@secureci/cli 0.0.0-stage → 0.1.0

package/dist/runner/executor.js

@@ -0,0 +1,554 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_RUNNER_IMAGES = exports.DEFAULT_CONTAINER_IMAGE = exports.topologicalJobOrder = exports.expandMatrix = exports.parseRepositoryFromRemote = void 0;
+exports.executeWorkflow = executeWorkflow;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const workflow_parser_1 = require("../parser/workflow-parser");
+const validator_1 = require("../parser/validator");
+const logger_1 = require("../utils/logger");
+const action_fetcher_1 = require("./action-fetcher");
+const repository_1 = require("../utils/repository");
+const expression_1 = require("./expression");
+const container_runtime_1 = require("./container-runtime");
+const github_context_1 = require("./github-context");
+const job_plan_1 = require("./job-plan");
+const job_runtime_1 = require("./job-runtime");
+const job_container_1 = require("./job-container");
+const steps_1 = require("./steps");
+const actions_1 = require("./actions");
+// Public API, kept here so `executor` stays the entry point.
+var github_context_2 = require("./github-context");
+Object.defineProperty(exports, "parseRepositoryFromRemote", { enumerable: true, get: function () { return github_context_2.parseRepositoryFromRemote; } });
+var job_plan_2 = require("./job-plan");
+Object.defineProperty(exports, "expandMatrix", { enumerable: true, get: function () { return job_plan_2.expandMatrix; } });
+Object.defineProperty(exports, "topologicalJobOrder", { enumerable: true, get: function () { return job_plan_2.topologicalJobOrder; } });
+var job_container_2 = require("./job-container");
+Object.defineProperty(exports, "DEFAULT_CONTAINER_IMAGE", { enumerable: true, get: function () { return job_container_2.DEFAULT_CONTAINER_IMAGE; } });
+Object.defineProperty(exports, "DEFAULT_RUNNER_IMAGES", { enumerable: true, get: function () { return job_container_2.DEFAULT_RUNNER_IMAGES; } });
+/**
+ * Execute a reusable workflow called via `jobs.<id>.uses:`: a local path
+ * (`./.github/workflows/x.yml`, relative to the repository root) or a
+ * remote `owner/repo/path.yml@ref`. `with:` and `secrets:` are resolved in
+ * the calling job's context; the called workflow sees only those secrets
+ * (all of them with `secrets: inherit`), and its `on.workflow_call.outputs`
+ * become the calling job's outputs.
+ */
+async function executeReusableWorkflowJob(jobId, job, callerPath, options, ctx) {
+    const startTime = Date.now();
+    const uses = job.uses;
+    const failed = (error) => {
+        logger_1.logger.error(error);
+        return {
+            job: jobId,
+            success: false,
+            steps: [],
+            duration: Date.now() - startTime
+        };
+    };
+    let resolvedPath;
+    if ((0, actions_1.isLocalActionRef)(uses)) {
+        const candidates = [
+            path.resolve((0, repository_1.repositoryRoot)(callerPath), uses),
+            path.resolve(path.dirname(callerPath), uses)
+        ];
+        resolvedPath = candidates.find((file) => fs.existsSync(file)) ?? null;
+        if (!resolvedPath) {
+            return failed(`Reusable workflow not found: ${candidates[0]}`);
+        }
+    }
+    else {
+        resolvedPath = await (0, action_fetcher_1.fetchRepoFile)(uses, { offline: options.offline });
+        if (!resolvedPath) {
+            return failed(`Could not fetch reusable workflow ${uses}`);
+        }
+    }
+    const inputs = (0, expression_1.substituteRecord)(job.with, ctx);
+    const secrets = job.secrets === 'inherit'
+        ? { ...(options.secrets || {}) }
+        : {
+            // GITHUB_TOKEN is always available to called workflows.
