@secureci/cli 0.0.0-stage → 0.1.0

package/dist/runner/job-plan.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sameValue = sameValue;
+exports.matrixLabel = matrixLabel;
+exports.isTruthySetting = isTruthySetting;
+exports.numberSetting = numberSetting;
+exports.matrixValue = matrixValue;
+exports.expandMatrix = expandMatrix;
+exports.topologicalJobOrder = topologicalJobOrder;
+const logger_1 = require("../utils/logger");
+const expression_1 = require("./expression");
+/** Deep equality for matrix values (JSON-like data). */
+function sameValue(a, b) {
+    if (a === b)
+        return true;
+    if (!a || !b || typeof a !== 'object' || typeof b !== 'object')
+        return false;
+    if (Array.isArray(a) !== Array.isArray(b))
+        return false;
+    const keysA = Object.keys(a);
+    const keysB = Object.keys(b);
+    return (keysA.length === keysB.length &&
+        keysA.every((key) => sameValue(a[key], b[key])));
+}
+/** `key: value, ...` for a matrix combination's job label. */
+function matrixLabel(values) {
+    return Object.entries(values)
+        .map(([k, v]) => `${k}: ${v && typeof v === 'object' ? JSON.stringify(v) : v}`)
+        .join(', ');
+}
+/** A boolean setting that may be an expression (`continue-on-error`). */
+function isTruthySetting(value, ctx) {
+    const resolved = matrixValue(value, ctx);
+    return resolved === true || resolved === 'true';
+}
+/** A positive number setting (e.g. timeout-minutes), possibly an expression. */
+function numberSetting(value, ctx) {
+    if (value === undefined || value === null || value === '')
+        return undefined;
+    const n = Number(matrixValue(value, ctx));
+    return Number.isFinite(n) && n > 0 ? n : undefined;
+}
+/** A `${{ }}` string resolved to its value (e.g. via fromJSON), else as is. */
+function matrixValue(value, ctx) {
+    if (typeof value !== 'string' || !/^\s*\$\{\{[\s\S]*\}\}\s*$/.test(value)) {
+        return value;
+    }
+    return (0, expression_1.resolveExpressionValue)(value, ctx);
+}
+/**
+ * Expand a job's `strategy.matrix` into its combinations, as GitHub does:
+ * the cartesian product of the axes, minus combinations matching an
+ * `exclude` entry (on all of its keys), then each `include` entry is
+ * merged into every combination whose original axis values it doesn't
+ * change (values added by an earlier include may be overwritten), or
+ * added as a new combination if it fits none. The matrix, or any axis,
+ * may be an expression such as `${{ fromJSON(needs.x.outputs.m) }}`.
+ */
+function expandMatrix(rawMatrix, ctx) {
+    const matrix = matrixValue(rawMatrix, ctx);
+    if (!matrix || typeof matrix !== 'object' || Array.isArray(matrix)) {
+        return [{}];
+    }
+    const entries = (key) => {
+        const list = matrixValue(matrix[key], ctx);
+        return Array.isArray(list)
+            ? list.filter((e) => !!e && typeof e === 'object')
+            : [];
+    };
+    const include = entries('include');
+    const exclude = entries('exclude');
+    const axes = Object.entries(matrix)
+        .filter(([key]) => key !== 'include' && key !== 'exclude')
+        .map(([key, raw]) => {
+        const values = matrixValue(raw, ctx);
+        return [key, Array.isArray(values) ? values : [values]];
+    });
+    const axisKeys = new Set(axes.map(([key]) => key));
+    let combinations = axes.length ? [{}] : [];
+    for (const [key, values] of axes) {
+        combinations = combinations.flatMap((combo) => values.map((value) => ({ ...combo, [key]: value })));
+    }
+    combinations = combinations.filter((combo) => !exclude.some((entry) => Object.entries(entry).every(([key, value]) => sameValue(combo[key], value))));
+    const added = [];
+    for (const entry of include) {
+        let merged = false;
+        for (const combo of combinations) {
+            const fits = Object.entries(entry).every(([key, value]) => !axisKeys.has(key) || sameValue(combo[key], value));
+            if (fits) {
+                Object.assign(combo, entry);
+                merged = true;
+            }
+        }
+        if (!merged)
+            added.push({ ...entry });
+    }
+    combinations.push(...added);
+    return combinations.length ? combinations : [{}];
+}
+/**
+ * Order job IDs so dependencies (via `needs`) run before dependents, using
+ * Kahn's algorithm. Falls back to declaration order (with a warning) if a
+ * cycle is detected, since that indicates an invalid workflow.
