@secureci/cli 1.0.1 → 1.1.0

package/dist/runner/checkout.js

@@ -34,10 +34,13 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.copyWorkingCopy = copyWorkingCopy;
+exports.createIsolatedWorkspace = createIsolatedWorkspace;
+exports.removeIsolatedWorkspace = removeIsolatedWorkspace;
 exports.isLocalCheckout = isLocalCheckout;
 exports.localCheckout = localCheckout;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
 const logger_1 = require("../utils/logger");
 const expression_1 = require("./expression");
 /** Marks a `path:` copy made by localCheckout, so it may be replaced. */
@@ -64,10 +67,34 @@ function copyWorkingCopy(srcDir, dstDir, exclude) {
         fs.cpSync(src, dst, {
             recursive: true,
             verbatimSymlinks: true,
+            // Copy-on-write clones where the file system supports them.
+            mode: fs.constants.COPYFILE_FICLONE,
             filter: (file) => !fs.existsSync(path.join(file, CHECKOUT_MARKER))
         });
     }
 }
+/**
+ * A copy of the working copy (uncommitted changes and .git included) for
+ * one job, in `parentDir`, for --isolate-workspace. Remove it with
+ * removeIsolatedWorkspace.
+ */
+function createIsolatedWorkspace(workingCopy, parentDir) {
+    const dir = fs.mkdtempSync(path.join(parentDir, 'workspace-'));
+    copyWorkingCopy(workingCopy, dir, dir);
+    return dir;
+}
+/**
+ * Remove a job's isolated workspace. Best effort: files a container step
+ * created as another user may not be removable, which is only warned about.
+ */
+function removeIsolatedWorkspace(dir) {
+    try {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    catch (error) {
+        logger_1.logger.warn(`Couldn't remove the job's workspace copy ${dir}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 /**
  * Whether a step is `actions/checkout` of the repository being run (no
  * `repository:` input, or the current one in any case), which is served
@@ -101,6 +128,54 @@ function escapesViaSymlink(workspace, dest) {
     const real = fs.realpathSync(existing);
     return real !== root && !real.startsWith(root + path.sep);
 }
+/** Run git in `cwd` on the host; undefined when it fails. */
+function gitOutput(cwd, args) {
+    try {
+        return (0, child_process_1.execFileSync)('git', args, {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore']
+        }).trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The commit `ref` names in the local repository (as given, else as a
+ * branch of `origin`), or undefined. A ref that looks like an option is
+ * never passed to git.
+ */
+function resolveLocalRef(workspace, ref) {
+    if (ref.startsWith('-'))
+        return undefined;
+    for (const candidate of [ref, `refs/remotes/origin/${ref}`]) {
+        const sha = gitOutput(workspace, [
+            'rev-parse',
+            '--verify',
+            '--quiet',
+            '--end-of-options',
+            `${candidate}^{commit}`
+        ]);
+        if (sha)
+            return sha;
+    }
+    return undefined;
+}
+/**
+ * Submodules of the working copy that aren't initialized (`git submodule
+ * status` marks them with "-"), by path.
+ */
+function uninitializedSubmodules(workspace) {
+    if (!fs.existsSync(path.join(workspace, '.gitmodules')))
+        return [];
+    const status = gitOutput(workspace, ['submodule', 'status', '--recursive']);
+    return (status ?? '')
+        .split('\n')
+        .filter((line) => line.startsWith('-'))
+        .map((line) => line.slice(1).split(' ')[1])
+        .filter(Boolean);
+}
 function localCheckout(step, ctx, runtime, startTime) {
     const withValues = (0, expression_1.substituteRecord)(step.with, ctx);
     const outputs = {
@@ -111,12 +186,7 @@ function localCheckout(step, ctx, runtime, startTime) {
         logger_1.logger.error(error);
         return { step, success: false, error, duration: Date.now() - startTime };
     };
-    const ref = withValues.ref;
-    if (ref &&
-        ![ctx.github.ref, ctx.github.ref_name, ctx.github.sha].includes(ref)) {
-        logger_1.logger.warn(`actions/checkout: ignoring ref "${ref}"; using the local working copy (pass --no-local-checkout to run the real action)`);
-    }
-    const workspace = process.cwd();
+    const workspace = runtime.workspace;
     const dest = path.resolve(workspace, withValues.path || '.');
     const relative = path.relative(workspace, dest);
     if (relative.startsWith('..') ||
@@ -124,6 +194,28 @@ function localCheckout(step, ctx, runtime, startTime) {
         escapesViaSymlink(workspace, dest)) {
         return fail(`actions/checkout: path "${withValues.path}" is outside the workspace`);
     }
+    // A ref other than the current one: check out that commit, when the local
+    // repository has it, into path: (never over the user's working copy).
+    const ref = withValues.ref;
+    let commit;
+    if (ref &&
+        ![ctx.github.ref, ctx.github.ref_name, ctx.github.sha].includes(ref)) {
+        commit = resolveLocalRef(workspace, ref);
+        if (!commit) {
+            logger_1.logger.warn(`actions/checkout: ref "${ref}" isn't in the local repository; using the local working copy (fetch it, or pass --no-local-checkout to run the real action)`);
+        }
+        else if (relative === '') {
+            logger_1.logger.warn(`actions/checkout: not checking out ref "${ref}" over your working copy; add a path: to check it out there, or pass --no-local-checkout to run the real action`);
+            commit = undefined;
+        }
+    }
+    const submodules = String(withValues.submodules ?? '').toLowerCase();
+    if (submodules === 'true' || submodules === 'recursive') {
+        const missing = uninitializedSubmodules(workspace);
+        if (missing.length > 0) {
+            logger_1.logger.warn(`actions/checkout: submodules aren't initialized in your working copy (${missing.join(', ')}); run \`git submodule update --init --recursive\` first`);
+        }
+    }
     let output = 'Using local working copy';
     if (relative !== '') {
         if (fs.existsSync(dest)) {
@@ -134,9 +226,33 @@ function localCheckout(step, ctx, runtime, startTime) {
                 return fail(`actions/checkout: path "${withValues.path}" already exists in the working copy; remove it or pass --no-local-checkout`);
             }
         }
-        copyWorkingCopy(workspace, dest, dest);
+        if (commit) {
+            // A local clone, sharing the repository's objects: nothing is fetched
+            // and the working copy's .git is only read.
+            const cloned = gitOutput(workspace, [
+                'clone',
+                '--quiet',
+                '--shared',
+                '--no-checkout',
+                '--',
+                workspace,
+                dest
+            ]) !== undefined &&
+                gitOutput(dest, ['checkout', '--quiet', '--detach', commit]) !==
+                    undefined;
+            if (!cloned) {
+                fs.rmSync(dest, { recursive: true, force: true });
+                return fail(`actions/checkout: couldn't check out ref "${ref}" to "${withValues.path}"`);
+            }
+            outputs.ref = String(ref);
+            outputs.commit = commit;
+            output = `Checked out ${ref} (${commit.slice(0, 7)}) to ${relative}`;
+        }
+        else {
+            copyWorkingCopy(workspace, dest, dest);
+            output = `Using local working copy (copied to ${relative})`;
+        }
         fs.writeFileSync(path.join(dest, CHECKOUT_MARKER), '');
-        output = `Using local working copy (copied to ${relative})`;
         const postStep = { name: `Post ${step.name || step.uses}` };
         runtime.postSteps.push({
             step: postStep,