+            ...(options.secrets?.GITHUB_TOKEN !== undefined
+                ? { GITHUB_TOKEN: options.secrets.GITHUB_TOKEN }
+                : {}),
+            ...(0, expression_1.substituteRecord)(job.secrets, ctx)
+        };
+    logger_1.logger.step(`Executing reusable workflow: ${uses} (job: ${jobId})`);
+    const subResult = await executeWorkflow(resolvedPath, {
+        ...options,
+        inputs,
+        secrets,
+        job: undefined
+    });
+    return {
+        job: jobId,
+        success: subResult.success,
+        steps: subResult.jobs.flatMap((j) => j.steps),
+        outputs: subResult.outputs ?? {},
+        duration: Date.now() - startTime
+    };
+}
+/**
+ * Execute a workflow or action file
+ */
+async function executeWorkflow(filePath, options = {}) {
+    const startTime = Date.now();
+    logger_1.logger.registerSecrets(options.secrets);
+    // One run id for every job and called workflow of this run.
+    options = {
+        ...options,
+        runId: options.runId || process.env.GITHUB_RUN_ID || String(Date.now())
+    };
+    // Steps never fall back to running on the host: without the requested
+    // container runtime, stop before anything runs. The host is opt-in
+    // (--container-runtime host).
+    const preference = options.containerRuntime ?? 'host';
+    if (preference !== 'host' && !(await (0, container_runtime_1.resolveContainerRuntime)(preference))) {
+        logger_1.logger.error((0, job_container_1.noRuntimeMessage)(preference));
+        return { success: false, jobs: [], duration: Date.now() - startTime };
+    }
+    const runDir = (0, job_runtime_1.createRunDir)();
+    try {
+        const parsed = (0, workflow_parser_1.parseFile)(filePath);
+        if (parsed.type === 'workflow') {
+            // Like GitHub, refuse a workflow with an invalid if: before any job.
+            const invalid = (0, validator_1.workflowExpressionErrors)(parsed.file);
+            if (invalid.length > 0) {
+                logger_1.logger.error(`Invalid workflow file: ${filePath}`);
+                for (const error of invalid) {
+                    logger_1.logger.error(`  ${error.path}: ${error.message}`);
+                }
+                return { success: false, jobs: [], duration: Date.now() - startTime };
+            }
+            logger_1.logger.info(`Executing workflow: ${parsed.file.name}`);
+            options = {
+                ...options,
+                inputs: {
+                    ...(0, github_context_1.declaredInputDefaults)(parsed.file.on),
+                    ...(options.inputs ?? {})
+                }
+            };
+            const event = (0, github_context_1.loadEvent)(options, options.inputs ?? {}, parsed.file.on);
+            const inputs = (0, github_context_1.typedInputs)(parsed.file.on, options.inputs ?? {});
+            fs.writeFileSync(path.join(runDir, 'event.json'), JSON.stringify(event.payload));
+            const jobs = [];
+            const jobResults = new Map();
+            const jobOrder = (0, job_plan_1.topologicalJobOrder)(parsed.file.jobs);
+            for (const jobId of jobOrder) {
+                const job = parsed.file.jobs[jobId];
+                // Skip if specific job requested and this isn't it
+                if (options.job && jobId !== options.job) {
+                    continue;
+                }
+                const github = (0, github_context_1.buildGithubContext)(parsed.file.name, jobId, process.cwd(), event, options.secrets?.GITHUB_TOKEN, options.runId);
+                // `needs` results feed the job's `if:` (implicitly `success()`,
+                // which requires every dependency to have succeeded). With --job,
+                // dependencies aren't run and count as successful.
