@secureci/cli 1.0.0 → 1.1.0

package/dist/runner/expression.js

@@ -6,6 +6,7 @@ exports.substituteExpressions = substituteExpressions;
 exports.substituteRecord = substituteRecord;
 exports.withImplicitSuccess = withImplicitSuccess;
 exports.evaluateCondition = evaluateCondition;
+exports.staticCondition = staticCondition;
 exports.ifEvaluationError = ifEvaluationError;
 exports.validateExpression = validateExpression;
 exports.expressionDataFlow = expressionDataFlow;
@@ -388,16 +389,46 @@ function callFunction(name, rawArgs, ctx) {
 }
 /** The `*` filter in `x.*` / `x[*]`, as opposed to a `'*'` key. */
 const STAR = Symbol('*');
+/**
+ * A value static evaluation (`staticCondition`) doesn't know, with its
+ * truthiness when that is known anyway (`unknown || true` is truthy).
+ */
+class Unknown {
+    constructor(truthy) {
+        this.truthy = truthy;
+    }
+}
+/** Contexts an expression may name; static evaluation knows only some. */
+const NAMED_CONTEXTS = new Set([
+    'env',
+    'inputs',
+    'secrets',
+    'steps',
+    'github',
+    'matrix',
+    'needs',
+    'job',
+    'runner',
+    'vars',
+    'strategy'
+]);
+/** Truthiness of a (possibly Unknown) value; undefined when unknown. */
+function truthOf(value) {
+    return value instanceof Unknown ? value.truthy : toBoolean(unwrap(value));
+}
 class Parser {
     /**
      * With a scope, only check names and syntax; with `flow`, compute data
      * flow (Flow values) instead. Either way nothing is evaluated.
      */
-    constructor(tokens, ctx, scope, flow = false) {
+    constructor(tokens, ctx, scope, flow = false, 
+    /** Static evaluation: only these contexts are known (see Unknown). */
+    known) {
         this.tokens = tokens;
         this.ctx = ctx;
         this.scope = scope;
         this.flow = flow;
+        this.known = known;
         this.pos = 0;
     }
     peek() {
@@ -429,6 +460,16 @@ class Parser {
         while (this.isOp('||')) {
             this.next();
             const right = this.parseAnd();
+            if (this.known) {
+                const l = truthOf(left);
+                left =
+                    l === true
+                        ? left
+                        : l === false
+                            ? right
+                            : new Unknown(truthOf(right) === true ? true : undefined);
+                continue;
+            }
             left = this.flow
                 ? Flow.union(left, right)
                 : toBoolean(unwrap(left))
@@ -442,6 +483,16 @@ class Parser {
         while (this.isOp('&&')) {
             this.next();
             const right = this.parseEquality();
+            if (this.known) {
+                const l = truthOf(left);
+                left =
+                    l === false
+                        ? left
+                        : l === true
+                            ? right
+                            : new Unknown(truthOf(right) === false ? false : undefined);
+                continue;
+            }
             left = this.flow
                 ? Flow.union(left, right)
                 : toBoolean(unwrap(left))
@@ -455,6 +506,10 @@ class Parser {
         while (this.isOp('==', '!=')) {
             const op = this.next().value;
             const right = this.parseComparison();
+            if (left instanceof Unknown || right instanceof Unknown) {
+                left = new Unknown();
+                continue;
+            }
             const eq = looseEquals(unwrap(left), unwrap(right));
             left = op === '==' ? eq : !eq;
         }
@@ -465,6 +520,10 @@ class Parser {
         while (this.isOp('<', '<=', '>', '>=')) {
             const op = this.next().value;
             const right = this.parseUnary();
+            if (left instanceof Unknown || right instanceof Unknown) {
+                left = new Unknown();
+                continue;
+            }
             const c = compare(unwrap(left), unwrap(right));
             left =
                 !Number.isNaN(c) &&
@@ -481,7 +540,11 @@ class Parser {
     parseUnary() {
         if (this.isOp('!')) {
             this.next();
-            return !toBoolean(unwrap(this.parseUnary()));
+            const operand = this.parseUnary();
+            if (operand instanceof Unknown) {
+                return new Unknown(operand.truthy === undefined ? undefined : !operand.truthy);
