@secureci/cli 0.0.0-stage → 0.1.1

package/dist/runner/expression.js

@@ -0,0 +1,676 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createContext = createContext;
+exports.resolveExpressionValue = resolveExpressionValue;
+exports.substituteExpressions = substituteExpressions;
+exports.substituteRecord = substituteRecord;
+exports.withImplicitSuccess = withImplicitSuccess;
+exports.evaluateCondition = evaluateCondition;
+exports.ifEvaluationError = ifEvaluationError;
+exports.validateExpression = validateExpression;
+const logger_1 = require("../utils/logger");
+const hash_files_1 = require("./hash-files");
+function createContext(env = {}, inputs = {}, secrets = {}, github = {}, matrix = {}) {
+    return {
+        env,
+        inputs,
+        secrets,
+        steps: {},
+        github,
+        matrix,
+        needs: {},
+        job: {},
+        runner: {},
+        vars: {},
+        strategy: {},
+        jobFailed: false
+    };
+}
+const OPERATORS = ['==', '!=', '<=', '>=', '&&', '||', '<', '>', '!'];
+function tokenize(input) {
+    const tokens = [];
+    let i = 0;
+    while (i < input.length) {
+        const ch = input[i];
+        if (/\s/.test(ch)) {
+            i++;
+            continue;
+        }
+        const single = {
+            '(': { type: 'lparen' },
+            ')': { type: 'rparen' },
+            '[': { type: 'lbracket' },
+            ']': { type: 'rbracket' },
+            ',': { type: 'comma' },
+            '*': { type: 'star' },
+            '.': { type: 'dot' }
+        };
+        if (single[ch] && !(ch === '.' && /[0-9]/.test(input[i + 1] ?? ''))) {
+            tokens.push(single[ch]);
+            i++;
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            // GitHub strings are single-quoted, with '' as an escaped quote.
+            const quote = ch;
+            let j = i + 1;
+            let value = '';
+            while (j < input.length) {
+                if (input[j] === quote) {
+                    if (input[j + 1] === quote) {
+                        value += quote;
+                        j += 2;
+                        continue;
+                    }
+                    break;
+                }
+                value += input[j];
+                j++;
+            }
+            if (j >= input.length) {
+                throw new Error('Unterminated string literal');
+            }
+            tokens.push({ type: 'string', value });
+            i = j + 1;
+            continue;
+        }
+        const op = OPERATORS.find((candidate) => input.startsWith(candidate, i));
+        if (op) {
+            tokens.push({ type: 'op', value: op });
+            i += op.length;
+            continue;
+        }
+        if (/[0-9.]/.test(ch) || (ch === '-' && /[0-9.]/.test(input[i + 1]))) {
+            const match = input
+                .slice(i)
+                .match(/^-?(?:0x[0-9a-fA-F]+|[0-9]*\.?[0-9]+(?:e[+-]?[0-9]+)?)/);
+            if (!match)
+                throw new Error(`Invalid number at position ${i}`);
+            tokens.push({ type: 'number', value: Number(match[0]) });
+            i += match[0].length;
+            continue;
+        }
+        if (/[A-Za-z_]/.test(ch)) {
+            let j = i;
+            while (j < input.length && /[A-Za-z0-9_-]/.test(input[j]))
+                j++;
+            tokens.push({ type: 'ident', value: input.slice(i, j) });
+            i = j;
+            continue;
+        }
+        throw new Error(`Unexpected character '${ch}' at position ${i}`);
+    }
+    tokens.push({ type: 'eof' });
+    return tokens;
+}
+/** GitHub truthiness: false, 0, -0, '', null and NaN are falsy. */
+function toBoolean(value) {
+    if (value === undefined || value === null)
+        return false;
+    if (typeof value === 'boolean')
+        return value;
+    if (typeof value === 'number')
+        return value !== 0 && !Number.isNaN(value);
+    if (typeof value === 'string')
+        return value !== '';
+    return true;
+}
+/** GitHub's number coercion for mixed-type comparisons. */
+function toNumber(value) {
+    if (value === undefined || value === null)
+        return 0;
+    if (typeof value === 'boolean')