+                const needsIds = job.needs
+                    ? Array.isArray(job.needs)
+                        ? job.needs
+                        : [job.needs]
+                    : [];
+                const needs = {};
+                for (const dep of needsIds) {
+                    needs[dep] = jobResults.get(dep) ?? {
+                        result: 'success',
+                        outputs: {}
+                    };
+                }
+                const vars = options.vars ?? {};
+                const jobIfCtx = {
+                    ...(0, expression_1.createContext)({}, inputs, options.secrets, github),
+                    needs,
+                    vars,
+                    dependencies: {
+                        allSucceeded: Object.values(needs).every((n) => n.result === 'success'),
+                        anyFailed: Object.values(needs).some((n) => n.result === 'failure')
+                    }
+                };
+                let runJob;
+                try {
+                    runJob = (0, expression_1.evaluateCondition)((0, expression_1.withImplicitSuccess)(job.if), jobIfCtx);
+                }
+                catch (error) {
+                    // An if: that can't be evaluated fails the job, as on GitHub.
+                    logger_1.logger.error((0, expression_1.ifEvaluationError)(`job '${jobId}'`, error));
+                    jobs.push({ job: jobId, success: false, steps: [], duration: 0 });
+                    jobResults.set(jobId, { result: 'failure', outputs: {} });
+                    continue;
+                }
+                if (!runJob) {
+                    const notOk = needsIds.find((dep) => needs[dep].result !== 'success');
+                    logger_1.logger.info(notOk
+                        ? `Skipping job: ${jobId} (dependency "${notOk}" ${needs[notOk].result === 'skipped' ? 'was skipped' : 'did not succeed'})`
+                        : `Skipping job: ${jobId} (condition not met)`);
+                    jobResults.set(jobId, { result: 'skipped', outputs: {} });
+                    continue;
+                }
+                // Handle reusable workflow calls (once per matrix combination)
+                if (job.uses) {
+                    const combinations = (0, job_plan_1.expandMatrix)(job.strategy?.matrix, jobIfCtx);
+                    const callOutputs = {};
+                    let callFailed = false;
+                    for (const matrixValues of combinations) {
+                        if (callFailed && job.strategy?.['fail-fast'] !== false)
+                            break;
+                        const label = combinations.length > 1
+                            ? `${jobId} (${(0, job_plan_1.matrixLabel)(matrixValues)})`
+                            : jobId;
+                        const reusableResult = await executeReusableWorkflowJob(label, job, filePath, options, { ...jobIfCtx, matrix: matrixValues });
+                        jobs.push(reusableResult);
+                        Object.assign(callOutputs, reusableResult.outputs);
+                        if (!reusableResult.success)
+                            callFailed = true;
+                    }
+                    jobResults.set(jobId, {
+                        result: callFailed ? 'failure' : 'success',
+                        outputs: callOutputs
+                    });
+                    if (!callFailed) {
+                        logger_1.logger.success(`Job ${jobId} completed successfully`);
+                    }
+                    continue;
+                }
+                const matrixCombinations = (0, job_plan_1.expandMatrix)(job.strategy?.matrix, jobIfCtx);
+                const failFast = job.strategy?.['fail-fast'] !== false;
+                let matrixFailed = false;
+                const jobOutputs = {};
+                for (const [jobIndex, matrixValues] of matrixCombinations.entries()) {
+                    if (matrixFailed && failFast) {
+                        logger_1.logger.info(`Skipping remaining matrix jobs for ${jobId} (fail-fast)`);
+                        break;
+                    }
+                    const matrixSuffix = matrixCombinations.length > 1
+                        ? ` (${(0, job_plan_1.matrixLabel)(matrixValues)})`
+                        : '';
+                    const jobLabel = `${jobId}${matrixSuffix}`;
+                    const runtime = (0, job_runtime_1.createJobRuntime)(github, runDir, {
+                        shell: job.defaults?.run?.shell ?? parsed.file.defaults?.run?.shell,
+                        workingDirectory: job.defaults?.run?.['working-directory'] ??
+                            parsed.file.defaults?.run?.['working-directory']
+                    });
+                    // Workflow-level env can't reference `env` itself; job-level env
+                    // sees the workflow env plus matrix (matching GitHub's contexts).
