@secureci/cli 0.5.0 → 0.6.0

package/dist/runner/action-fetcher.js

@@ -37,12 +37,20 @@ exports.parseActionReference = parseActionReference;
 exports.getActionCacheDir = getActionCacheDir;
 exports.githubToken = githubToken;
 exports._resetGithubTokenForTests = _resetGithubTokenForTests;
+exports.serverUrl = serverUrl;
+exports.apiUrl = apiUrl;
 exports.lsRemoteSha = lsRemoteSha;
+exports.parseLsRemoteTags = parseLsRemoteTags;
+exports.lsRemoteTags = lsRemoteTags;
+exports.getText = getText;
 exports.fetchAction = fetchAction;
 exports.fetchRepoFile = fetchRepoFile;
 exports.clearActionCache = clearActionCache;
+exports.cachedActionSha = cachedActionSha;
 exports.resolveActionSha = resolveActionSha;
 exports.resolveRepoIdentity = resolveRepoIdentity;
+exports.lsRemoteReachable = lsRemoteReachable;
+exports.repoExists = repoExists;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const http = __importStar(require("http"));
@@ -108,9 +116,14 @@ function githubToken() {
 function _resetGithubTokenForTests() {
     discoveredToken = undefined;
 }
+/** The GitHub server ($GITHUB_SERVER_URL, default https://github.com). */
 function serverUrl() {
     return (process.env.GITHUB_SERVER_URL || 'https://github.com').replace(/\/+$/, '');
 }
+/**
+ * The GitHub REST API base: $GITHUB_API_URL, else api.github.com, or
+ * `<server>/api/v3` for GitHub Enterprise Server.
+ */
 function apiUrl() {
     if (process.env.GITHUB_API_URL) {
         return process.env.GITHUB_API_URL.replace(/\/+$/, '');
@@ -153,7 +166,51 @@ async function lsRemoteSha(url, ref) {
         refs.get(`refs/tags/${ref}`) ??
         refs.get(`refs/heads/${ref}`));
 }
-/** GET a small text response (the API commit lookup). */
+/**
+ * Tag name -> commit SHA from `git ls-remote --tags` output. An annotated
+ * tag's peeled entry (`refs/tags/x^{}`) wins, so every SHA is a commit.
+ */
+function parseLsRemoteTags(output) {
+    const tags = new Map();
+    const peeled = new Set();
+    for (const line of output.split('\n')) {
+        const [sha, ref] = line.trim().split(/\s+/);
+        if (!sha || !FULL_SHA.test(sha) || !ref?.startsWith('refs/tags/'))
+            continue;
+        let name = ref.slice('refs/tags/'.length);
+        const isPeeled = name.endsWith('^{}');
+        if (isPeeled)
+            name = name.slice(0, -3);
+        if (isPeeled || !peeled.has(name))
+            tags.set(name, sha.toLowerCase());
+        if (isPeeled)
+            peeled.add(name);
+    }
+    return tags;
+}
+/**
+ * Every tag of the repository at `url` and the commit it points at, via
+ * anonymous `git ls-remote --tags` (no API rate limit), or undefined if
+ * the repository can't be read.
+ */
+async function lsRemoteTags(url) {
+    try {
+        const { stdout } = await execFileAsync('git', ['ls-remote', '--tags', url], {
+            encoding: 'utf8',
+            timeout: 15000,
+            maxBuffer: 16 * 1024 * 1024,
+            env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }
+        });
+        return parseLsRemoteTags(stdout);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * GET a small text response (API lookups). Rejects on a non-200 status
+ * with an error carrying `status`.
+ */
 function getText(url, headers, timeoutMs) {
     return new Promise((resolve, reject) => {
         const client = url.startsWith('http://') ? http : https;
@@ -276,7 +333,27 @@ function writeRefIndex(dir, refs) {
  * picked up. If the ref can't be resolved (offline, rate-limited), the
  * last commit cached for it is used. Returns the repository root.
  */
-async function fetchRepository(ref, uses, options) {
+const inflight = new Map();
+/**
+ * fetchRepositoryOnce, shared by concurrent callers asking for the same
+ * repository and ref (jobs running in parallel), so it is downloaded and
+ * written into the cache once.
+ */
+function fetchRepository(ref, uses, options) {
+    const key = JSON.stringify([
+        repoCacheDir(ref),
+        ref.ref,
+        !!options.offline,
+        options.token === undefined ? 'discovered' : options.token
+    ]);
+    let pending = inflight.get(key);
+    if (!pending) {
+        pending = fetchRepositoryOnce(ref, uses, options).finally(() => inflight.delete(key));
+        inflight.set(key, pending);
+    }
+    return pending;
+}
+async function fetchRepositoryOnce(ref, uses, options) {
     const dir = repoCacheDir(ref);
     const refs = readRefIndex(dir);
     const cachedSha = FULL_SHA.test(ref.ref)
@@ -332,8 +409,12 @@ async function fetchRepository(ref, uses, options) {
         const [top] = fs.readdirSync(extractDir);
         if (!top)
             throw new Error('No files extracted from tarball');
-        fs.rmSync(target, { recursive: true, force: true });
-        fs.renameSync(path.join(extractDir, top), target);
+        // A commit's content never changes: keep a copy another job (asking
+        // by another ref) put there meanwhile, as it may be in use.
+        if (!sha || !fs.existsSync(target)) {
+            fs.rmSync(target, { recursive: true, force: true });
+            fs.renameSync(path.join(extractDir, top), target);
+        }
         if (sha) {
             writeRefIndex(dir, { ...readRefIndex(dir), [ref.ref]: sha });
         }
@@ -408,6 +489,23 @@ function clearActionCache() {
         logger_1.logger.info('Action cache cleared');
     }
 }
+/**
+ * The commit a ref resolved to when it was last downloaded into the action
+ * cache, without touching the network (for offline use), or undefined when
+ * that commit isn't cached. An already-pinned SHA is returned as is. For a
+ * moving ref (`@main`) this is the last commit seen, not necessarily the
+ * current one.
+ */
+function cachedActionSha(uses) {
+    const ref = parseActionReference(uses);
+    if (!ref)
+        return undefined;
+    if (FULL_SHA.test(ref.ref))
+        return ref.ref.toLowerCase();
+    const dir = repoCacheDir(ref);
+    const sha = readRefIndex(dir)[ref.ref];
+    return sha && fs.existsSync(path.join(dir, sha)) ? sha : undefined;
+}
 /**
  * Resolve a `uses:` action reference to its current commit SHA, for the
  * inventory and lockfile. Returns undefined if the ref can't be resolved
@@ -459,4 +557,39 @@ async function resolveRepoIdentity(owner, repo, options = {}) {
         return (await lookup(null)).identity;
     return undefined;
 }
+/** Whether `git ls-remote` can read the repository at `url`. */
+async function lsRemoteReachable(url) {
+    try {
+        await execFileAsync('git', ['ls-remote', url, 'HEAD'], {
+            encoding: 'utf8',
+            timeout: 15000,
+            env: { ...process.env, GIT_TERMINAL_PROMPT: '0' }
+        });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Whether `owner/repo` can still be read: via the API when a token is
+ * available (404 means no), otherwise (or if the API can't answer) via
+ * anonymous `git ls-remote`. False also when the network is down.
+ */
+async function repoExists(owner, repo, options = {}) {
+    const timeoutMs = options.timeoutMs ?? DOWNLOAD_TIMEOUT_MS;
+    const token = options.token === undefined ? githubToken() : options.token;
+    if (token) {
+        try {
+            await getText(`${apiUrl()}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}`, { ...requestHeaders(token), Accept: 'application/vnd.github+json' }, timeoutMs);
+            return true;
+        }
+        catch (error) {
+            if (error.status === 404)
+                return false;
+            // 401, rate limit or network: fall back to anonymous git.
+        }
+    }
+    return lsRemoteReachable(`${serverUrl()}/${owner}/${repo}.git`);
+}
 //# sourceMappingURL=action-fetcher.js.map

