@secureci/cli 0.0.0-stage → 0.1.0

package/dist/runner/actions.js

@@ -0,0 +1,495 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveActionInputs = resolveActionInputs;
+exports.warnUnsandboxedActions = warnUnsandboxedActions;
+exports.stepFileSystem = stepFileSystem;
+exports.runBuiltinAction = runBuiltinAction;
+exports.fetchActionOnce = fetchActionOnce;
+exports.runPreSteps = runPreSteps;
+exports.isLocalActionRef = isLocalActionRef;
+exports.resolveLocalAction = resolveLocalAction;
+exports.executeAction = executeAction;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const workflow_parser_1 = require("../parser/workflow-parser");
+const logger_1 = require("../utils/logger");
+const action_fetcher_1 = require("./action-fetcher");
+const shell_1 = require("./shell");
+const builtin_actions_1 = require("./builtin-actions");
+const expression_1 = require("./expression");
+const container_runtime_1 = require("./container-runtime");
+const job_runtime_1 = require("./job-runtime");
+const checkout_1 = require("./checkout");
+const steps_1 = require("./steps");
+const docker_action_1 = require("./docker-action");
+const node_action_1 = require("./node-action");
+const validator_1 = require("../parser/validator");
+/**
+ * Build an action's `inputs.*`: the step's `with:` values (resolved against
+ * the calling step's context), falling back to each declared input's
+ * `default` (which may itself contain expressions, e.g. `${{ github.token }}`).
+ */
+function resolveActionInputs(action, withValues, callerCtx) {
+    const inputs = {};
+    for (const [name, def] of Object.entries(action.inputs || {})) {
+        if (def?.default !== undefined) {
+            inputs[name] = (0, expression_1.substituteExpressions)(String(def.default), callerCtx);
+        }
+    }
+    return { ...inputs, ...(0, expression_1.substituteRecord)(withValues, callerCtx) };
+}
+/**
+ * Warn that a job's remote actions are about to run on the host, with the
+ * user's privileges (container mode off, or no runtime available). Local
+ * actions, `docker://` steps and a local checkout are left out.
+ */
+function warnUnsandboxedActions(steps, ctx, options) {
+    const remote = steps
+        .filter((step) => step.uses &&
+        !isLocalActionRef(step.uses) &&
+        !step.uses.startsWith('docker://') &&
+        !(0, builtin_actions_1.builtinActionFor)(step.uses) &&
+        !(options.localCheckout !== false &&
+            (0, checkout_1.isLocalCheckout)(step.uses, step.with, ctx)))
+        .map((step) => step.uses);
+    if (remote.length === 0)
+        return;
+    logger_1.logger.warn(`Running remote actions on the host without container isolation: ${[...new Set(remote)].join(', ')}. They run with your user's privileges; use a container runtime (--container-runtime docker|podman|containerd) to sandbox them.`);
+}
+/** The file system a step sees: the host, or the job container. */
+async function stepFileSystem(runtime) {
+    const container = runtime.container;
+    if (!container)
+        return (0, builtin_actions_1.hostFileSystem)(process.cwd());
+    if (container.home === undefined) {
+        const probe = await container.runtime.exec(container.id, {
+            command: 'printf %s "$HOME"'
+        });
+        container.home = (probe.success && probe.stdout.trim()) || '/root';
+    }
+    return (0, builtin_actions_1.containerFileSystem)({
+        workspace: container_runtime_1.CONTAINER_WORKDIR,
+        hostWorkspace: process.cwd(),
+        home: container.home,
+        copyFrom: (from, to) => container.runtime.copyFrom(container.id, from, to),
+        copyTo: (from, to) => container.runtime.copyTo(container.id, from, to),
+        mkdir: async (dir) => {
+            await container.runtime.exec(container.id, {
+                args: ['mkdir', '-p', dir]
+            });
+        }
+    });
+}
+/**
+ * Run actions/upload-artifact, download-artifact or cache locally (see
+ * builtin-actions.ts); actions/cache's save is queued as a post step.