+        return value ? 1 : 0;
+    if (typeof value === 'number')
+        return value;
+    if (typeof value === 'string') {
+        const trimmed = value.trim();
+        return trimmed === '' ? 0 : Number(trimmed);
+    }
+    return NaN;
+}
+function isPrimitive(value) {
+    return value === null || value === undefined || typeof value !== 'object';
+}
+function looseEquals(a, b) {
+    if (typeof a === 'string' && typeof b === 'string') {
+        return a.toLowerCase() === b.toLowerCase();
+    }
+    if (!isPrimitive(a) || !isPrimitive(b))
+        return a === b;
+    if (typeof a === typeof b && typeof a !== 'string')
+        return a === b;
+    return toNumber(a) === toNumber(b);
+}
+function compare(a, b) {
+    if (typeof a === 'string' && typeof b === 'string') {
+        const x = a.toLowerCase();
+        const y = b.toLowerCase();
+        return x < y ? -1 : x > y ? 1 : 0;
+    }
+    const x = toNumber(a);
+    const y = toNumber(b);
+    if (Number.isNaN(x) || Number.isNaN(y))
+        return NaN;
+    return x < y ? -1 : x > y ? 1 : 0;
+}
+/** How a value is rendered when substituted into text. */
+function toText(value) {
+    if (value === undefined || value === null)
+        return '';
+    if (Array.isArray(value))
+        return 'Array';
+    if (typeof value === 'object')
+        return 'Object';
+    return String(value);
+}
+/** Wraps the result of a `*` filter so further access maps over it. */
+class FilteredArray {
+    constructor(items) {
+        this.items = items;
+    }
+}
+function unwrap(value) {
+    return value instanceof FilteredArray ? value.items : value;
+}
+function member(target, key) {
+    if (target instanceof FilteredArray) {
+        return new FilteredArray(target.items.flatMap((item) => {
+            const v = member(item, key);
+            return v === undefined ? [] : [unwrap(v)];
+        }));
+    }
+    if (target === null || target === undefined)
+        return undefined;
+    if (Array.isArray(target)) {
+        return typeof key === 'number' ? target[key] : undefined;
+    }
+    if (typeof target === 'object') {
+        const record = target;
+        if (Object.prototype.hasOwnProperty.call(record, key)) {
+            return record[key];
+        }
+        // Property names are case-insensitive in GitHub expressions.
+        const match = Object.keys(record).find((k) => k.toLowerCase() === String(key).toLowerCase());
+        return match === undefined ? undefined : record[match];
+    }
+    return undefined;
+}
+function star(target) {
+    const source = unwrap(target);
+    if (Array.isArray(source))
+        return new FilteredArray([...source]);
+    if (source && typeof source === 'object') {
+        return new FilteredArray(Object.values(source));
+    }
+    return new FilteredArray([]);
+}
+function stepsContext(ctx) {
+    const steps = {};
+    for (const [id, info] of Object.entries(ctx.steps)) {
+        steps[id] = {
+            outcome: info.outcome,
+            conclusion: info.conclusion ?? info.outcome,
+            outputs: info.outputs
+        };
+    }
+    return steps;
+}
+function rootContext(name, ctx) {
+    switch (name) {
+        case 'env':
+            return ctx.env;
+        case 'inputs':
+            return ctx.inputs;
+        case 'secrets':
+            if (ctx.secretsUnavailable) {
+                throw new Error("Unrecognized named-value: 'secrets' (composite actions get secrets as inputs)");
+            }
+            return ctx.secrets;
+        case 'steps':
+            return stepsContext(ctx);
+        case 'github':
+            return ctx.github;
+        case 'matrix':
+            return ctx.matrix;
+        case 'needs':
+            return ctx.needs;
+        case 'job':
+            return ctx.job;
+        case 'runner':
+            return ctx.runner;
+        case 'vars':
+            return ctx.vars;
+        case 'strategy':
+            return ctx.strategy;
+        case 'jobs':
+            if (ctx.jobs)
+                return ctx.jobs;
+            throw new Error(`Unrecognized named-value: 'jobs'`);
+        default:
+            throw new Error(`Unrecognized named-value: '${name}'`);
+    }
+}