+            }
+            return !toBoolean(unwrap(operand));
         }
         return this.parsePostfix(this.parsePrimary());
     }
@@ -509,7 +572,12 @@ class Parser {
                 }
                 else {
                     const key = unwrap(this.parseOr());
-                    value = this.access(value, typeof key === 'number' || key instanceof Flow ? key : toText(key));
+                    value =
+                        key instanceof Unknown
+                            ? new Unknown()
+                            : this.access(value, typeof key === 'number' || key instanceof Flow
+                                ? key
+                                : toText(key));
                 }
                 this.expect('rbracket');
             }
@@ -526,6 +594,12 @@ class Parser {
             // `.*` and a computed key (`x[matrix.field]`) may be any key.
             return value.member(key === STAR || key instanceof Flow ? '*' : String(key).toLowerCase());
         }
+        if (this.known) {
+            if (value instanceof Unknown)
+                return new Unknown();
+            const result = key === STAR ? star(value) : member(value, key);
+            return result === undefined ? new Unknown() : result;
+        }
         if (key === STAR)
             return star(value);
         return member(value, key);
@@ -566,6 +640,8 @@ class Parser {
                     }
                     if (this.flow)
                         return flowCall(tok.value, args);
+                    if (this.known)
+                        return this.staticCall(tok.value, args);
                     return callFunction(tok.value, args, this.ctx);
                 }
                 if (this.scope) {
@@ -576,12 +652,34 @@ class Parser {
                 }
                 if (this.flow)
                     return new Flow([[lower]]);
+                if (this.known) {
+                    if (!NAMED_CONTEXTS.has(lower)) {
+                        throw new Error(`Unrecognized named-value: '${tok.value}'`);
+                    }
+                    return lower in this.known ? this.known[lower] : new Unknown();
+                }
                 return rootContext(lower, this.ctx);
             }
             default:
                 throw new Error(`Unexpected token: ${tok.type}`);
         }
     }
+    /**
+     * A function call in static evaluation: `success()` and `always()` hold
+     * for a step that runs at all; other status functions, `hashFiles` and
+     * calls with an unknown argument are unknown.
+     */
+    staticCall(name, args) {
+        checkCall(name, args.length);
+        const lower = name.toLowerCase();
+        if (lower === 'success' || lower === 'always')
+            return true;
+        if (['failure', 'cancelled', 'hashfiles'].includes(lower) ||
+            args.some((arg) => arg instanceof Unknown)) {
+            return new Unknown();
+        }
+        return callFunction(name, args, this.ctx);
+    }
 }
 function evaluate(expr, ctx) {
     return new Parser(tokenize(expr), ctx).parse();
@@ -670,6 +768,30 @@ function evaluateCondition(expr, ctx) {
     // it fails the step or job), never a condition that passes.
     return toBoolean(evaluate(trimmed, ctx));
 }
+/**
+ * Whether an `if:` holds when only the `known` contexts are known, e.g.
+ * `{ github: { event_name: 'push' } }`: true or false when that settles
+ * it, undefined when it depends on anything else (or can't be parsed).
+ * Used to check a contract without running the workflow.
+ */
+function staticCondition(expr, known) {
+    if (expr === undefined || typeof expr === 'boolean')
+        return expr ?? true;
+    let trimmed = expr.trim();
+    const wrapped = trimmed.match(/^\$\{\{([\s\S]*)\}\}$/);
+    if (wrapped)
+        trimmed = wrapped[1].trim();
+    if (trimmed === '')
+        return true;
+    try {
+        return truthOf(new Parser(tokenize(trimmed), createContext(), undefined, false, {
+            ...known
+        }).parse());
+    }
+    catch {
+        return undefined;
+    }
+}
 /** The error for an `if:` that couldn't be evaluated, worded like GitHub's. */
 function ifEvaluationError(target, error) {
     return `Error when evaluating 'if' for ${target}. ${error instanceof Error ? error.message : String(error)}`;

