@secureci/cli 0.5.0 → 0.5.1

package/dist/cli.js

@@ -38,6 +38,7 @@ const commander_1 = require("commander");
 const dry_run_1 = require("./runner/dry-run");
 const executor_1 = require("./runner/executor");
 const action_fetcher_1 = require("./runner/action-fetcher");
+const progress_1 = require("./utils/progress");
 const contract_source_1 = require("./contract-source");
 const validator_1 = require("./parser/validator");
 const workflow_parser_1 = require("./parser/workflow-parser");
@@ -248,9 +249,6 @@ async function runInventory(files, options) {
         process.exit(1);
     }
     targets.forEach(requireFile);
-    const resolver = options.offline
-        ? undefined
-        : (uses) => (0, action_fetcher_1.resolveActionSha)(uses);
     // Merge every file's remote actions by `uses`.
     const byUses = new Map();
     for (const file of targets) {
@@ -258,7 +256,11 @@ async function runInventory(files, options) {
             const parsed = (0, workflow_parser_1.parseFile)(file);
             if (parsed.type !== 'workflow')
                 continue;
-            const inv = await (0, inventory_1.buildInventory)({ type: 'workflow', path: file, file: parsed.file }, resolver);
+            const inv = await (0, inventory_1.buildInventory)({
+                type: 'workflow',
+                path: file,
+                file: parsed.file
+            });
             for (const action of inv.actions) {
                 const existing = byUses.get(action.uses);
                 if (existing)
@@ -272,19 +274,7 @@ async function runInventory(files, options) {
             process.exit(1);
         }
     }
-    // Download progress would corrupt --dry-run's JSON on stdout; warnings
-    // still go to stderr.
-    if (options.dryRun)
-        logger_1.logger.setLevel(logger_1.LogLevel.WARN);
-    // Follow remote composite actions and reusable workflows into the
-    // actions they use, downloaded at the resolved commit.
-    const actions = (await (0, inventory_1.addTransitive)([...byUses.values()], {
-        resolveSha: resolver,
-        fetch: (uses, kind) => kind === 'action'
-            ? (0, action_fetcher_1.fetchAction)(uses, { offline: options.offline })
-            : (0, action_fetcher_1.fetchRepoFile)(uses, { offline: options.offline }),
-        warn: (message) => logger_1.logger.warn(message)
-    })).sort((a, b) => a.uses.localeCompare(b.uses));
+    const direct = [...byUses.values()];
     const lockPath = path.join(process.cwd(), LOCKFILE_NAME);
     // secureci.lock is first-class; GitHub's actions.lock is used only when
     // it is the lockfile the repository provides.
@@ -293,10 +283,11 @@ async function runInventory(files, options) {
     // writes the lock; otherwise (`--check`, or bare `inventory` with a
     // lockfile) compares against it.
     const writing = update || (!check && !source);
+    const comparing = !writing && !options.dryRun;
     let lock;
     const github = source?.kind === 'github';
     const lockName = github ? 'actions.lock' : LOCKFILE_NAME;
-    if (!writing && !options.dryRun) {
+    if (comparing) {
         if (!source) {
             logger_1.logger.error(`No ${LOCKFILE_NAME} found (or GitHub's ${github_lockfile_1.GITHUB_LOCKFILE}). Create one with: secureci inventory --update-lock`);
             process.exit(1);
@@ -309,24 +300,83 @@ async function runInventory(files, options) {
             process.exit(1);
         }
     }
-    // Repository identity: recorded when writing; when checking, looked up
-    // only for repositories the lock has an identity for.
-    if (!options.offline) {
-        const lookups = new Map();
+    // Download messages would corrupt --dry-run's JSON on stdout and clash
+    // with the progress lines; warnings and errors still go to stderr.
+    const level = logger_1.logger.getLevel();
+    if (level === logger_1.LogLevel.INFO)
+        logger_1.logger.setLevel(logger_1.LogLevel.WARN);
+    const online = !options.offline;
+    if (online && direct.length > 0) {
+        process.stderr.write(`Resolving ${direct.length} action(s) over the network, and reading the actions they use. This can take a while (--offline uses only what is cached).\n`);
+    }
+    // 1. Resolve each tag or branch to the commit it points at.
+    const toResolve = online ? direct.filter((a) => !a.resolvedSha) : [];
+    const resolving = new progress_1.Progress('Resolving tags', toResolve.length);
+    for (const action of toResolve) {
+        resolving.tick(action.uses);
+        action.resolvedSha = await (0, action_fetcher_1.resolveActionSha)(action.uses);
+    }
+    resolving.done(`Resolved ${toResolve.length} tag(s)`);
+    // 2. Follow remote composite actions and reusable workflows into the
+    // actions they use, downloaded at the resolved commit.
+    const reading = new progress_1.Progress('Reading actions', online ? direct.length : 0);
+    let read = 0;
+    const actions = (await (0, inventory_1.addTransitive)(direct, {
+        resolveSha: online ? (uses) => (0, action_fetcher_1.resolveActionSha)(uses) : undefined,
+        fetch: (uses, kind) => {
+            if (online)
+                reading.tick(uses.replace(/@([0-9a-f]{12})[0-9a-f]{28}$/, '@$1'));
+            read++;
+            return kind === 'action'
+                ? (0, action_fetcher_1.fetchAction)(uses, { offline: options.offline })
+                : (0, action_fetcher_1.fetchRepoFile)(uses, { offline: options.offline });
+        },
+        warn: (message) => logger_1.logger.warn(message),
+        onQueue: () => reading.grow()
+    })).sort((a, b) => a.uses.localeCompare(b.uses));
+    reading.done(`Read ${read} action(s) for the actions they use`);
+    const repos = new Map();
+    if (online) {
