger of ['workflow_dispatch', 'workflow_call']) {
+        const inputs = on[trigger]
+            ?.inputs;
+        if (!inputs || typeof inputs !== 'object')
+            continue;
+        for (const [name, def] of Object.entries(inputs)) {
+            if (def && def.default !== undefined && !(name in defaults)) {
+                defaults[name] = String(def.default);
+            }
+        }
+    }
+    return defaults;
+}
+/**
+ * The `inputs` context: values as given (strings), with `boolean` and
+ * `number` inputs declared in `on.workflow_dispatch` / `on.workflow_call`
+ * converted to their types, as on GitHub (so `if: inputs.flag` is false
+ * for `flag: false`, not the truthy string "false").
+ */
+function typedInputs(on, inputs) {
+    const types = {};
+    if (on && typeof on === 'object' && !Array.isArray(on)) {
+        for (const trigger of ['workflow_dispatch', 'workflow_call']) {
+            const declared = on[trigger]
+                ?.inputs;
+            if (!declared || typeof declared !== 'object')
+                continue;
+            for (const [name, def] of Object.entries(declared)) {
+                if (def && typeof def.type === 'string' && !(name in types)) {
+                    types[name] = def.type;
+                }
+            }
+        }
+    }
+    const typed = { ...inputs };
+    for (const [name, value] of Object.entries(inputs)) {
+        if (types[name] === 'boolean' && /^(true|false)$/i.test(value.trim())) {
+            typed[name] = value.trim().toLowerCase() === 'true';
+        }
+        else if (types[name] === 'number' &&
+            value.trim() !== '' &&
+            Number.isFinite(Number(value))) {
+            typed[name] = Number(value);
+        }
+    }
+    return typed;
+}
+/** `on.workflow_call.outputs` as name -> value expression, if declared. */
+function workflowCallOutputs(on) {
+    const outputs = on && typeof on === 'object' && !Array.isArray(on)
+        ? on.workflow_call?.outputs
+        : undefined;
+    if (!outputs || typeof outputs !== 'object')
+        return undefined;
+    const values = {};
+    for (const [name, def] of Object.entries(outputs)) {
+        if (def?.value !== undefined)
+            values[name] = String(def.value);
+    }
+    return values;
+}
+/** The workflow's own triggers, in declaration order. */
+function workflowTriggers(on) {
+    if (typeof on === 'string')
+        return [on];
+    if (Array.isArray(on))
+        return on.map(String);
+    if (on && typeof on === 'object')
+        return Object.keys(on);
+    return [];
+}
+/**
+ * The event for this run: `--event-name`, else $GITHUB_EVENT_NAME, else
+ * workflow_dispatch if the workflow declares it, else its first trigger.
+ * The payload comes from `--event-path`; without one, workflow_dispatch
+ * gets `{ inputs }` like on GitHub, other events `{}`.
+ */
+function loadEvent(options, inputs, on) {
+    const triggers = workflowTriggers(on);
+    const name = options.eventName ||
+        process.env.GITHUB_EVENT_NAME ||
+        (triggers.includes('workflow_dispatch') || triggers.length === 0
+            ? 'workflow_dispatch'
+            : triggers[0]);
+    if (!options.eventPath) {
+        return { name, payload: name === 'workflow_dispatch' ? { inputs } : {} };
+    }
+    let payload;
+    try {
+        payload = JSON.parse(fs.readFileSync(options.eventPath, 'utf-8'));
+    }
+    catch (error) {
+        throw new Error(`Invalid event payload ${options.eventPath}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
+        throw new Error(`Invalid event payload ${options.eventPath}: expected a JSON object`);
+    }
+    return { name, payload: payload };
+}
+//# sourceMappingURL=github-context.js.map

package/dist/runner/hash-files.js

@@ -0,0 +1,123 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.globToRegExp = globToRegExp;
+exports.hashFiles = hashFiles;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * Convert a glob (`**`, `*`, `?`) to a regex over `/`-separated paths
+ * relative to the workspace.
+ */
+function globToRegExp(pattern) {
+    let source = '';
+    for (let i = 0; i < pattern.length; i++) {
+        const ch = pattern[i];
+        if (ch === '*' && pattern[i + 1] === '*') {
+            if (pattern[i + 2] === '/') {
+                source += '(?:.*/)?';
+                i += 2;
+            }
+            else {
+                source += '.*';
+                i += 1;
+            }
+        }
+        else if (ch === '*') {
+            source += '[^/]*';
+        }
+        else if (ch === '?') {
+            source += '[^/]';
+        }
+        else {
+            source += ch.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+        }
+    }
+    return new RegExp(`^${source}$`);
+}
+function walk(dir, root, files) {
+    let entries;
+    try {
+        entries = fs.readdirSync(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            walk(full, root, files);
+        }
+        else if (entry.isFile()) {
+            files.push(path.relative(root, full).split(path.sep).join('/'));
+        }
+    }
+}
+/**
+ * GitHub's `hashFiles(...patterns)`: SHA-256 over the concatenated SHA-256
+ * digests of every matching file (sorted by path), or '' when nothing
+ * matches. Patterns are relative to the workspace; `!pattern` excludes.
