@secureci/cli 0.5.0 → 0.6.0

package/dist/runner/steps.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.killProcessTree = killProcessTree;
 exports.executeStep = executeStep;
 exports.executeInJobContainer = executeInJobContainer;
 const fs = __importStar(require("fs"));
@@ -47,6 +48,38 @@ const shell_1 = require("./shell");
 const job_runtime_1 = require("./job-runtime");
 const actions_1 = require("./actions");
 const execAsync = (0, util_1.promisify)(child_process_1.exec);
+/**
+ * SIGKILL a process and all its descendants (found with `pgrep -P`), so a
+ * killed step's shell doesn't leave its commands running.
+ */
+function killProcessTree(pid) {
+    const tree = [];
+    const visit = (parent) => {
+        tree.push(parent);
+        let children;
+        try {
+            children = (0, child_process_1.execFileSync)('pgrep', ['-P', String(parent)], {
+                encoding: 'utf-8',
+                stdio: ['ignore', 'pipe', 'ignore']
+            });
+        }
+        catch {
+            return; // no children (or no pgrep)
+        }
+        for (const child of children.split('\n').filter(Boolean)) {
+            visit(Number(child));
+        }
+    };
+    visit(pid);
+    for (const id of tree) {
+        try {
+            process.kill(id, 'SIGKILL');
+        }
+        catch {
+            // already gone
+        }
+    }
+}
 /**
  * Execute a single step
  */
@@ -104,8 +137,9 @@ async function executeStep(step, options, runtime, ctx) {
             fs.writeFileSync(scriptPath, command);
             const workingDirectory = step['working-directory'] ?? runtime.defaults.workingDirectory;
             const limit = (0, job_runtime_1.effectiveTimeout)(runtime);
+            let stopOnAbort;
             try {
-                const { stdout, stderr } = await execAsync((0, shell_1.shellCommandLine)(shell.template, scriptPath), {
+                const running = execAsync((0, shell_1.shellCommandLine)(shell.template, scriptPath), {
                     timeout: limit.ms,
                     killSignal: 'SIGKILL',
                     cwd: workingDirectory
@@ -120,6 +154,17 @@ async function executeStep(step, options, runtime, ctx) {
                         ...(0, job_runtime_1.fileCommandEnv)(files)
                     }
                 });
+                // A cancelled job (fail-fast) kills its running step, with
+                // everything the step started.
+                const child = running.child;
+                stopOnAbort = () => {
+                    if (child.pid !== undefined)
+                        killProcessTree(child.pid);
+                };
+                if (runtime.signal?.aborted)
+                    stopOnAbort();
+                runtime.signal?.addEventListener('abort', stopOnAbort);
+                const { stdout, stderr } = await running;
                 const { outputs } = (0, job_runtime_1.finishStepOutput)(stdout, files, runtime);
                 if (stderr) {
                     logger_1.logger.warn(stderr.trim());
@@ -135,8 +180,12 @@ async function executeStep(step, options, runtime, ctx) {
             }
             catch (execError) {
                 const error = execError;
-                if (error.killed && limit.ms)
+                if (runtime.signal?.aborted) {
+                    error.message = 'The operation was canceled.';
+                }
+                else if (error.killed && limit.ms) {
                     error.message = limit.message;
+                }
                 logger_1.logger.error(`Step failed: ${error.message}`);
                 const { outputs } = (0, job_runtime_1.finishStepOutput)(error.stdout, files, runtime);
                 if (error.stderr) {
@@ -152,6 +201,9 @@ async function executeStep(step, options, runtime, ctx) {
                 };
             }
             finally {
+                if (stopOnAbort) {
+                    runtime.signal?.removeEventListener('abort', stopOnAbort);
+                }
                 (0, runner_env_1.cleanupStepFiles)(files);
             }
         }