package/dist/runner/container-policy.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.invalidImageReason = invalidImageReason;
 exports.unsafeServiceOptions = unsafeServiceOptions;
+exports.splitReservedOptions = splitReservedOptions;
 exports.unsafeServiceVolumeReason = unsafeServiceVolumeReason;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -125,6 +126,37 @@ function unsafeServiceOptions(args) {
     }
     return found;
 }
+/**
+ * Split `args` into the options to pass on and the `reserved` ones (by
+ * flag name, in order), dropping a reserved option's value too. Values of
+ * other options are kept as they are, so `--health-cmd --entrypoint` stays.
+ */
+function splitReservedOptions(args, reserved) {
+    const kept = [];
+    const dropped = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        let name;
+        let takesNext = false;
+        if (arg.startsWith('--')) {
+            const [flag, value] = arg.split(/=(.*)/s);
+            name = flag;
+            takesNext = value === undefined && VALUE_OPTIONS.has(flag);
+        }
+        else if (arg.startsWith('-') && arg.length > 1) {
+            name = arg.slice(0, 2);
+            takesNext = arg.length === 2 && SHORT_VALUE_OPTIONS.has(name);
+        }
+        const span = takesNext ? args.slice(i, i + 2) : [arg];
+        if (name !== undefined && reserved.has(name))
+            dropped.push(name);
+        else
+            kept.push(...span);
+        if (takesNext)
+            i++;
+    }
+    return { kept, dropped };
+}
 const VOLUME_NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
 function realpathOrSelf(p) {
     try {