+                    const workflowEnv = {
+                        ...options.env,
+                        ...(0, expression_1.substituteRecord)(parsed.file.env, {
+                            ...(0, expression_1.createContext)({ ...options.env }, inputs, options.secrets, github),
+                            vars
+                        })
+                    };
+                    const jobEnv = (0, expression_1.substituteRecord)(job.env, {
+                        ...(0, expression_1.createContext)(workflowEnv, inputs, options.secrets, github, matrixValues),
+                        needs,
+                        vars
+                    });
+                    const jobCtx = {
+                        ...(0, expression_1.createContext)({ ...workflowEnv, ...jobEnv }, inputs, options.secrets, github, matrixValues),
+                        needs,
+                        vars,
+                        job: { status: 'success' },
+                        runner: (0, job_runtime_1.runnerContext)(runtime),
+                        strategy: {
+                            'fail-fast': failFast,
+                            'job-index': jobIndex,
+                            'job-total': matrixCombinations.length,
+                            'max-parallel': job.strategy?.['max-parallel'] ?? matrixCombinations.length
+                        }
+                    };
+                    logger_1.logger.step(`Executing job: ${jobLabel}`);
+                    const jobStartTime = Date.now();
+                    const jobTimeoutMinutes = (0, job_plan_1.numberSetting)(job['timeout-minutes'], jobCtx);
+                    const jobDeadline = jobTimeoutMinutes
+                        ? jobStartTime + jobTimeoutMinutes * 60000
+                        : undefined;
+                    const jobTimeoutMessage = `The job running on runner secureci has exceeded the maximum execution time of ${jobTimeoutMinutes} minutes.`;
+                    const stepResults = [];
+                    if (!(await (0, job_container_1.startJobServices)(job, jobCtx, options, runtime)) ||
+                        !(await (0, job_container_1.startJobContainer)(job, jobCtx, options, runtime, runDir))) {
+                        await (0, job_container_1.stopJobContainer)(runtime);
+                        jobs.push({
+                            job: jobLabel,
+                            success: false,
+                            steps: [],
+                            duration: Date.now() - jobStartTime
+                        });
+                        matrixFailed = true;
+                        continue;
+                    }
+                    if (!runtime.container) {
+                        (0, actions_1.warnUnsandboxedActions)(job.steps ?? [], jobCtx, options);
+                    }
+                    try {
+                        await (0, actions_1.runPreSteps)(job.steps ?? [], options, runtime, jobCtx, stepResults);
+                        // Execute each step
+                        for (const step of job.steps || []) {
+                            jobCtx.job = {
+                                ...jobCtx.job,
+                                status: jobCtx.jobFailed ? 'failure' : 'success'
+                            };
+                            // `$GITHUB_ENV` additions from earlier steps sit between the
+                            // job env and this step's own `env:`.
+                            const envCtx = {
+                                ...jobCtx,
+                                env: { ...jobCtx.env, ...runtime.env }
+                            };
+                            runtime.actionEnv = (0, job_runtime_1.stepActionEnv)(runtime, step);
+                            const stepCtx = {
+                                ...envCtx,
+                                github: {
+                                    ...envCtx.github,
+                                    action: runtime.actionEnv.GITHUB_ACTION
+                                },
+                                env: { ...envCtx.env, ...(0, expression_1.substituteRecord)(step.env, envCtx) }
+                            };
+                            // After a failure, only steps whose `if:` uses a status
+                            // function (always(), failure(), ...) still run.
+                            let runStep;
+                            try {
+                                runStep = (0, expression_1.evaluateCondition)((0, expression_1.withImplicitSuccess)(step.if), stepCtx);
+                            }
+                            catch (error) {
+                                // An if: that can't be evaluated fails the step.