+function formatString(template, args) {
+    return template.replace(/\{\{|\}\}|\{(\d+)\}/g, (match, index) => {
+        if (match === '{{')
+            return '{';
+        if (match === '}}')
+            return '}';
+        const i = Number(index);
+        if (i >= args.length) {
+            throw new Error(`format(): no argument for {${i}}`);
+        }
+        return toText(args[i]);
+    });
+}
+/** Functions and their [min, max] number of arguments. */
+const FUNCTIONS = {
+    success: [0, 0],
+    failure: [0, 0],
+    always: [0, 0],
+    cancelled: [0, 0],
+    contains: [2, 2],
+    startswith: [2, 2],
+    endswith: [2, 2],
+    format: [1, Infinity],
+    join: [1, 2],
+    tojson: [1, 1],
+    fromjson: [1, 1],
+    hashfiles: [1, Infinity]
+};
+/** Check a function name and its argument count, as GitHub does. */
+function checkCall(name, argCount, allowed) {
+    const arity = FUNCTIONS[name.toLowerCase()];
+    if (!arity || (allowed && !allowed.has(name.toLowerCase()))) {
+        throw new Error(`Unrecognized function: '${name}'`);
+    }
+    if (argCount < arity[0]) {
+        throw new Error(`Too few parameters supplied: '${name}'`);
+    }
+    if (argCount > arity[1]) {
+        throw new Error(`Too many parameters supplied: '${name}'`);
+    }
+}
+function callFunction(name, rawArgs, ctx) {
+    checkCall(name, rawArgs.length);
+    const args = rawArgs.map(unwrap);
+    switch (name.toLowerCase()) {
+        case 'success':
+            return !ctx.jobFailed && (ctx.dependencies?.allSucceeded ?? true);
+        case 'failure':
+            return ctx.jobFailed || (ctx.dependencies?.anyFailed ?? false);
+        case 'always':
+            return true;
+        case 'cancelled':
+            return false;
+        case 'contains': {
+            const [search, item] = args;
+            if (Array.isArray(search)) {
+                return search.some((element) => looseEquals(element, item));
+            }
+            return toText(search).toLowerCase().includes(toText(item).toLowerCase());
+        }
+        case 'startswith':
+            return toText(args[0])
+                .toLowerCase()
+                .startsWith(toText(args[1]).toLowerCase());
+        case 'endswith':
+            return toText(args[0])
+                .toLowerCase()
+                .endsWith(toText(args[1]).toLowerCase());
+        case 'format':
+            return formatString(toText(args[0]), args.slice(1));
+        case 'join': {
+            const separator = args.length > 1 ? toText(args[1]) : ',';
+            return Array.isArray(args[0])
+                ? args[0].map(toText).join(separator)
+                : toText(args[0]);
+        }
+        case 'tojson':
+            return JSON.stringify(args[0] ?? null, null, 2);
+        case 'fromjson':
+            return JSON.parse(toText(args[0]));
+        case 'hashfiles': {
+            const workspace = typeof ctx.github.workspace === 'string' && ctx.github.workspace
+                ? ctx.github.workspace
+                : process.cwd();
+            return (0, hash_files_1.hashFiles)(workspace, args.map(toText));
+        }
+        default:
+            throw new Error(`Unrecognized function: '${name}'`);
+    }
+}
+class Parser {
+    /** With a scope, only check names and syntax; nothing is evaluated. */
+    constructor(tokens, ctx, scope) {
+        this.tokens = tokens;
+        this.ctx = ctx;
+        this.scope = scope;
+        this.pos = 0;
+    }
+    peek() {
+        return this.tokens[this.pos];
+    }
+    next() {
+        return this.tokens[this.pos++];
+    }
+    expect(type) {
+        if (this.peek().type !== type) {
+            throw new Error(`Expected ${type} but got ${this.peek().type}`);
+        }
+        this.next();
+    }
+    isOp(...values) {
+        const tok = this.peek();
+        return tok.type === 'op' && values.includes(tok.value);
+    }
+    parse() {
+        const value = this.parseOr();
+        if (this.peek().type !== 'eof') {
+            throw new Error(`Unexpected token: ${this.peek().type}`);
+        }
+        return unwrap(value);
+    }
+    // `||` / `&&` return the deciding operand, like GitHub (and JavaScript).