+ */
+function hashFiles(workspace, patterns) {
+    const includes = [];
+    const excludes = [];
+    for (const raw of patterns) {
+        const pattern = raw.trim().replace(/^\.\//, '');
+        if (!pattern)
+            continue;
+        if (pattern.startsWith('!')) {
+            excludes.push(globToRegExp(pattern.slice(1).replace(/^\.\//, '')));
+        }
+        else {
+            includes.push(globToRegExp(pattern));
+        }
+    }
+    const all = [];
+    walk(workspace, workspace, all);
+    const matched = all
+        .filter((file) => includes.some((re) => re.test(file)) &&
+        !excludes.some((re) => re.test(file)))
+        .map((file) => path.join(workspace, file))
+        .sort();
+    if (matched.length === 0)
+        return '';
+    const combined = crypto.createHash('sha256');
+    for (const file of matched) {
+        combined.update(crypto.createHash('sha256').update(fs.readFileSync(file)).digest());
+    }
+    return combined.digest('hex');
+}
+//# sourceMappingURL=hash-files.js.map

package/dist/runner/job-container.js

@@ -0,0 +1,322 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_RUNNER_IMAGES = exports.DEFAULT_CONTAINER_IMAGE = void 0;
+exports.installContainerCleanup = installContainerCleanup;
+exports.noRuntimeMessage = noRuntimeMessage;
+exports.startJobContainer = startJobContainer;
+exports.runnerImage = runnerImage;
+exports.stopJobContainer = stopJobContainer;
+exports.startJobServices = startJobServices;
+exports.stopJobServices = stopJobServices;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+const logger_1 = require("../utils/logger");
+const expression_1 = require("./expression");
+const container_runtime_1 = require("./container-runtime");
+const shell_1 = require("./shell");
+/**
+ * Image for jobs whose `runs-on` has no image mapping. Runner-like (Node.js,
+ * git, curl and common tools), as used by nektos/act.
+ */
+exports.DEFAULT_CONTAINER_IMAGE = 'catthehacker/ubuntu:act-22.04';
+/** Built-in `runs-on` label -> image mapping, extended by `runner-images`. */
+exports.DEFAULT_RUNNER_IMAGES = {
+    'ubuntu-latest': 'catthehacker/ubuntu:act-latest',
+    'ubuntu-24.04': 'catthehacker/ubuntu:act-24.04',
+    'ubuntu-22.04': 'catthehacker/ubuntu:act-22.04',
+    'ubuntu-20.04': 'catthehacker/ubuntu:act-20.04'
+};
+const activeContainers = new Set();
+const activeNetworks = new Set();
+let containerCleanupInstalled = false;
+/**
+ * Make sure job containers are removed if the CLI exits early (Ctrl-C,
+ * SIGTERM, or an exit that skips the normal per-job cleanup).
+ */
+function installContainerCleanup() {
+    if (containerCleanupInstalled)
+        return;
+    containerCleanupInstalled = true;
+    const cleanup = () => {
+        for (const container of activeContainers) {
+            container.runtime.stopSync(container.id);
+        }
+        activeContainers.clear();
+        for (const network of activeNetworks) {
+            network.runtime.removeNetworkSync(network.name);
+        }
+        activeNetworks.clear();
+    };
+    process.once('exit', cleanup);
+    for (const [signal, code] of [
+        ['SIGINT', 130],
+        ['SIGTERM', 143]
+    ]) {
+        process.once(signal, () => {
+            cleanup();
+            process.exit(code);
+        });
+    }
+}
+/** Why a run can't start without its container runtime, and what to do. */
+function noRuntimeMessage(preference) {
+    const which = preference === 'auto'
+        ? 'docker, podman or containerd (nerdctl)'
+        : `"${preference}"`;
+    return `No container runtime available: ${which} is not installed or not running. Start it, pick another with --container-runtime, or run steps directly on this machine, with your user's privileges, with --container-runtime host.`;
+}
+/**
+ * Start the job's container when container isolation is on, using
+ * `jobs.<id>.container` if set, else the image for its `runs-on`. Returns
+ * false (the job then fails) when the runtime is unavailable or the
+ * container can't be started; steps never fall back to the host.