         for (const action of actions) {
             if (!action.resolvedSha)
                 continue;
-            if (lock && lock.actions[action.uses]?.repoId === undefined)
+            const identity = !lock || lock.actions[action.uses]?.repoId !== undefined;
+            const existence = comparing && action.pinned;
+            if (!identity && !existence)
                 continue;
             const key = `${action.owner}/${action.repo}`.toLowerCase();
-            if (!lookups.has(key)) {
-                lookups.set(key, (0, action_fetcher_1.resolveRepoIdentity)(action.owner, action.repo));
-            }
-            const identity = await lookups.get(key);
-            if (identity)
-                Object.assign(action, identity);
+            const entry = repos.get(key) ?? {
+                owner: action.owner,
+                repo: action.repo,
+                identity: false,
+                existence: false
+            };
+            entry.identity || (entry.identity = identity);
+            entry.existence || (entry.existence = existence);
+            repos.set(key, entry);
+        }
+    }
+    const identities = new Map();
+    const missingRepos = new Set();
+    const checking = new progress_1.Progress('Checking repositories', repos.size);
+    for (const [key, r] of repos) {
+        checking.tick(`${r.owner}/${r.repo}`);
+        const identity = r.identity
+            ? await (0, action_fetcher_1.resolveRepoIdentity)(r.owner, r.repo)
+            : undefined;
+        if (identity)
+            identities.set(key, identity);
+        else if (r.existence && !(await (0, action_fetcher_1.repoExists)(r.owner, r.repo))) {
+            missingRepos.add(key);
         }
     }
+    checking.done(`Checked ${repos.size} repositor${repos.size === 1 ? 'y' : 'ies'}`);
+    for (const action of actions) {
+        const identity = identities.get(`${action.owner}/${action.repo}`.toLowerCase());
+        if (identity && action.resolvedSha)
+            Object.assign(action, identity);
+    }
+    logger_1.logger.setLevel(level);
     const current = {};
     for (const action of actions) {
         if (!action.resolvedSha)
@@ -344,7 +394,12 @@ async function runInventory(files, options) {
         console.log(JSON.stringify({ actions }, null, 2));
         return;
     }
+    // Used references that couldn't be resolved to a commit now.
+    const unresolved = actions.filter((a) => !a.resolvedSha);
     if (writing) {
+        if (online) {
+            unresolved.forEach((a) => logger_1.logger.warn(`Not locked: could not resolve ${a.uses} (repository deleted, renamed or private, or the network is unavailable?)`));
+        }
         fs.writeFileSync(lockPath, (0, github_lockfile_1.serializeSecureciLockfile)(current));
         const transitive = Object.values(current).filter((e) => e.via).length;
         logger_1.logger.success(`Wrote ${Object.keys(current).length} action(s) to ${LOCKFILE_NAME}` +
@@ -363,16 +418,41 @@ async function runInventory(files, options) {
     for (const d of diff.identity) {
         logger_1.logger.error(`Repository changed: ${d.uses} ${d.field} is now ${d.to} (was ${d.from}). The name now points at a different ${d.field === 'repo_id' ? 'repository (deleted and re-created?)' : 'owner (transferred, or the account re-registered?)'}.`);
     }
+    for (const a of actions) {
+        if (missingRepos.has(`${a.owner}/${a.repo}`.toLowerCase())) {
+            logger_1.logger.error(`Repository gone: ${a.uses} can no longer be read (deleted, renamed or made private?). The locked commit can't be fetched, and the name could be re-registered by someone else.`);
+        }
+    }
+    // Online, a used reference that doesn't resolve is a failure (its
+    // repository may be gone); offline, tags can't resolve, so it's a warning.
+    for (const a of unresolved) {
+        const locked = lock?.actions[a.uses];
+        const at = locked ? ` (locked at ${locked.commit.slice(0, 12)})` : '';
+        if (online) {
+            logger_1.logger.error(`Could not resolve ${a.uses}${at}: the repository or ref may have been deleted, renamed or made private, or the network is unavailable.`);
+        }
+    }
+    if (!online && unresolved.length > 0) {
+        logger_1.logger.warn(`Not checked offline (tags need the network): ${unresolved.map((a) => a.uses).join(', ')}`);
+    }
     diff.added.forEach((u) => logger_1.logger.warn(`New action not in ${lockName}: ${u}`));
     // actions.lock is written by `gh actions-lock`, which may record entries
     // SecureCI doesn't follow, so "no longer used" is only for secureci.lock.
+    // A reference still in use but unresolved isn't "no longer used".
     if (!github) {
-        diff.removed.forEach((u) => logger_1.logger.info(`In ${lockName} but no longer used: ${u}`));
+        const used = new Set(unresolved.map((a) => a.uses));
+        diff.removed
+            .filter((u) => !used.has(u))
+            .forEach((u) => logger_1.logger.info(`In ${lockName} but no longer used: ${u}`));
     }
     if (diff.identity.length > 0) {
         logger_1.logger.error(`A locked repository is no longer the one that was locked. Verify it before trusting it, then ${fixHint}.`);
         process.exit(1);
     }
+    if (missingRepos.size > 0 || (online && unresolved.length > 0)) {
+        logger_1.logger.error(`Locked actions could not be verified. Check that each repository and ref still exists and is readable${(0, action_fetcher_1.githubToken)() ? '' : ' (set GITHUB_TOKEN for private repositories)'}.`);
+        process.exit(1);
+    }
     if (diff.drifted.length > 0) {
         logger_1.logger.error(`Action commits drifted from ${lockName}. Review the change, then ${fixHint}.`);
         process.exit(1);