+    parseOr() {
+        let left = this.parseAnd();
+        while (this.isOp('||')) {
+            this.next();
+            const right = this.parseAnd();
+            left = toBoolean(unwrap(left)) ? left : right;
+        }
+        return left;
+    }
+    parseAnd() {
+        let left = this.parseEquality();
+        while (this.isOp('&&')) {
+            this.next();
+            const right = this.parseEquality();
+            left = toBoolean(unwrap(left)) ? right : left;
+        }
+        return left;
+    }
+    parseEquality() {
+        let left = this.parseComparison();
+        while (this.isOp('==', '!=')) {
+            const op = this.next().value;
+            const right = this.parseComparison();
+            const eq = looseEquals(unwrap(left), unwrap(right));
+            left = op === '==' ? eq : !eq;
+        }
+        return left;
+    }
+    parseComparison() {
+        let left = this.parseUnary();
+        while (this.isOp('<', '<=', '>', '>=')) {
+            const op = this.next().value;
+            const right = this.parseUnary();
+            const c = compare(unwrap(left), unwrap(right));
+            left =
+                !Number.isNaN(c) &&
+                    (op === '<'
+                        ? c < 0
+                        : op === '<='
+                            ? c <= 0
+                            : op === '>'
+                                ? c > 0
+                                : c >= 0);
+        }
+        return left;
+    }
+    parseUnary() {
+        if (this.isOp('!')) {
+            this.next();
+            return !toBoolean(unwrap(this.parseUnary()));
+        }
+        return this.parsePostfix(this.parsePrimary());
+    }
+    parsePostfix(value) {
+        for (;;) {
+            const tok = this.peek();
+            if (tok.type === 'dot') {
+                this.next();
+                const part = this.next();
+                if (part.type === 'star') {
+                    value = star(value);
+                }
+                else if (part.type === 'ident') {
+                    value = member(value, part.value);
+                }
+                else {
+                    throw new Error('Expected property name after .');
+                }
+            }
+            else if (tok.type === 'lbracket') {
+                this.next();
+                if (this.peek().type === 'star') {
+                    this.next();
+                    value = star(value);
+                }
+                else {
+                    const key = unwrap(this.parseOr());
+                    value = member(value, typeof key === 'number' ? key : toText(key));
+                }
+                this.expect('rbracket');
+            }
+            else {
+                return value;
+            }
+        }
+    }
+    parsePrimary() {
+        const tok = this.next();
+        switch (tok.type) {
+            case 'lparen': {
+                const value = this.parseOr();
+                this.expect('rparen');
+                return value;
+            }
+            case 'string':
+            case 'number':
+                return tok.value;
+            case 'ident': {
+                const lower = tok.value.toLowerCase();
+                if (lower === 'true')
+                    return true;
+                if (lower === 'false')
+                    return false;
+                if (lower === 'null')
+                    return null;
+                if (this.peek().type === 'lparen') {
+                    this.next();
+                    const args = [];
+                    if (this.peek().type !== 'rparen') {
+                        args.push(this.parseOr());
+                        while (this.peek().type === 'comma') {
+                            this.next();
+                            args.push(this.parseOr());
+                        }
+                    }
+                    this.expect('rparen');
+                    if (this.scope) {
+                        checkCall(tok.value, args.length, this.scope.functions);
+                        return undefined;
+                    }
+                    return callFunction(tok.value, args, this.ctx);
+                }
+                if (this.scope) {
+                    if (!this.scope.contexts.has(lower)) {
+                        throw new Error(`Unrecognized named-value: '${tok.value}'`);
+                    }
+                    return undefined;
+                }
+                return rootContext(lower, this.ctx);
+            }
+            default:
+                throw new Error(`Unexpected token: ${tok.type}`);
+        }
+    }
+}
+function evaluate(expr, ctx) {
+    return new Parser(tokenize(expr), ctx).parse();
+}
+/**
+ * Resolve a single `${{ expr }}` expression to its underlying value (not
+ * coerced to boolean), used for e.g. action output value mapping such as
+ * `outputs.greeting.value: ${{ steps.greet.outputs.greeting }}`.
+ * Returns undefined if the string isn't a (sole) `${{ }}` expression or
+ * fails to evaluate.
+ */
+function resolveExpressionValue(expr, ctx) {
+    if (expr === undefined)
+        return undefined;
+    const trimmed = expr.trim();
+    const wrapped = trimmed.match(/^\$\{\{([\s\S]*)\}\}$/);
+    const inner = wrapped ? wrapped[1].trim() : trimmed;
+    try {
+        return evaluate(inner, ctx);
+    }
+    catch (error) {
+        logger_1.logger.warn(`Failed to resolve expression "${expr}": ${error instanceof Error ? error.message : 'Unknown error'}.`);
+        return undefined;
+    }
+}
+/**
+ * Replace every `${{ expr }}` occurrence within a string with its resolved
+ * value. Used for substituting env/inputs/secrets/steps/github/matrix
+ * references inside `run:` command text. Expressions that fail to resolve
+ * are left as `undefined` -> empty string, matching GitHub Actions behavior
+ * for unresolved references.
+ */
+function substituteExpressions(input, ctx) {
+    return input.replace(/\$\{\{([\s\S]*?)\}\}/g, (full, inner) => {
+        try {
+            return toText(evaluate(inner.trim(), ctx));
+        }
+        catch (error) {
+            logger_1.logger.warn(`Failed to resolve expression "${full}": ${error instanceof Error ? error.message : 'Unknown error'}.`);
+            return full;
+        }
+    });
+}
+/**
+ * Resolve every value of an `env:` / `with:` map against the given context,
+ * stringifying non-string YAML scalars (e.g. `PORT: 3000`) the way the
+ * runner does before exporting them.