+ */
+async function startJobContainer(job, ctx, options, runtime, runDir) {
+    const preference = options.containerRuntime ?? 'host';
+    const spec = typeof job?.container === 'string'
+        ? { image: job.container }
+        : job?.container;
+    if (preference === 'host') {
+        if (spec) {
+            logger_1.logger.warn(`Ignoring jobs.<id>.container (${spec.image}): container runtime is "host", running on the host.`);
+        }
+        return true;
+    }
+    const containerRuntime = await (0, container_runtime_1.resolveContainerRuntime)(preference);
+    if (!containerRuntime) {
+        logger_1.logger.error(noRuntimeMessage(preference));
+        return false;
+    }
+    if (spec &&
+        'image' in spec &&
+        (('options' in spec && spec.options) ||
+            ('volumes' in spec && spec.volumes) ||
+            ('ports' in spec && spec.ports) ||
+            ('credentials' in spec && spec.credentials))) {
+        logger_1.logger.warn('jobs.<id>.container: only image and env are supported; ignoring options/volumes/ports/credentials.');
+    }
+    // `container: ${{ inputs.image || null }}` that comes out empty means no
+    // container image, as on GitHub: use the image for runs-on.
+    const specImage = spec?.image
+        ? (0, expression_1.substituteExpressions)(spec.image, ctx).trim()
+        : '';
+    const image = specImage ||
+        options.containerImage ||
+        runnerImage(job?.['runs-on'], ctx, options);
+    const containerEnv = (0, expression_1.substituteRecord)(specImage && spec && 'env' in spec ? spec.env : undefined, ctx);
+    const exchangeDir = fs.mkdtempSync(path.join(runDir, 'container-'));
+    fs.chmodSync(exchangeDir, 0o777);
+    fs.copyFileSync(runtime.eventPath, path.join(exchangeDir, 'event.json'));
+    logger_1.logger.info(`Starting job container: ${image} (${containerRuntime.name})`);
+    const started = await containerRuntime.start({
+        image,
+        workingDir: process.cwd(),
+        exchangeDir,
+        env: containerEnv,
+        memoryLimit: options.containerMemoryLimit,
+        networkDisabled: options.networkDisabled === true,
+        network: runtime.services?.network
+    });
+    if (!started.success || !started.id) {
+        logger_1.logger.error(`Failed to start job container (${image}): ${started.error}`);
+        return false;
+    }
+    const bashProbe = await containerRuntime.exec(started.id, {
+        command: 'command -v bash'
+    });
+    runtime.container = {
+        runtime: containerRuntime,
+        id: started.id,
+        image,
+        exchangeDir,
+        bash: bashProbe.success,
+        actionDirs: new Map()
+    };
+    installContainerCleanup();
+    activeContainers.add(runtime.container);
+    return true;
+}
+/**
+ * The image for a job's `runs-on`: the first label with a mapping in
+ * `runner-images` (or the built-in one), else the default image, with a
+ * warning for labels that have no mapping.
+ */
+function runnerImage(runsOn, ctx, options) {
+    const fallback = options.defaultContainerImage || exports.DEFAULT_CONTAINER_IMAGE;
+    const raw = runsOn;
+    const labels = (Array.isArray(raw)
+        ? raw
+        : raw && typeof raw === 'object'
+            ? [raw.labels ?? []].flat()
+            : [raw])
+        .filter((label) => typeof label === 'string')
+        .map((label) => (0, expression_1.substituteExpressions)(label, ctx));
+    if (labels.length === 0)
+        return fallback;
+    const mapping = { ...exports.DEFAULT_RUNNER_IMAGES, ...options.runnerImages };
+    for (const label of labels) {
+        if (mapping[label])
+            return mapping[label];
+    }
+    const shown = labels.join(', ');
+    if (labels.some((label) => /windows|macos/i.test(label))) {
+        logger_1.logger.warn(`runs-on "${shown}": only Linux containers are supported; running in ${fallback}.`);
+    }
+    else {
+        logger_1.logger.warn(`runs-on "${shown}" has no image mapping; using ${fallback} (map it with runner-images in ~/.secureci/config.yml).`);
+    }
+    return fallback;
+}
+async function stopJobContainer(runtime) {
+    const container = runtime.container;
+    if (container) {
+        activeContainers.delete(container);
+        runtime.container = undefined;
+        await container.runtime.stop(container.id);
+    }
+    await stopJobServices(runtime);
+}
+/** How long services may take to report healthy. */
+const SERVICE_HEALTH_TIMEOUT_MS = 5 * 60 * 1000;
+const SERVICE_HEALTH_POLL_MS = 1000;
+/**
+ * Start `jobs.<id>.services`, before the job container. In container
+ * mode, services join a per-job network under their service id (so steps
+ * reach `postgres:5432`), and the job container joins it too; on the host,
+ * they're reached through their published `ports` on localhost. Waits
+ * for health checks, and exposes `job.services.<id>.{id,network,ports}`.