+ */
+async function runBuiltinAction(kind, step, ctx, options, runtime, startTime) {
+    const inputs = (0, expression_1.substituteRecord)(step.with, ctx);
+    const runId = String(ctx.github.run_id ?? options.runId ?? 'local');
+    const repository = String(ctx.github.repository ?? '');
+    const fsys = await stepFileSystem(runtime);
+    try {
+        const result = kind === 'upload-artifact'
+            ? await (0, builtin_actions_1.uploadArtifact)(fsys, inputs, runId)
+            : kind === 'download-artifact'
+                ? await (0, builtin_actions_1.downloadArtifact)(fsys, inputs, runId)
+                : await (0, builtin_actions_1.runCacheAction)(kind, fsys, inputs, repository);
+        if (result.warning)
+            logger_1.logger.warn(result.warning);
+        if (result.output)
+            logger_1.logger.info(result.output);
+        if (!result.success)
+            logger_1.logger.error(result.error ?? 'failed');
+        const post = result.post;
+        if (post) {
+            const postStep = { name: `Post ${step.name || step.uses}` };
+            runtime.postSteps.push({
+                step: postStep,
+                condition: 'success()',
+                run: async () => {
+                    const postFs = await stepFileSystem(runtime);
+                    try {
+                        const saved = await post(postFs);
+                        if (saved.warning)
+                            logger_1.logger.warn(saved.warning);
+                        if (saved.output)
+                            logger_1.logger.info(saved.output);
+                        return {
+                            step: postStep,
+                            success: saved.success,
+                            output: saved.output,
+                            error: saved.error,
+                            duration: 0
+                        };
+                    }
+                    finally {
+                        postFs.cleanup();
+                    }
+                }
+            });
+        }
+        return {
+            step,
+            success: result.success,
+            output: result.output,
+            outputs: result.outputs,
+            error: result.error,
+            duration: Date.now() - startTime
+        };
+    }
+    finally {
+        fsys.cleanup();
+    }
+}
+/** fetchAction, once per remote action per job. */
+async function fetchActionOnce(uses, options, runtime) {
+    if (!runtime.actionPaths.has(uses)) {
+        runtime.actionPaths.set(uses, await (0, action_fetcher_1.fetchAction)(uses, { offline: options.offline }));
+    }
+    return runtime.actionPaths.get(uses) ?? null;
+}
+/**
+ * Run the `pre` scripts of the job's remote JavaScript actions at job
+ * start, before any step, as GitHub does (gated by `pre-if`, default
+ * `always()`). Their `main` later continues from the state they saved.
+ * Local actions usually come from the checkout, so their `pre` still runs
+ * right before their `main`. A failed `pre` fails the job.
+ */
+async function runPreSteps(steps, options, runtime, jobCtx, stepResults) {
+    for (const step of steps) {
+        if (!step.uses ||
+            isLocalActionRef(step.uses) ||
+            step.uses.startsWith('docker://') ||
+            (0, builtin_actions_1.builtinActionFor)(step.uses)) {
+            continue;
+        }
+        const envCtx = {
+            ...jobCtx,
+            env: { ...jobCtx.env, ...runtime.env }
+        };
+        const stepCtx = {
+            ...envCtx,
+            env: { ...envCtx.env, ...(0, expression_1.substituteRecord)(step.env, envCtx) }
+        };
+        if (options.localCheckout !== false &&
+            (0, checkout_1.isLocalCheckout)(step.uses, step.with, stepCtx)) {
+            continue;
+        }
+        // Unresolvable actions are reported when their step runs.
+        const actionPath = await fetchActionOnce(step.uses, options, runtime);
+        if (!actionPath)
+            continue;
+        let action;
+        try {
+            const parsed = (0, workflow_parser_1.parseFile)(actionPath);
+            if (parsed.type !== 'action')
+                continue;
+            action = parsed.file;
+        }
+        catch {
+            continue;
+        }
+        if (!/^node\d+$/.test(action.runs.using) || !action.runs.pre)
+            continue;
+        let runPre;
+        try {
+            runPre = (0, node_action_1.runPreIf)(action, step, stepCtx);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            logger_1.logger.error(message);
+            stepResults.push({
+                step: { name: `Pre ${step.name || step.uses}` },
+                success: false,
+                error: message,
+                duration: 0
+            });
+            jobCtx.jobFailed = true;
+            continue;
+        }
+        if (!runPre)
+            continue;
+        logger_1.logger.info(`Running: Pre ${step.name || step.uses}`);
+        const result = await (0, node_action_1.executeNodeAction)(action, actionPath, step, resolveActionInputs(action, step.with, stepCtx), stepCtx, options, runtime, Date.now(), 'pre');
+        stepResults.push(result);
+        if (!result.success) {
+            jobCtx.jobFailed = true;
+            logger_1.logger.error(`Step failed: Pre ${step.name || step.uses}`);
+        }
+    }
+}
+function isLocalActionRef(uses) {
+    return uses.startsWith('./') || uses.startsWith('../');
+}
+/**
+ * Resolve a local action (`uses: ./path/to/action`) relative to the
+ * workspace, like the runner does, to its action.yml / action.yaml.