package/dist/utils/env-file.js

@@ -0,0 +1,185 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseEnvFile = parseEnvFile;
+exports.readEnvFiles = readEnvFiles;
+exports.loadKeyValues = loadKeyValues;
+const fs = __importStar(require("fs"));
+const key_value_1 = require("./key-value");
+const logger_1 = require("./logger");
+/**
+ * Names accepted as keys. Hyphens are allowed because input names may
+ * contain them; everything else follows shell variable naming.
+ */
+const KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+const DOUBLE_QUOTE_ESCAPES = {
+    n: '\n',
+    r: '\r',
+    t: '\t',
+    '"': '"',
+    '\\': '\\'
+};
+/**
+ * Parse `.env`-style content into a record (see DOCS.md for the format):
+ * `KEY=value` lines, an optional `export ` prefix, `#` comments, single
+ * quotes (literal) and double quotes (escapes, may span lines). Later keys
+ * win. Errors name `fileName:line` but never echo the line, since it may
+ * hold a secret.
+ */
+function parseEnvFile(content, fileName) {
+    const result = {};
+    const lines = content
+        .replace(/^\uFEFF/, '')
+        .replace(/\r\n/g, '\n')
+        .split('\n');
+    let next = 0;
+    while (next < lines.length) {
+        const lineNo = next + 1;
+        const line = lines[next++];
+        const fail = (reason) => {
+            throw new Error(`${fileName}:${lineNo}: ${reason}`);
+        };
+        const trimmed = line.trim();
+        if (trimmed === '' || trimmed.startsWith('#'))
+            continue;
+        const body = trimmed.replace(/^export\s+/, '');
+        const separator = body.indexOf('=');
+        if (separator === -1)
+            fail('expected KEY=value');
+        const key = body.slice(0, separator).trim();
+        if (!KEY_PATTERN.test(key))
+            fail('invalid variable name');
+        const raw = body.slice(separator + 1);
+        const rest = raw.trimStart();
+        let value;
+        let tail = '';
+        if (rest.startsWith("'")) {
+            const close = rest.indexOf("'", 1);
+            if (close === -1)
+                fail('unterminated single-quoted value');
+            value = rest.slice(1, close);
+            tail = rest.slice(close + 1);
+        }
+        else if (rest.startsWith('"')) {
+            let text = rest;
+            let pos = 1;
+            value = '';
+            for (;;) {
+                if (pos >= text.length) {
+                    if (next >= lines.length)
+                        fail('unterminated double-quoted value');
+                    value += '\n';
+                    text = lines[next++];
+                    pos = 0;
+                    continue;
+                }
+                const char = text[pos];
+                if (char === '\\' && pos + 1 < text.length) {
+                    const escaped = text[pos + 1];
+                    value += DOUBLE_QUOTE_ESCAPES[escaped] ?? `\\${escaped}`;
+                    pos += 2;
+                    continue;
+                }
+                if (char === '"') {
+                    tail = text.slice(pos + 1);
+                    break;
+                }
+                value += char;
+                pos++;
+            }
+        }
+        else {
+            // A `#` starts a comment only after whitespace, so `a#b` stays intact.
+            const comment = raw.search(/\s#/);
+            value = (comment === -1 ? raw : raw.slice(0, comment)).trim();
+        }
+        const after = tail.trim();
+        if (after !== '' && !after.startsWith('#')) {
+            fail('unexpected text after closing quote');
+        }
+        result[key] = value;
+    }
+    return result;
+}
+/** Read and merge env files in order; later files override earlier ones. */
+function readEnvFiles(files, options) {
+    const platform = options.platform ?? process.platform;
+    const result = {};
+    for (const file of files) {
+        if (!fs.existsSync(file)) {
+            throw new Error(`${options.flagName}: file not found: ${file}`);
+        }
+        // POSIX modes don't describe Windows ACLs, so the check would mislead.
+        if (options.secret && platform !== 'win32') {
+            const mode = fs.statSync(file).mode & 0o777;
+            if (mode & 0o077) {
+                logger_1.logger.warn(`Secret file ${file} is readable by other users (mode ${mode.toString(8).padStart(4, '0')}). Restrict it with: chmod 600 ${file}`);
+            }
+        }
+        Object.assign(result, parseEnvFile(fs.readFileSync(file, 'utf-8'), file));
+    }
+    return result;
+}
+function configFileList(value, key) {
+    if (value === undefined)
+        return [];
+    if (typeof value === 'string')
+        return [value];
+    if (Array.isArray(value) && value.every((v) => typeof v === 'string')) {
+        return value;
+    }
+    throw new Error(`Invalid ${key} in config: expected a file path or a list of file paths`);
+}
+/**
+ * Resolve one family of run values (env, secrets, inputs or vars): files
+ * from the flag (or, without one, from the config), merged in order, then
+ * explicit `key=value` flags on top.
+ */
+function loadKeyValues(options) {
+    const configKey = options.fileFlagName.replace(/^--/, '');
+    const defaults = configFileList(options.configFiles, configKey);
+    const files = options.files && options.files.length > 0 ? options.files : defaults;
+    return {
+        ...readEnvFiles(files, {
+            flagName: options.fileFlagName,
+            secret: options.secret
+        }),
+        ...(0, key_value_1.parseKeyValuePairs)(options.pairs, options.flagName, {
+            redact: options.secret,
+            fromEnv: options.fromEnv
+        })
+    };
+}
+//# sourceMappingURL=env-file.js.map