+ * Returns false (after cleaning up) if a service can't be started.
+ */
+async function startJobServices(job, ctx, options, runtime) {
+    const specs = Object.entries(job.services ?? {});
+    if (specs.length === 0)
+        return true;
+    const preference = options.containerRuntime ?? 'host';
+    const jobRuntime = preference === 'host' ? null : await (0, container_runtime_1.resolveContainerRuntime)(preference);
+    const containerRuntime = jobRuntime ?? (await (0, container_runtime_1.resolveContainerRuntime)('auto'));
+    if (!containerRuntime) {
+        logger_1.logger.error('jobs.<id>.services need a container runtime (docker, podman or containerd), but none is available.');
+        return false;
+    }
+    if (jobRuntime && options.networkDisabled) {
+        logger_1.logger.error('jobs.<id>.services need networking, but container networking is disabled (--no-network).');
+        return false;
+    }
+    const services = {
+        runtime: containerRuntime,
+        ids: []
+    };
+    runtime.services = services;
+    installContainerCleanup();
+    if (jobRuntime) {
+        const network = `secureci-${crypto.randomBytes(6).toString('hex')}`;
+        if (!(await containerRuntime.createNetwork(network))) {
+            logger_1.logger.error(`Failed to create the job network ${network}`);
+            return false;
+        }
+        services.network = network;
+        activeNetworks.add({ runtime: containerRuntime, name: network });
+    }
+    const contexts = {};
+    for (const [serviceId, spec] of specs) {
+        const service = typeof spec === 'string' ? { image: spec } : spec;
+        if (service.credentials) {
+            logger_1.logger.warn(`services.${serviceId}: credentials are ignored; log in with \`docker login\` instead.`);
+        }
+        const image = (0, expression_1.substituteExpressions)(service.image, ctx);
+        logger_1.logger.info(`Starting service ${serviceId}: ${image}`);
+        const started = await containerRuntime.start({
+            image,
+            service: true,
+            ...(services.network
+                ? { network: services.network, networkAlias: serviceId }
+                : {}),
+            ports: (service.ports ?? []).map((port) => (0, expression_1.substituteExpressions)(String(port), ctx)),
+            volumes: (service.volumes ?? []).map((v) => (0, expression_1.substituteExpressions)(v, ctx)),
+            extraArgs: service.options
+                ? (0, shell_1.splitArgs)((0, expression_1.substituteExpressions)(service.options, ctx))
+                : [],
+            env: (0, expression_1.substituteRecord)(service.env, ctx)
+        });
+        if (!started.success || !started.id) {
+            logger_1.logger.error(`Failed to start service ${serviceId} (${image}): ${started.error}`);
+            return false;
+        }
+        services.ids.push(started.id);
+        activeContainers.add({ runtime: containerRuntime, id: started.id });
+        const deadline = Date.now() + SERVICE_HEALTH_TIMEOUT_MS;
+        for (;;) {
+            const health = await containerRuntime.health(started.id);
+            if (health === 'healthy' || health === 'none')
+                break;
+            if (health === 'unhealthy' || Date.now() > deadline) {
+                logger_1.logger.error(`Service ${serviceId} is not healthy (${health}).`);
+                return false;
+            }
+            await new Promise((resolve) => setTimeout(resolve, SERVICE_HEALTH_POLL_MS));
+        }
+        contexts[serviceId] = {
+            id: started.id,
+            network: services.network ?? '',
+            ports: await containerRuntime.ports(started.id)
+        };
+    }
+    ctx.job = { ...ctx.job, services: contexts };
+    return true;
+}
+/** Remove the job's service containers and network. */
+async function stopJobServices(runtime) {
+    const services = runtime.services;
+    if (!services)
+        return;
+    runtime.services = undefined;
+    for (const id of services.ids) {
+        for (const entry of activeContainers) {
+            if (entry.id === id)
+                activeContainers.delete(entry);
+        }
+        await services.runtime.stop(id);
+    }
+    if (services.network) {
+        for (const entry of activeNetworks) {
+            if (entry.name === services.network)
+                activeNetworks.delete(entry);
+        }
+        await services.runtime.removeNetwork(services.network);
+    }
+}
+//# sourceMappingURL=job-container.js.map