package/dist/runner/builtin-actions.js

@@ -435,14 +435,24 @@ async function saveCache(fsys, scope, key, paths) {
             warning: 'Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.'
         };
     }
-    const staging = `${dir}.tmp-${process.pid}`;
-    fs.rmSync(staging, { recursive: true, force: true });
+    // Unique per save: jobs running at once may save the same key.
+    const staging = `${dir}.tmp-${process.pid}-${crypto.randomBytes(4).toString('hex')}`;
     for (const file of files) {
         copyFile(file.host, path.join(staging, 'files', ...cachedLocation(fsys, file.logical).split('/')));
     }
     fs.writeFileSync(path.join(staging, 'meta.json'), JSON.stringify({ key, version, created: Date.now() }));
     fs.mkdirSync(path.dirname(dir), { recursive: true });
-    fs.renameSync(staging, dir);
+    try {
+        fs.renameSync(staging, dir);
+    }
+    catch (error) {
+        fs.rmSync(staging, { recursive: true, force: true });
+        // Another job saved this key meanwhile; cache entries are immutable.
+        if (fs.existsSync(path.join(dir, 'meta.json'))) {
+            return ok(`Cache for key "${key}" already exists; not saving`);
+        }
+        throw error;
+    }
     return ok(`Cache saved with key: ${key} (${files.length} file(s))`);
 }
 /** `actions/cache`, `actions/cache/restore` and `actions/cache/save`. */