+ */
+function topologicalJobOrder(jobs) {
+    const jobIds = Object.keys(jobs);
+    const needsOf = (id) => {
+        const needs = jobs[id].needs;
+        if (!needs)
+            return [];
+        return Array.isArray(needs) ? needs : [needs];
+    };
+    const inDegree = new Map();
+    for (const id of jobIds) {
+        inDegree.set(id, needsOf(id).filter((dep) => jobIds.includes(dep)).length);
+    }
+    const queue = jobIds.filter((id) => inDegree.get(id) === 0);
+    const ordered = [];
+    while (queue.length > 0) {
+        const id = queue.shift();
+        ordered.push(id);
+        for (const other of jobIds) {
+            if (needsOf(other).includes(id)) {
+                const remaining = (inDegree.get(other) || 0) - 1;
+                inDegree.set(other, remaining);
+                if (remaining === 0) {
+                    queue.push(other);
+                }
+            }
+        }
+    }
+    if (ordered.length !== jobIds.length) {
+        logger_1.logger.warn('Detected a cycle in job "needs" dependencies; falling back to declaration order.');
+        return jobIds;
+    }
+    return ordered;
+}
+//# sourceMappingURL=job-plan.js.map

package/dist/runner/job-runtime.js

@@ -0,0 +1,338 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createContainerStepFiles = createContainerStepFiles;
+exports.killStepProcesses = killStepProcesses;
+exports.containerPathPrefix = containerPathPrefix;
+exports.createRunDir = createRunDir;
+exports.runnerContext = runnerContext;
+exports.hostHasBash = hostHasBash;
+exports.createJobRuntime = createJobRuntime;
+exports.runPostSteps = runPostSteps;
+exports.fileCommandEnv = fileCommandEnv;
+exports.containerRunnerEnv = containerRunnerEnv;
+exports.finishStepOutput = finishStepOutput;
+exports.stepActionEnv = stepActionEnv;
+exports.actionDirInContainer = actionDirInContainer;
+exports.effectiveTimeout = effectiveTimeout;
+exports.stepDisplayName = stepDisplayName;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const logger_1 = require("../utils/logger");
+const child_process_1 = require("child_process");
+const expression_1 = require("./expression");
+const container_runtime_1 = require("./container-runtime");
+const runner_env_1 = require("./runner-env");
+/** Step files inside the job container's exchange dir, writable from it. */
+function createContainerStepFiles(container) {
+    const dir = fs.mkdtempSync(path.join(container.exchangeDir, 'step-'));
+    const files = (0, runner_env_1.createStepFiles)(dir);
+    fs.chmodSync(dir, 0o777);
+    for (const file of [
+        files.output,
+        files.env,
+        files.path,
+        files.state,
+        files.summary
+    ]) {
+        fs.chmodSync(file, 0o666);
+    }
+    return {
+        files,
+        containerDir: `${container_runtime_1.CONTAINER_EXCHANGE_DIR}/${path.basename(dir)}`
+    };
+}
+/**
+ * Kill what a timed-out step left running in the job container: every
+ * process whose environment carries the step's SECURECI_STEP marker
+ * (children inherit it). Killing the container client alone leaves the
+ * command running until the container is removed.
+ */
+async function killStepProcesses(container, marker) {
+    await container.runtime.exec(container.id, {
+        command: `for p in /proc/[0-9]*; do tr '\\0' '\\n' < "$p/environ" 2>/dev/null | grep -qx 'SECURECI_STEP=${marker}' && kill -9 "\${p#/proc/}" 2>/dev/null; done; true`
+    });
+}
+/** `export PATH=...` prefix applying `$GITHUB_PATH` additions in a shell. */
+function containerPathPrefix(runtime) {
+    return runtime.path.length
+        ? `export PATH="${runtime.path.join(':')}:$PATH"\n`
+        : '';
+}
+/**
+ * Create the per-run scratch directory holding the event payload
+ * (`$GITHUB_EVENT_PATH`) and `$RUNNER_TEMP`.