package/dist/inventory.js

@@ -247,6 +247,7 @@ async function addTransitive(direct, deps) {
             }
             byUses.set(dep.uses, dep);
             queue.push({ action: dep, depth: depth + 1 });
+            deps.onQueue?.(dep);
         }
     }
     return [...byUses.values()];

package/dist/runner/action-fetcher.js

@@ -43,6 +43,8 @@ exports.fetchRepoFile = fetchRepoFile;
 exports.clearActionCache = clearActionCache;
 exports.resolveActionSha = resolveActionSha;
 exports.resolveRepoIdentity = resolveRepoIdentity;
+exports.lsRemoteReachable = lsRemoteReachable;
+exports.repoExists = repoExists;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const http = __importStar(require("http"));
@@ -459,4 +461,39 @@ async function resolveRepoIdentity(owner, repo, options = {}) {
         return (await lookup(null)).identity;
     return undefined;
 }
+/** Whether `git ls-remote` can read the repository at `url`. */
+async function lsRemoteReachable(url) {
+    try {
+        await execFileAsync('git', ['ls-remote', url, 'HEAD'], {
+            encoding: 'utf8',
+            timeout: 15000,
+            env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether `owner/repo` can still be read: via the API when a token is
+ * available (404 means no), otherwise (or if the API can't answer) via
+ * anonymous `git ls-remote`. False also when the network is down.
+ */
+async function repoExists(owner, repo, options = {}) {
+    const timeoutMs = options.timeoutMs ?? DOWNLOAD_TIMEOUT_MS;
+    const token = options.token === undefined ? githubToken() : options.token;
+    if (token) {
+        try {
+            await getText(`${apiUrl()}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`, { ...requestHeaders(token), Accept: 'application/vnd.github+json' }, timeoutMs);
+            return true;
+        }
+        catch (error) {
+            if (error.status === 404)
+                return false;
+            // 401, rate limit or network: fall back to anonymous git.
+        }
+    }
+    return lsRemoteReachable(`${serverUrl()}/${owner}/${repo}.git`);
+}
 //# sourceMappingURL=action-fetcher.js.map