+                                const message = (0, expression_1.ifEvaluationError)(`step '${(0, job_runtime_1.stepDisplayName)(step, stepCtx)}'`, error);
+                                logger_1.logger.error(message);
+                                stepResults.push({
+                                    step,
+                                    success: false,
+                                    error: message,
+                                    duration: 0
+                                });
+                                if (step.id) {
+                                    jobCtx.steps[step.id] = {
+                                        outcome: 'failure',
+                                        conclusion: 'failure',
+                                        outputs: {}
+                                    };
+                                }
+                                jobCtx.jobFailed = true;
+                                continue;
+                            }
+                            if (!runStep) {
+                                logger_1.logger.info(`Skipping step: ${(0, job_runtime_1.stepDisplayName)(step, stepCtx)} (condition not met)`);
+                                const skippedResult = {
+                                    step,
+                                    success: true,
+                                    outcome: 'skipped',
+                                    output: 'Skipped: condition not met',
+                                    duration: 0
+                                };
+                                stepResults.push(skippedResult);
+                                if (step.id) {
+                                    jobCtx.steps[step.id] = {
+                                        outcome: 'skipped',
+                                        conclusion: 'skipped',
+                                        outputs: {}
+                                    };
+                                }
+                                continue;
+                            }
+                            // timeout-minutes: the step's own, or what's left of the job's.
+                            const stepMinutes = (0, job_plan_1.numberSetting)(step['timeout-minutes'], stepCtx);
+                            const jobLeft = jobDeadline !== undefined
+                                ? Math.max(jobDeadline - Date.now(), 1)
+                                : undefined;
+                            const stepMs = stepMinutes ? stepMinutes * 60000 : undefined;
+                            runtime.stepTimeout =
+                                jobLeft !== undefined &&
+                                    (stepMs === undefined || jobLeft < stepMs)
+                                    ? { ms: jobLeft, message: jobTimeoutMessage }
+                                    : stepMs !== undefined
+                                        ? {
+                                            ms: stepMs,
+                                            message: `The action '${(0, job_runtime_1.stepDisplayName)(step, stepCtx)}' has timed out after ${stepMinutes} minutes.`
+                                        }
+                                        : undefined;
+                            const stepResult = await (0, steps_1.executeStep)(step, options, runtime, stepCtx);
+                            runtime.stepTimeout = undefined;
+                            stepResults.push(stepResult);
+                            if (jobDeadline !== undefined && Date.now() >= jobDeadline) {
+                                // The job is cancelled: no further steps run.
+                                if (stepResult.success) {
+                                    stepResult.success = false;
+                                    stepResult.error = jobTimeoutMessage;
+                                }
+                                logger_1.logger.error(jobTimeoutMessage);
+                                jobCtx.jobFailed = true;
+                                break;
+                            }
+                            const outcome = stepResult.success ? 'success' : 'failure';
+                            if (step.id) {
+                                jobCtx.steps[step.id] = {
+                                    outcome,
+                                    // continue-on-error turns a failure into a successful
+                                    // conclusion, which is what success()/failure() see.
+                                    conclusion: step['continue-on-error'] ? 'success' : outcome,
+                                    outputs: stepResult.outputs || {}
+                                };
+                            }
+                            if (!stepResult.success && !step['continue-on-error']) {
+                                jobCtx.jobFailed = true;
+                                logger_1.logger.error(`Step failed: ${(0, job_runtime_1.stepDisplayName)(step, stepCtx)}`);
+                            }
+                        }
+                        await (0, job_runtime_1.runPostSteps)(runtime, jobCtx, stepResults);
+                        if (runtime.summary.trim()) {
+                            logger_1.logger.info(`Job summary (${jobLabel}):\n${runtime.summary.trim()}`);
+                        }
+                        jobCtx.job = {
+                            ...jobCtx.job,
+                            status: jobCtx.jobFailed ? 'failure' : 'success'
+                        };
+                        Object.assign(jobOutputs, (0, expression_1.substituteRecord)(job.outputs, {
+                            ...jobCtx,
+                            env: { ...jobCtx.env, ...runtime.env }
+                        }));
+                    }
+                    finally {
+                        await (0, job_container_1.stopJobContainer)(runtime);
+                    }
+                    const jobSuccess = stepResults.every((s) => s.success || s.step['continue-on-error']);
+                    // Job-level continue-on-error (often `${{ matrix.experimental }}`)
+                    // lets this combination fail without failing the job or run.