+ */
+function resolveLocalAction(uses) {
+    const dir = path.resolve(process.cwd(), uses);
+    for (const name of ['action.yml', 'action.yaml']) {
+        const candidate = path.join(dir, name);
+        if (fs.existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+/**
+ * Execute an action step: local (`./`), remote (`owner/repo@ref`) or
+ * `docker://image`.
+ */
+async function executeAction(step, options, startTime, runtime, ctx) {
+    if (!step.uses) {
+        return {
+            step,
+            success: false,
+            error: 'No action specified',
+            duration: Date.now() - startTime
+        };
+    }
+    try {
+        const callerCtx = ctx ?? (0, expression_1.createContext)({}, {}, options.secrets);
+        // `uses: docker://image` runs the image directly, with `with.args` /
+        // `with.entrypoint` as its argv and entrypoint.
+        if (step.uses.startsWith('docker://')) {
+            const withValues = (0, expression_1.substituteRecord)(step.with, callerCtx);
+            const dockerAction = {
+                name: step.uses,
+                description: '',
+                runs: {
+                    using: 'docker',
+                    image: step.uses,
+                    entrypoint: withValues.entrypoint,
+                    args: withValues.args ? (0, shell_1.splitArgs)(withValues.args) : []
+                }
+            };
+            return await (0, docker_action_1.executeDockerAction)(dockerAction, path.join(process.cwd(), 'action.yml'), step, {}, callerCtx.env, options, runtime, startTime);
+        }
+        if (options.localCheckout !== false &&
+            (0, checkout_1.isLocalCheckout)(step.uses, step.with, callerCtx)) {
+            return (0, checkout_1.localCheckout)(step, callerCtx, runtime, startTime);
+        }
+        const builtin = (0, builtin_actions_1.builtinActionFor)(step.uses);
+        if (builtin) {
+            return await runBuiltinAction(builtin, step, callerCtx, options, runtime, startTime);
+        }
+        const actionPath = isLocalActionRef(step.uses)
+            ? resolveLocalAction(step.uses)
+            : await fetchActionOnce(step.uses, options, runtime);
+        if (!actionPath) {
+            const error = `Could not resolve action "${step.uses}"${isLocalActionRef(step.uses)
+                ? ` (no action.yml or action.yaml in ${path.resolve(process.cwd(), step.uses)})`
+                : ''}`;
+            logger_1.logger.error(error);
+            return {
+                step,
+                success: false,
+                error,
+                duration: Date.now() - startTime
+            };
+        }
+        // Parse the action file
+        const parsed = (0, workflow_parser_1.parseFile)(actionPath);
+        if (parsed.type !== 'action') {
+            logger_1.logger.error(`Invalid action file: ${actionPath}`);
+            return {
+                step,
+                success: false,
+                error: 'Invalid action file',
+                duration: Date.now() - startTime
+            };
+        }
+        const action = parsed.file;
+        // Resolve `with:` values against the calling step's context before they
+        // become the action's inputs (INPUT_* env vars / `inputs.*`).
+        const actionInputs = resolveActionInputs(action, step.with, callerCtx);
+        // Handle different action types
+        if (action.runs.using === 'composite') {
+            const invalid = (0, validator_1.actionExpressionErrors)(action);
+            if (invalid.length > 0) {
+                const error = `Invalid action file for ${step.uses}: ${invalid
+                    .map((e) => `${e.path}: ${e.message}`)
+                    .join('; ')}`;
+                logger_1.logger.error(error);
+                return {
+                    step,
+                    success: false,
+                    error,
+                    duration: Date.now() - startTime
+                };
+            }
+            // Execute composite action steps
+            logger_1.logger.info(`Executing composite action: ${action.name}`);
+            const compositeSteps = action.runs.steps || [];
+            const outputs = {};
+            // Composite steps see only the action's own inputs, plus the
+            // caller's env and github context - never the workflow's inputs.
+            // The action's files, as its steps see them (copied into the job
+            // container in container mode).
+            const actionDir = runtime.container
+                ? (0, job_runtime_1.actionDirInContainer)(runtime.container, path.dirname(actionPath))
+                : path.dirname(actionPath);
+            const callerActionEnv = runtime.actionEnv;
+            const parent = {
+                repository: callerActionEnv.GITHUB_ACTION_REPOSITORY ?? '',
+                ref: callerActionEnv.GITHUB_ACTION_REF ?? '',
+                path: actionDir
+            };
+            const actionCtx = {
+                ...(0, expression_1.createContext)({ ...callerCtx.env }, actionInputs, {}, { ...callerCtx.github, action_path: actionDir }),
+                secretsUnavailable: true,
+                vars: callerCtx.vars,
+                job: callerCtx.job,
+                runner: callerCtx.runner,
+                strategy: callerCtx.strategy
+            };
+            // `defaults.run` doesn't apply inside composite actions.