+ */
+function createRunDir() {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'secureci-run-'));
+    fs.writeFileSync(path.join(dir, 'event.json'), '{}');
+    fs.mkdirSync(path.join(dir, 'tmp'));
+    return dir;
+}
+/** The `runner` context, derived from the runner env. */
+function runnerContext(runtime) {
+    return {
+        name: 'secureci',
+        os: runtime.runnerEnv.RUNNER_OS,
+        arch: process.arch === 'arm64' ? 'ARM64' : 'X64',
+        temp: runtime.runnerEnv.RUNNER_TEMP,
+        tool_cache: runtime.runnerEnv.RUNNER_TOOL_CACHE
+    };
+}
+let hostBash;
+/** Whether bash is available on the host (decides the default shell). */
+function hostHasBash() {
+    if (hostBash === undefined) {
+        try {
+            (0, child_process_1.execSync)('command -v bash', { stdio: 'ignore' });
+            hostBash = true;
+        }
+        catch {
+            hostBash = false;
+        }
+    }
+    return hostBash;
+}
+function createJobRuntime(github, runDir, defaults = {}) {
+    const homeDir = process.env.HOME || process.env.USERPROFILE || os.tmpdir();
+    const eventPath = path.join(runDir, 'event.json');
+    return {
+        runnerEnv: (0, runner_env_1.buildRunnerEnv)(github, {
+            workspace: process.cwd(),
+            eventPath,
+            tempDir: path.join(runDir, 'tmp'),
+            toolCache: path.join(homeDir, '.secureci', 'toolcache')
+        }),
+        eventPath,
+        env: {},
+        path: [],
+        postSteps: [],
+        defaults,
+        summary: '',
+        actionEnv: {},
+        actionNames: new Map(),
+        preState: new Map(),
+        actionPaths: new Map()
+    };
+}
+/**
+ * Run the job's queued `post:` steps in reverse registration order, each
+ * gated on its `post-if` condition (default `always()`).
+ */
+async function runPostSteps(runtime, ctx, stepResults) {
+    for (const post of [...runtime.postSteps].reverse()) {
+        let run;
+        try {
+            run = (0, expression_1.evaluateCondition)(post.condition, ctx);
+        }
+        catch (error) {
+            const message = (0, expression_1.ifEvaluationError)(`step '${post.step.name}'`, error);
+            logger_1.logger.error(message);
+            stepResults.push({
+                step: post.step,
+                success: false,
+                error: message,
+                duration: 0
+            });
+            ctx.jobFailed = true;
+            continue;
+        }
+        if (!run) {
+            logger_1.logger.info(`Skipping step: ${post.step.name ?? 'post'} (condition not met)`);
+            continue;
+        }
+        logger_1.logger.info(`Running: ${post.step.name}`);
+        const result = await post.run();
+        stepResults.push(result);
+        if (!result.success) {
+            ctx.jobFailed = true;
+        }
+    }
+    runtime.postSteps = [];
+}
+/** `GITHUB_OUTPUT` / `GITHUB_ENV` / ... pointing at a step's files. */
+function fileCommandEnv(files, containerDir) {
+    const at = (file) => containerDir ? `${containerDir}/${path.basename(file)}` : file;
+    return {
+        GITHUB_OUTPUT: at(files.output),
+        GITHUB_ENV: at(files.env),
+        GITHUB_PATH: at(files.path),
+        GITHUB_STATE: at(files.state),
+        GITHUB_STEP_SUMMARY: at(files.summary)
+    };
+}
+/**
+ * The runner env as seen from inside a container: workspace and event
+ * payload at their mounted paths (the event payload is copied into the
+ * exchange dir's root).
+ */
+function containerRunnerEnv(runtime) {
+    return {
+        ...runtime.runnerEnv,
+        GITHUB_WORKSPACE: container_runtime_1.CONTAINER_WORKDIR,
+        GITHUB_EVENT_PATH: `${container_runtime_1.CONTAINER_EXCHANGE_DIR}/event.json`,
+        RUNNER_TEMP: '/tmp',
+        RUNNER_TOOL_CACHE: '/opt/hostedtoolcache'
+    };
+}
+/**
+ * Handle a finished step's stdout and file commands: register
+ * `::add-mask::` values before anything is logged, log the remaining
+ * output, and fold `$GITHUB_ENV` / `$GITHUB_PATH` changes into the job
+ * runtime. Returns the step's outputs and saved state.