package/dist/utils/logger.js

@@ -17,6 +17,16 @@ class Logger {
     setLevel(level) {
         this.level = level;
     }
+    getLevel() {
+        return this.level;
+    }
+    /**
+     * Run `hook` before each message is written (e.g. to clear an in-place
+     * progress line); undefined removes it.
+     */
+    setBeforeWrite(hook) {
+        this.beforeWrite = hook;
+    }
     /**
      * Register secret values so they get masked (replaced with `***`) in any
      * subsequent log output, mirroring GitHub Actions' own secret masking.
@@ -48,35 +58,42 @@ class Logger {
     }
     debug(message, ...args) {
         if (this.level <= LogLevel.DEBUG) {
+            this.beforeWrite?.();
             console.log(ansi_1.colors.gray(`[DEBUG] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     info(message, ...args) {
         if (this.level <= LogLevel.INFO) {
+            this.beforeWrite?.();
             console.log(ansi_1.colors.blue(`[INFO] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     success(message, ...args) {
         if (this.level <= LogLevel.INFO) {
+            this.beforeWrite?.();
             console.log(ansi_1.colors.green(`✓ ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     warn(message, ...args) {
         if (this.level <= LogLevel.WARN) {
+            this.beforeWrite?.();
             console.warn(ansi_1.colors.yellow(`[WARN] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     error(message, ...args) {
         if (this.level <= LogLevel.ERROR) {
+            this.beforeWrite?.();
             console.error(ansi_1.colors.red(`[ERROR] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
         }
     }
     step(message) {
+        this.beforeWrite?.();
         console.log(ansi_1.colors.cyan(`\n→ ${this.mask(message)}`));
     }
     result(message, success) {
         const icon = success ? '✓' : '✗';
         const color = success ? ansi_1.colors.green : ansi_1.colors.red;
+        this.beforeWrite?.();
         console.log(color(`${icon} ${this.mask(message)}`));
     }
 }

package/dist/utils/progress.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Progress = void 0;
+const logger_1 = require("./logger");
+const CLEAR_LINE = '\r\x1b[K';
+/**
+ * Progress for a slow phase, e.g. resolving actions over the network. On a
+ * terminal it updates one line in place (`Label [3/10] item`); elsewhere
+ * (CI logs) it prints a line per item. The total can grow as work is found.
+ */
+class Progress {
+    constructor(label, total, out = process.stderr) {
+        this.label = label;
+        this.total = total;
+        this.out = out;
+        this.count = 0;
+        this.drawn = false;
+        this.tty = !!out.isTTY;
+        // A log line would otherwise be appended to the half-drawn line.
+        if (this.tty)
+            logger_1.logger.setBeforeWrite(() => this.clear());
+    }
+    /** More items were found to process. */
+    grow(n = 1) {
+        this.total += n;
+    }
+    tick(item) {
+        this.count++;
+        if (this.count > this.total)
+            this.total = this.count;
+        const line = `${this.label} [${this.count}/${this.total}] ${item}`;
+        if (this.tty) {
+            this.out.write(CLEAR_LINE + line);
+            this.drawn = true;
+        }
+        else {
+            this.out.write(line + '\n');
+        }
+    }
+    /** End the phase, leaving `summary` (if any work was done). */
+    done(summary) {
+        if (this.tty)
+            logger_1.logger.setBeforeWrite(undefined);
+        if (this.count === 0)
+            return;
+        this.clear();
+        if (summary)
+            this.out.write(summary + '\n');
+    }
+    clear() {
+        if (this.drawn) {
+            this.out.write(CLEAR_LINE);
+            this.drawn = false;
+        }
+    }
+}
+exports.Progress = Progress;
+//# sourceMappingURL=progress.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureci/cli",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "SecureCI: validate, check against pipeline standards, and run GitHub Actions workflows locally",
   "main": "dist/index.js",
   "bin": {