package/dist/runner/dry-run.js

@@ -4,11 +4,15 @@ exports.dryRun = dryRun;
 const workflow_parser_1 = require("../parser/workflow-parser");
 const logger_1 = require("../utils/logger");
 const validator_1 = require("../parser/validator");
+const expression_1 = require("./expression");
+const job_plan_1 = require("./job-plan");
+// A matrix expression reading a context a dry run doesn't have.
+const RUN_TIME_MATRIX = /\$\{\{[^}]*\b(?:needs|inputs|vars|github|secrets)\b/;
 /**
  * Perform a dry run of a workflow or action file
  * Shows what would be executed without actually running anything
  */
-function dryRun(filePath) {
+function dryRun(filePath, options = {}) {
     try {
         const parsed = (0, workflow_parser_1.parseFile)(filePath);
         // A file a real run would reject fails the dry run too.
@@ -23,7 +27,7 @@ function dryRun(filePath) {
             return { success: false, type: parsed.type };
         }
         if (parsed.type === 'workflow') {
-            return dryRunWorkflow(parsed);
+            return dryRunWorkflow(parsed, options);
         }
         else {
             return dryRunAction(parsed);
@@ -37,22 +41,56 @@ function dryRun(filePath) {
         };
     }
 }
-function dryRunWorkflow(parsed) {
+function dryRunWorkflow(parsed, options) {
     const workflow = parsed.file;
+    const filter = options.matrix ?? {};
+    const definedKeys = new Set();
+    let runTimeMatrix = false;
+    let unmatched = false;
     logger_1.logger.info(`Workflow: ${workflow.name}`);
     logger_1.logger.info(`Trigger: ${JSON.stringify(workflow.on)}`);
-    const jobs = Object.entries(workflow.jobs).map(([jobId, job]) => {
+    const selectedJobs = Object.entries(workflow.jobs).filter(([jobId]) => !options.job || jobId === options.job);
+    const jobs = selectedJobs.flatMap(([jobId, job]) => {
+        // Matrix combinations, as far as they can be known without running.
+        let matrix;
+        const rawMatrix = job.strategy?.matrix;
+        const atRunTime = rawMatrix !== undefined &&
+            RUN_TIME_MATRIX.test(JSON.stringify(rawMatrix));
+        if (atRunTime) {
+            runTimeMatrix = true;
+        }
+        else if (rawMatrix !== undefined) {
+            const combinations = (0, job_plan_1.expandMatrix)(rawMatrix, (0, expression_1.createContext)());
+            combinations.forEach((c) => Object.keys(c).forEach((k) => definedKeys.add(k)));
+            const { keys, matches } = (0, job_plan_1.filterMatrix)(combinations, filter);
+            if (keys.length > 0 && matches.length === 0) {
+                logger_1.logger.warn((0, job_plan_1.noMatrixMatchMessage)(jobId, filter, combinations));
+                unmatched = true;
+                return [];
+            }
+            matrix = matches.map((m) => (0, job_plan_1.matrixLabel)(m.values));
+        }
         logger_1.logger.step(`Job: ${jobId} (${job.name || jobId})`);
+        if (atRunTime) {
+            logger_1.logger.info('  Matrix: resolved at run time');
+        }
+        else if (matrix) {
+            logger_1.logger.info(`  Matrix (${matrix.length} combination(s)):`);
+            matrix.forEach((label) => logger_1.logger.info(`    ${label}`));
+        }
         // Handle reusable workflow calls
         if (job.uses) {
             logger_1.logger.info(`  Uses workflow: ${job.uses}`);
             if (job.with) {
                 logger_1.logger.info(`  With inputs: ${JSON.stringify(job.with)}`);
             }
-            return {
-                name: jobId,
-                steps: [`Calls reusable workflow: ${job.uses}`]
-            };
+            return [
+                {
+                    name: jobId,
+                    steps: [`Calls reusable workflow: ${job.uses}`],
+                    ...(matrix ? { matrix } : {})
+                }
+            ];
         }
         // Handle regular jobs
         if (job['runs-on']) {
@@ -74,11 +112,18 @@ function dryRunWorkflow(parsed) {
             logger_1.logger.info(stepDesc);
             return stepDesc;
         });
-        return {
-            name: jobId,
-            steps
-        };
+        return [{ name: jobId, steps, ...(matrix ? { matrix } : {}) }];
     });
+    // A key might belong to a matrix only known at run time.
+    if (!runTimeMatrix) {
+        for (const key of (0, job_plan_1.unknownMatrixKeys)(filter, definedKeys)) {
+            logger_1.logger.warn(`--matrix ${key}: no matrix job defines this key; it was ignored`);
+        }
+    }
+    if (unmatched) {
+        logger_1.logger.error('Dry run failed: a --matrix filter matched no combination');
+        return { success: false, type: 'workflow', jobs };
+    }
     logger_1.logger.success('Dry run completed successfully');
     return {
         success: true,