package/dist/utils/logger.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.logger = exports.LogLevel = void 0;
+const async_hooks_1 = require("async_hooks");
 const ansi_1 = require("./ansi");
 var LogLevel;
 (function (LogLevel) {
@@ -13,10 +14,22 @@ class Logger {
     constructor() {
         this.level = LogLevel.INFO;
         this.secrets = new Set();
+        /** The labels of the job whose code is logging (see withJob). */
+        this.job = new async_hooks_1.AsyncLocalStorage();
     }
     setLevel(level) {
         this.level = level;
     }
+    getLevel() {
+        return this.level;
+    }
+    /**
+     * Run `hook` before each message is written (e.g. to clear an in-place
+     * progress line); undefined removes it.
+     */
+    setBeforeWrite(hook) {
+        this.beforeWrite = hook;
+    }
     /**
      * Register secret values so they get masked (replaced with `***`) in any
      * subsequent log output, mirroring GitHub Actions' own secret masking.
@@ -43,41 +56,74 @@ class Logger {
         }
         return masked;
     }
+    /**
+     * Run `fn` with every message it logs (across awaits, and in anything
+     * it starts) prefixed with `[label]`, so concurrent jobs' lines can be
+     * told apart. Nested calls (a called workflow's jobs) join the labels;
+     * with `replace`, `label` takes the place of the innermost one (a matrix
+     * combination's label instead of its job's).
+     */
+    withJob(label, fn, replace = false) {
+        const outer = this.job.getStore() ?? [];
+        return this.job.run([...(replace ? outer.slice(0, -1) : outer), label], fn);
+    }
+    /**
+     * `head` and the masked `message`, each non-empty line prefixed with the
+     * job label inside withJob.
+     */
+    format(head, message) {
+        const labels = this.job.getStore();
+        const masked = head + this.mask(message);
+        if (!labels)
+            return masked;
+        const prefix = `[${this.mask(labels.join(' / '))}] `;
+        return masked
+            .split('\n')
+            .map((line) => (line ? prefix + line : line))
+            .join('\n');
+    }
     maskArg(arg) {
         return typeof arg === 'string' ? this.mask(arg) : arg;
     }
     debug(message, ...args) {
         if (this.level <= LogLevel.DEBUG) {
-            console.log(ansi_1.colors.gray(`[DEBUG] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            this.beforeWrite?.();
+            console.log(ansi_1.colors.gray(this.format('[DEBUG] ', message)), ...args.map((a) => this.maskArg(a)));
         }
     }
     info(message, ...args) {
         if (this.level <= LogLevel.INFO) {
-            console.log(ansi_1.colors.blue(`[INFO] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            this.beforeWrite?.();
+            console.log(ansi_1.colors.blue(this.format('[INFO] ', message)), ...args.map((a) => this.maskArg(a)));
         }
     }
     success(message, ...args) {
         if (this.level <= LogLevel.INFO) {
-            console.log(ansi_1.colors.green(`✓ ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            this.beforeWrite?.();
+            console.log(ansi_1.colors.green(this.format('✓ ', message)), ...args.map((a) => this.maskArg(a)));
         }
     }
     warn(message, ...args) {
         if (this.level <= LogLevel.WARN) {
-            console.warn(ansi_1.colors.yellow(`[WARN] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            this.beforeWrite?.();
+            console.warn(ansi_1.colors.yellow(this.format('[WARN] ', message)), ...args.map((a) => this.maskArg(a)));
         }
     }
     error(message, ...args) {
         if (this.level <= LogLevel.ERROR) {
-            console.error(ansi_1.colors.red(`[ERROR] ${this.mask(message)}`), ...args.map((a) => this.maskArg(a)));
+            this.beforeWrite?.();
+            console.error(ansi_1.colors.red(this.format('[ERROR] ', message)), ...args.map((a) => this.maskArg(a)));
         }
     }
     step(message) {
-        console.log(ansi_1.colors.cyan(`\n→ ${this.mask(message)}`));
+        this.beforeWrite?.();
+        console.log(ansi_1.colors.cyan(`\n${this.format('→ ', message)}`));
     }
     result(message, success) {
         const icon = success ? '✓' : '✗';
         const color = success ? ansi_1.colors.green : ansi_1.colors.red;
-        console.log(color(`${icon} ${this.mask(message)}`));
+        this.beforeWrite?.();
+        console.log(color(this.format(`${icon} `, message)));
     }
 }
 exports.logger = new Logger();