+ */
+function finishStepOutput(stdout, files, runtime) {
+    const commands = (0, runner_env_1.processWorkflowCommands)(stdout || '');
+    commands.masks.forEach((mask, i) => logger_1.logger.registerSecrets({ [`mask-${i}`]: mask }));
+    for (const annotation of commands.annotations) {
+        if (annotation.level === 'warning')
+            logger_1.logger.warn(annotation.message);
+        else if (annotation.level === 'error')
+            logger_1.logger.error(annotation.message);
+        else if (annotation.level === 'debug')
+            logger_1.logger.debug(annotation.message);
+        else if (annotation.level === 'group')
+            logger_1.logger.info(`▸ ${annotation.message}`);
+        else
+            logger_1.logger.info(annotation.message);
+    }
+    const text = commands.text.trim();
+    if (text) {
+        logger_1.logger.info(text);
+    }
+    const fileResults = (0, runner_env_1.readStepFiles)(files);
+    runtime.summary += fileResults.summary;
+    Object.assign(runtime.env, fileResults.env);
+    runtime.path.unshift(...[...fileResults.path].reverse());
+    return {
+        outputs: { ...fileResults.outputs, ...commands.outputs },
+        state: { ...fileResults.state, ...commands.state }
+    };
+}
+/**
+ * The runner's per-step GITHUB_ACTION variables: GITHUB_ACTION is the
+ * step's id, else `__run` / `__owner_repo` (numbered `_2`, `_3`... when
+ * repeated); a remote `uses:` sets GITHUB_ACTION_REPOSITORY / _REF. Inside
+ * a composite action, steps also get its GITHUB_ACTION_PATH, and run steps
+ * its repository and ref.
+ */
+function stepActionEnv(runtime, step, parent) {
+    let name = step.id;
+    if (!name) {
+        const base = step.uses
+            ? `__${step.uses
+                .replace(/@.*$/, '')
+                .replace(/[^A-Za-z0-9]+/g, '_')
+                .replace(/^_+|_+$/g, '')}`
+            : '__run';
+        const count = (runtime.actionNames.get(base) ?? 0) + 1;
+        runtime.actionNames.set(base, count);
+        name = count === 1 ? base : `${base}_${count}`;
+    }
+    const remote = step.uses?.match(/^([^./][^/@]*\/[^/@]+)(?:\/[^@]*)?@(.+)$/);
+    const env = {
+        GITHUB_ACTION: name,
+        GITHUB_ACTION_REPOSITORY: remote
+            ? remote[1]
+            : step.uses
+                ? ''
+                : (parent?.repository ?? ''),
+        GITHUB_ACTION_REF: remote ? remote[2] : step.uses ? '' : (parent?.ref ?? '')
+    };
+    if (parent)
+        env.GITHUB_ACTION_PATH = parent.path;
+    return env;
+}
+/**
+ * An action directory's path inside the job container: copied once into
+ * the mounted exchange dir (the action cache isn't mounted).
+ */
+function actionDirInContainer(container, actionDir) {
+    let containerDir = container.actionDirs.get(actionDir);
+    if (!containerDir) {
+        const hash = crypto
+            .createHash('sha1')
+            .update(actionDir)
+            .digest('hex')
+            .slice(0, 12);
+        fs.cpSync(actionDir, path.join(container.exchangeDir, 'actions', hash), {
+            recursive: true
+        });
+        containerDir = `${container_runtime_1.CONTAINER_EXCHANGE_DIR}/actions/${hash}`;
+        container.actionDirs.set(actionDir, containerDir);
+    }
+    return containerDir;
+}
+/**
+ * The time limit for the running step: its (or its job's) timeout-minutes,
+ * or --container-timeout in container mode, whichever is shorter, with the
+ * message to fail it with.
+ */
+function effectiveTimeout(runtime, containerTimeoutMs, inContainer = !!runtime.container) {
+    const own = runtime.stepTimeout;
+    const flag = inContainer && containerTimeoutMs ? containerTimeoutMs : undefined;
+    if (own && (flag === undefined || own.ms <= flag))
+        return own;
+    if (flag !== undefined) {
+        return {
+            ms: flag,
+            message: `Timed out after ${flag}ms (--container-timeout)`
+        };
+    }
+    return { message: '' };
+}
+/**
+ * The label shown for a step, like GitHub: its `name` with `${{ }}`
+ * expressions resolved, else its `uses:` reference, else the first
+ * non-empty line of its `run:` script, else "step".
+ */
+function stepDisplayName(step, ctx) {
+    if (step.name)
+        return ctx ? (0, expression_1.substituteExpressions)(step.name, ctx) : step.name;
+    if (step.uses)
+        return step.uses;
+    if (step.run) {
+        const line = step.run
+            .split('\n')
+            .map((l) => l.trim())
+            .find(Boolean);
+        if (line)
+            return ctx ? (0, expression_1.substituteExpressions)(line, ctx) : line;
+    }
+    return 'step';
+}
+//# sourceMappingURL=job-runtime.js.map