+            const callerDefaults = runtime.defaults;
+            runtime.defaults = {};
+            try {
+                for (const compositeStep of compositeSteps) {
+                    runtime.actionEnv = (0, job_runtime_1.stepActionEnv)(runtime, compositeStep, parent);
+                    const envCtx = {
+                        ...actionCtx,
+                        github: {
+                            ...actionCtx.github,
+                            action: runtime.actionEnv.GITHUB_ACTION
+                        },
+                        env: { ...actionCtx.env, ...runtime.env }
+                    };
+                    const stepCtx = {
+                        ...envCtx,
+                        env: {
+                            ...envCtx.env,
+                            ...(0, expression_1.substituteRecord)(compositeStep.env, envCtx)
+                        }
+                    };
+                    let runCompositeStep;
+                    try {
+                        runCompositeStep = (0, expression_1.evaluateCondition)(compositeStep.if, stepCtx);
+                    }
+                    catch (error) {
+                        const message = (0, expression_1.ifEvaluationError)(`step '${(0, job_runtime_1.stepDisplayName)(compositeStep, stepCtx)}' of ${step.uses}`, error);
+                        logger_1.logger.error(message);
+                        return {
+                            step,
+                            success: false,
+                            error: message,
+                            duration: Date.now() - startTime
+                        };
+                    }
+                    if (!runCompositeStep) {
+                        logger_1.logger.info(`Skipping composite step: ${(0, job_runtime_1.stepDisplayName)(compositeStep, stepCtx)} (condition not met)`);
+                        if (compositeStep.id) {
+                            actionCtx.steps[compositeStep.id] = {
+                                outcome: 'skipped',
+                                outputs: {}
+                            };
+                        }
+                        continue;
+                    }
+                    const stepOptions = {
+                        ...options,
+                        inputs: actionInputs
+                    };
+                    const stepResult = await (0, steps_1.executeStep)(compositeStep, stepOptions, runtime, stepCtx);
+                    if (compositeStep.id) {
+                        actionCtx.steps[compositeStep.id] = {
+                            outcome: stepResult.success ? 'success' : 'failure',
+                            outputs: stepResult.outputs || {}
+                        };
+                    }
+                    if (!stepResult.success) {
+                        actionCtx.jobFailed = true;
+                        return {
+                            step,
+                            success: false,
+                            error: `Composite action step failed: ${(0, job_runtime_1.stepDisplayName)(compositeStep, stepCtx)}`,
+                            duration: Date.now() - startTime
+                        };
+                    }
+                }
+            }
+            finally {
+                runtime.defaults = callerDefaults;
+                runtime.actionEnv = callerActionEnv;
+            }
+            // Resolve the action's declared outputs (e.g.
+            // `outputs.greeting.value: ${{ steps.greet.outputs.greeting }}`)
+            // against the accumulated step outcomes/outputs.
+            for (const [outputName, outputDef] of Object.entries(action.outputs || {})) {
+                const resolved = (0, expression_1.resolveExpressionValue)(outputDef.value, actionCtx);
+                if (resolved !== undefined) {
+                    outputs[outputName] = String(resolved);
+                }
+            }
+            return {
+                step,
+                success: true,
+                output: JSON.stringify(outputs),
+                outputs,
+                duration: Date.now() - startTime
+            };
+        }
+        else if (/^node\d+$/.test(action.runs.using)) {
+            return await (0, node_action_1.executeNodeAction)(action, actionPath, step, actionInputs, callerCtx, options, runtime, startTime);
+        }
+        else if (action.runs.using === 'docker') {
+            return await (0, docker_action_1.executeDockerAction)(action, actionPath, step, actionInputs, callerCtx.env, options, runtime, startTime);
+        }
+        else {
+            const error = `Unsupported action type "${action.runs.using}" in ${step.uses}`;
+            logger_1.logger.error(error);
+            return {
+                step,
+                success: false,
+                error,
+                duration: Date.now() - startTime
+            };
+        }
+    }
+    catch (error) {
+        logger_1.logger.error(`Action execution failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        return {
+            step,
+            success: false,
+            error: error instanceof Error ? error.message : 'Unknown error',
+            duration: Date.now() - startTime
+        };
+    }
+}
+//# sourceMappingURL=actions.js.map