package/dist/runner/job-container.js

@@ -50,6 +50,13 @@ const expression_1 = require("./expression");
 const container_runtime_1 = require("./container-runtime");
 const shell_1 = require("./shell");
 const container_policy_1 = require("./container-policy");
+/**
+ * `jobs.<id>.container.options` the CLI sets on the job container itself:
+ * it idles with its own entrypoint and steps run in the mounted workspace.
+ */
+const JOB_CONTAINER_RESERVED = new Set(['--entrypoint', '--workdir', '-w']);
+/** Also reserved when `--container-memory-limit` caps the job container. */
+const MEMORY_OPTIONS = ['--memory', '-m', '--memory-swap'];
 /**
  * Image for jobs whose `runs-on` has no image mapping. Runner-like (Node.js,
  * git, curl and common tools), as used by nektos/act.
@@ -123,14 +130,6 @@ async function startJobContainer(job, ctx, options, runtime, runDir) {
         logger_1.logger.error(noRuntimeMessage(preference));
         return false;
     }
-    if (spec &&
-        'image' in spec &&
-        (('options' in spec && spec.options) ||
-            ('volumes' in spec && spec.volumes) ||
-            ('ports' in spec && spec.ports) ||
-            ('credentials' in spec && spec.credentials))) {
-        logger_1.logger.warn('jobs.<id>.container: only image and env are supported; ignoring options/volumes/ports/credentials.');
-    }
     // `container: ${{ inputs.image || null }}` that comes out empty means no
     // container image, as on GitHub: use the image for runs-on.
     const specImage = spec?.image
@@ -140,19 +139,25 @@ async function startJobContainer(job, ctx, options, runtime, runDir) {
         options.containerImage ||
         runnerImage(job?.['runs-on'], ctx, options);
     const containerEnv = (0, expression_1.substituteRecord)(specImage && spec && 'env' in spec ? spec.env : undefined, ctx);
+    const extras = specImage && spec
+        ? jobContainerExtras(spec, ctx, options, runtime.workspace)
+        : {};
+    if (!extras)
+        return false;
     const exchangeDir = fs.mkdtempSync(path.join(runDir, 'container-'));
     fs.chmodSync(exchangeDir, 0o777);
     fs.copyFileSync(runtime.eventPath, path.join(exchangeDir, 'event.json'));
     logger_1.logger.info(`Starting job container: ${image} (${containerRuntime.name})`);
     const started = await containerRuntime.start({
         image,
-        workingDir: process.cwd(),
+        workingDir: runtime.workspace,
         readOnlyPaths: protectedWorkspacePaths(options),
         exchangeDir,
         env: containerEnv,
         memoryLimit: options.containerMemoryLimit,
         networkDisabled: options.networkDisabled === true,
-        network: runtime.services?.network
+        network: runtime.services?.network,
+        ...extras
     });
     if (!started.success || !started.id) {
         logger_1.logger.error(`Failed to start job container (${image}): ${started.error}`);
@@ -173,6 +178,47 @@ async function startJobContainer(job, ctx, options, runtime, runDir) {
     activeContainers.add(runtime.container);
     return true;
 }
+/**
+ * The `options`, `ports` and `volumes` of `jobs.<id>.container`, checked
+ * with the same policy as service containers: options and host mounts that
+ * would reach this machine are refused (undefined: the job fails), options
+ * the CLI sets itself are dropped with a warning.
+ */
+function jobContainerExtras(spec, ctx, options, workspace) {
+    const label = `jobs.${ctx.github.job ?? '<id>'}.container`;
+    const args = spec.options
+        ? (0, shell_1.splitArgs)((0, expression_1.substituteExpressions)(spec.options, ctx))
+        : [];
+    const unsafe = (0, container_policy_1.unsafeServiceOptions)(args);
+    if (unsafe.length > 0) {
+        logger_1.logger.error(`${label}: refusing unsafe options ${[...new Set(unsafe)].join(', ')}: they would give the container access to this machine.`);
+        return undefined;
+    }
+    const reserved = new Set([
+        ...JOB_CONTAINER_RESERVED,
+        ...(options.containerMemoryLimit ? MEMORY_OPTIONS : [])
+    ]);
+    const { kept, dropped } = (0, container_policy_1.splitReservedOptions)(args, reserved);
+    if (dropped.length > 0) {
+        logger_1.logger.warn(`${label}: ignoring options the CLI sets itself: ${[...new Set(dropped)].join(', ')}.`);
+    }
+    const volumes = (spec.volumes ?? []).map((v) => (0, expression_1.substituteExpressions)(v, ctx));
+    for (const volume of volumes) {
+        const reason = (0, container_policy_1.unsafeServiceVolumeReason)(volume, workspace);
+        if (reason) {
+            logger_1.logger.error(`${label}: ${reason}.`);
+            return undefined;
+        }
+    }
+    if (spec.credentials) {
+        logger_1.logger.warn(`${label}: credentials are ignored; log in with \`docker login\` instead.`);
+    }
+    return {
+        extraArgs: kept,
+        ports: (spec.ports ?? []).map((port) => (0, expression_1.substituteExpressions)(String(port), ctx)),
+        volumes
+    };
+}
 /**
  * The image for a job's `runs-on`: the first label with a mapping in
  * `runner-images` (or the built-in one), else the default image, with a
@@ -267,7 +313,7 @@ async function startJobServices(job, ctx, options, runtime) {
             return false;
         }
         for (const volume of volumes) {
-            const reason = (0, container_policy_1.unsafeServiceVolumeReason)(volume, process.cwd());
+            const reason = (0, container_policy_1.unsafeServiceVolumeReason)(volume, runtime.workspace);
             if (reason) {
                 logger_1.logger.error(`services.${serviceId}: ${reason}.`);
                 return false;