package/dist/utils/progress.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Progress = void 0;
+const logger_1 = require("./logger");
+const CLEAR_LINE = '\r\x1b[K';
+/**
+ * Progress for a slow phase, e.g. resolving actions over the network. On a
+ * terminal it updates one line in place (`Label [3/10] item`); elsewhere
+ * (CI logs) it prints a line per item. The total can grow as work is found.
+ */
+class Progress {
+    constructor(label, total, out = process.stderr) {
+        this.label = label;
+        this.total = total;
+        this.out = out;
+        this.count = 0;
+        this.drawn = false;
+        this.tty = !!out.isTTY;
+        // A log line would otherwise be appended to the half-drawn line.
+        if (this.tty)
+            logger_1.logger.setBeforeWrite(() => this.clear());
+    }
+    /** More items were found to process. */
+    grow(n = 1) {
+        this.total += n;
+    }
+    tick(item) {
+        this.count++;
+        if (this.count > this.total)
+            this.total = this.count;
+        const line = `${this.label} [${this.count}/${this.total}] ${item}`;
+        if (this.tty) {
+            this.out.write(CLEAR_LINE + line);
+            this.drawn = true;
+        }
+        else {
+            this.out.write(line + '\n');
+        }
+    }
+    /** End the phase, leaving `summary` (if any work was done). */
+    done(summary) {
+        if (this.tty)
+            logger_1.logger.setBeforeWrite(undefined);
+        if (this.count === 0)
+            return;
+        this.clear();
+        if (summary)
+            this.out.write(summary + '\n');
+    }
+    clear() {
+        if (this.drawn) {
+            this.out.write(CLEAR_LINE);
+            this.drawn = false;
+        }
+    }
+}
+exports.Progress = Progress;
+//# sourceMappingURL=progress.js.map

package/dist/version.js

@@ -0,0 +1,56 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readVersion = readVersion;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const EMBEDDED_VERSION = typeof __SECURECI_VERSION__ === 'string' ? __SECURECI_VERSION__ : undefined;
+/**
+ * The CLI's version: embedded at bundle time in the standalone binary (where
+ * package.json isn't on disk), else read from the package.json next to
+ * `dist/`, else `0.0.0`.
+ */
+function readVersion({ embedded = EMBEDDED_VERSION, packageDir = path.join(__dirname, '..') } = {}) {
+    if (embedded)
+        return embedded;
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.join(packageDir, 'package.json'), 'utf-8'));
+        return String(pkg.version);
+    }
+    catch {
+        return '0.0.0';
+    }
+}
+//# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureci/cli",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "SecureCI: validate, check against pipeline standards, and run GitHub Actions workflows locally",
   "main": "dist/index.js",
   "bin": {
@@ -14,6 +14,7 @@
   ],
   "scripts": {
     "build": "tsc",
+    "build:sea": "node scripts/build-sea.mjs",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
@@ -69,6 +70,7 @@
     "@typescript-eslint/parser": "^8.71.1",
     "@vitest/coverage-v8": "^4.1.11",
     "eslint": "^8.56.0",
+    "postject": "1.0.0-alpha.6",
     "typescript": "^5.3.3",
     "vitest": "^4.1.11"
   },