+                    const allowedFailure = !jobSuccess && (0, job_plan_1.isTruthySetting)(job['continue-on-error'], jobCtx);
+                    jobs.push({
+                        job: jobLabel,
+                        success: jobSuccess,
+                        ...(allowedFailure ? { continueOnError: true } : {}),
+                        ...(runtime.summary ? { summary: runtime.summary } : {}),
+                        steps: stepResults,
+                        outputs: { ...jobOutputs },
+                        duration: Date.now() - jobStartTime
+                    });
+                    if (!jobSuccess && !allowedFailure) {
+                        matrixFailed = true;
+                    }
+                }
+                const jobSuccess = !matrixFailed;
+                jobResults.set(jobId, {
+                    result: jobSuccess ? 'success' : 'failure',
+                    outputs: jobOutputs
+                });
+                if (jobSuccess) {
+                    logger_1.logger.success(`Job ${jobId} completed successfully`);
+                }
+            }
+            const callOutputs = (0, github_context_1.workflowCallOutputs)(parsed.file.on);
+            return {
+                success: jobs.every((j) => j.success || j.continueOnError),
+                jobs,
+                duration: Date.now() - startTime,
+                ...(callOutputs
+                    ? {
+                        outputs: (0, expression_1.substituteRecord)(callOutputs, {
+                            ...(0, expression_1.createContext)({}, inputs, options.secrets),
+                            vars: options.vars ?? {},
+                            jobs: Object.fromEntries(jobResults)
+                        })
+                    }
+                    : {})
+            };
+        }
+        else {
+            // Handle action execution
+            logger_1.logger.info(`Executing action: ${parsed.file.name}`);
+            if (parsed.file.runs.using === 'composite' && parsed.file.runs.steps) {
+                const stepResults = [];
+                const github = (0, github_context_1.buildGithubContext)(parsed.file.name, 'action', process.cwd(), undefined, options.secrets?.GITHUB_TOKEN, options.runId);
+                const runtime = (0, job_runtime_1.createJobRuntime)(github, runDir);
+                const actionCtx = (0, expression_1.createContext)({}, options.inputs, options.secrets, github);
+                if (!(await (0, job_container_1.startJobContainer)(undefined, actionCtx, options, runtime, runDir))) {
+                    return { success: false, jobs: [], duration: Date.now() - startTime };
+                }
+                try {
+                    for (const step of parsed.file.runs.steps) {
+                        const stepResult = await (0, steps_1.executeStep)(step, options, runtime);
+                        stepResults.push(stepResult);
+                        if (!stepResult.success) {
+                            return {
+                                success: false,
+                                jobs: [
+                                    {
+                                        job: 'action',
+                                        success: false,
+                                        steps: stepResults,
+                                        duration: Date.now() - startTime
+                                    }
+                                ],
+                                duration: Date.now() - startTime
+                            };
+                        }
+                    }
+                    return {
+                        success: true,
+                        jobs: [
+                            {
+                                job: 'action',
+                                success: true,
+                                steps: stepResults,
+                                duration: Date.now() - startTime
+                            }
+                        ],
+                        duration: Date.now() - startTime
+                    };
+                }
+                finally {
+                    await (0, job_container_1.stopJobContainer)(runtime);
+                }
+            }
+            else {
+                logger_1.logger.error(`Only composite actions can be run directly; call this ${parsed.file.runs.using} action from a workflow step instead.`);
+                return {
+                    success: false,
+                    jobs: [],
+                    duration: Date.now() - startTime
+                };
+            }
+        }
+    }
+    catch (error) {
+        logger_1.logger.error(`Execution failed: ${error instanceof Error ? error.message : 'Unknown error'}`);
+        return {
+            success: false,
+            jobs: [],
+            duration: Date.now() - startTime
+        };
+    }
+    finally {
+        fs.rmSync(runDir, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=executor.js.map