+ */
+function substituteRecord(record, ctx) {
+    const result = {};
+    for (const [key, value] of Object.entries(record || {})) {
+        result[key] = substituteExpressions(String(value ?? ''), ctx);
+    }
+    return result;
+}
+const STATUS_FUNCTION = /\b(success|failure|always|cancelled)\s*\(/i;
+/**
+ * GitHub wraps a job or step `if:` that doesn't call a status function in
+ * an implicit `success() && (...)`; an absent `if:` means `success()`.
+ */
+function withImplicitSuccess(expr) {
+    if (expr === undefined || expr === null || String(expr).trim() === '') {
+        return 'success()';
+    }
+    let inner = String(expr).trim();
+    const wrapped = inner.match(/^\$\{\{([\s\S]*)\}\}$/);
+    if (wrapped)
+        inner = wrapped[1].trim();
+    return STATUS_FUNCTION.test(inner) ? inner : `success() && (${inner})`;
+}
+/**
+ * Evaluate an `if:` condition string against the given context.
+ * Returns true when the condition is undefined/empty, or when it fails to
+ * parse (fails open, with a warning, to avoid unexpectedly skipping steps).
+ */
+function evaluateCondition(expr, ctx) {
+    if (expr === undefined)
+        return true;
+    let trimmed = String(expr).trim();
+    const wrapped = trimmed.match(/^\$\{\{([\s\S]*)\}\}$/);
+    if (wrapped)
+        trimmed = wrapped[1].trim();
+    if (trimmed === '')
+        return true;
+    // An expression that can't be evaluated is an error, as on GitHub (where
+    // it fails the step or job), never a condition that passes.
+    return toBoolean(evaluate(trimmed, ctx));
+}
+/** The error for an `if:` that couldn't be evaluated, worded like GitHub's. */
+function ifEvaluationError(target, error) {
+    return `Error when evaluating 'if' for ${target}. ${error instanceof Error ? error.message : String(error)}`;
+}
+const STATUS_FUNCTIONS = ['success', 'failure', 'always', 'cancelled'];
+const GENERAL_FUNCTIONS = [
+    'contains',
+    'startswith',
+    'endswith',
+    'format',
+    'join',
+    'tojson',
+    'fromjson'
+];
+/**
+ * GitHub's context availability for `if:`
+ * (https://docs.github.com/en/actions/learn-github-actions/contexts#context-availability).
+ */
+const SCOPES = {
+    'job-if': {
+        contexts: new Set(['github', 'needs', 'vars', 'inputs']),
+        functions: new Set([...STATUS_FUNCTIONS, ...GENERAL_FUNCTIONS])
+    },
+    'step-if': {
+        contexts: new Set([
+            'github',
+            'needs',
+            'strategy',
+            'matrix',
+            'job',
+            'runner',
+            'env',
+            'vars',
+            'secrets',
+            'steps',
+            'inputs'
+        ]),
+        functions: new Set([...STATUS_FUNCTIONS, ...GENERAL_FUNCTIONS, 'hashfiles'])
+    },
+    'composite-step-if': {
+        contexts: new Set([
+            'github',
+            'needs',
+            'strategy',
+            'matrix',
+            'job',
+            'runner',
+            'env',
+            'vars',
+            'steps',
+            'inputs'
+        ]),
+        functions: new Set([...STATUS_FUNCTIONS, ...GENERAL_FUNCTIONS, 'hashfiles'])
+    }
+};
+/**
+ * Check an `if:` expression without evaluating it: syntax, and that it only
+ * uses contexts and functions available where it appears. Returns the error
+ * message, or undefined if it's valid. GitHub rejects a workflow with such
+ * an error before running any job.
+ */
+function validateExpression(expr, location) {
+    if (expr === undefined || typeof expr === 'boolean')
+        return undefined;
+    let trimmed = expr.trim();
+    const wrapped = trimmed.match(/^\$\{\{([\s\S]*)\}\}$/);
+    if (wrapped)
+        trimmed = wrapped[1].trim();
+    if (trimmed === '')
+        return undefined;
+    try {
+        new Parser(tokenize(trimmed), createContext(), SCOPES[location]).parse();
+        return undefined;
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : String(error);
+    }
+}
+//# sourceMappingURL=expression.js.map