package/dist/runner/job-runtime.js

@@ -107,7 +107,7 @@ function runnerContext(runtime) {
     return {
         name: 'secureci',
         os: runtime.runnerEnv.RUNNER_OS,
-        arch: process.arch === 'arm64' ? 'ARM64' : 'X64',
+        arch: runtime.runnerEnv.RUNNER_ARCH,
         temp: runtime.runnerEnv.RUNNER_TEMP,
         tool_cache: runtime.runnerEnv.RUNNER_TOOL_CACHE
     };
@@ -126,12 +126,13 @@ function hostHasBash() {
     }
     return hostBash;
 }
-function createJobRuntime(github, runDir, defaults = {}) {
+function createJobRuntime(github, runDir, defaults = {}, workspace = process.cwd()) {
     const homeDir = process.env.HOME || process.env.USERPROFILE || os.tmpdir();
     const eventPath = path.join(runDir, 'event.json');
     return {
+        workspace,
         runnerEnv: (0, runner_env_1.buildRunnerEnv)(github, {
-            workspace: process.cwd(),
+            workspace,
             eventPath,
             // Per job, so concurrent jobs don't share $RUNNER_TEMP.
             tempDir: fs.mkdtempSync(path.join(runDir, 'tmp-')),

package/dist/runner/node-action.js

@@ -144,7 +144,7 @@ async function executeNodeAction(action, actionPath, step, actionInputs, callerC
         }
         try {
             const { stdout, stderr } = await execFileAsync(node.path, [path.join(actionDir, script)], {
-                cwd: process.cwd(),
+                cwd: runtime.workspace,
                 maxBuffer: 64 * 1024 * 1024,
                 timeout: limit.ms,
                 killSignal: 'SIGKILL',

package/dist/runner/runner-env.js

@@ -38,6 +38,7 @@ exports.createStepFiles = createStepFiles;
 exports.readStepFiles = readStepFiles;
 exports.cleanupStepFiles = cleanupStepFiles;
 exports.processWorkflowCommands = processWorkflowCommands;
+exports.runnerArch = runnerArch;
 exports.buildRunnerEnv = buildRunnerEnv;
 exports.prependPath = prependPath;
 exports.hostBaseEnv = hostBaseEnv;
@@ -248,6 +249,24 @@ function runnerOs() {
             return 'Linux';
     }
 }
+/**
+ * `RUNNER_ARCH` / `runner.arch` for a Node.js architecture, using GitHub's
+ * values (X86, X64, ARM, ARM64). Jobs run natively (a job container has the
+ * host's architecture), so the host's is the runner's. Anything else reports
+ * X64, as before this was mapped.
+ */
+function runnerArch(arch = process.arch) {
+    switch (arch) {
+        case 'arm64':
+            return 'ARM64';
+        case 'arm':
+            return 'ARM';
+        case 'ia32':
+            return 'X86';
+        default:
+            return 'X64';
+    }
+}
 /**
  * The default environment variables GitHub's runner exports to every step,
  * derived from the (local, best-effort) `github` context.
@@ -274,6 +293,7 @@ function buildRunnerEnv(github, options) {
         GITHUB_WORKSPACE: options.workspace,
         GITHUB_EVENT_PATH: options.eventPath,
         RUNNER_OS: runnerOs(),
+        RUNNER_ARCH: runnerArch(),
         RUNNER_TEMP: options.tempDir,
         RUNNER_TOOL_CACHE: options.toolCache
     };

package/dist/runner/steps.js

@@ -143,8 +143,8 @@ async function executeStep(step, options, runtime, ctx) {
                     timeout: limit.ms,
                     killSignal: 'SIGKILL',
                     cwd: workingDirectory
-                        ? path.resolve(process.cwd(), workingDirectory)
-                        : process.cwd(),
+                        ? path.resolve(runtime.workspace, workingDirectory)
+                        : runtime.workspace,
                     env: {
                         ...(0, runner_env_1.hostBaseEnv)(),
                         ...runtime.runnerEnv,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@secureci/cli",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "SecureCI: validate, check against pipeline standards, and run GitHub Actions workflows locally",
   "main": "dist/index.js",
   "bin": {