package/dist/runner/docker-action.js

@@ -131,7 +131,7 @@ async function executeDockerAction(action, actionPath, step, actionInputs, calle
             image,
             args,
             entrypoint: action.runs.entrypoint,
-            workingDir: process.cwd(),
+            workingDir: runtime.workspace,
             readOnlyPaths: (0, job_container_1.protectedWorkspacePaths)(options),
             exchangeDir,
             env: {

package/dist/runner/executor.js

@@ -49,6 +49,7 @@ const job_plan_1 = require("./job-plan");
 const job_runtime_1 = require("./job-runtime");
 const job_container_1 = require("./job-container");
 const steps_1 = require("./steps");
+const checkout_1 = require("./checkout");
 const actions_1 = require("./actions");
 const scheduler_1 = require("./scheduler");
 // Public API, kept here so `executor` stays the entry point.
@@ -161,6 +162,15 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                 return { success: false, jobs: [], duration: Date.now() - startTime };
             }
             logger_1.logger.info(`Executing workflow: ${parsed.file.name}`);
+            const concurrencyAt = [
+                ...(parsed.file.concurrency ? ['workflow'] : []),
+                ...Object.entries(parsed.file.jobs)
+                    .filter(([, job]) => job.concurrency)
+                    .map(([id]) => `jobs.${id}`)
+            ];
+            if (concurrencyAt.length > 0) {
+                logger_1.logger.info(`concurrency: isn't applied in a local run (${concurrencyAt.join(', ')}): it doesn't queue behind or cancel other runs, and jobs run as needs: and --parallel allow`);
+            }
             options = {
                 ...options,
                 inputs: {
@@ -291,11 +301,20 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                     // its running step killed and its containers removed.
                     const runCombination = async (jobIndex, matrixValues, signal) => {
                         const jobLabel = labelOf(matrixValues);
-                        const runtime = (0, job_runtime_1.createJobRuntime)(github, runDir, {
-                            shell: job.defaults?.run?.shell ?? parsed.file.defaults?.run?.shell,
+                        // With --isolate-workspace, the job (and github.workspace) gets
+                        // its own copy of the working copy.
+                        const workspace = options.isolateWorkspace
+                            ? (0, checkout_1.createIsolatedWorkspace)(process.cwd(), runDir)
+                            : process.cwd();
+                        const comboGithub = options.isolateWorkspace
+                            ? { ...github, workspace }
+                            : github;
+                        const runtime = (0, job_runtime_1.createJobRuntime)(comboGithub, runDir, {
+                            shell: job.defaults?.run?.shell ??
+                                parsed.file.defaults?.run?.shell,
                             workingDirectory: job.defaults?.run?.['working-directory'] ??
                                 parsed.file.defaults?.run?.['working-directory']
-                        });
+                        }, workspace);
                         runtime.signal = signal;
                         // Workflow-level env can't reference `env` itself; job-level
                         // env sees the workflow env plus matrix (matching GitHub's
@@ -303,17 +322,17 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                         const workflowEnv = {
                             ...options.env,
                             ...(0, expression_1.substituteRecord)(parsed.file.env, {
-                                ...(0, expression_1.createContext)({ ...options.env }, inputs, options.secrets, github),
+                                ...(0, expression_1.createContext)({ ...options.env }, inputs, options.secrets, comboGithub),
                                 vars
                             })
                         };
                         const jobEnv = (0, expression_1.substituteRecord)(job.env, {
-                            ...(0, expression_1.createContext)(workflowEnv, inputs, options.secrets, github, matrixValues),
+                            ...(0, expression_1.createContext)(workflowEnv, inputs, options.secrets, comboGithub, matrixValues),
                             needs,
                             vars
                         });
                         const jobCtx = {
-                            ...(0, expression_1.createContext)({ ...workflowEnv, ...jobEnv }, inputs, options.secrets, github, matrixValues),
+                            ...(0, expression_1.createContext)({ ...workflowEnv, ...jobEnv }, inputs, options.secrets, comboGithub, matrixValues),
                             needs,
                             vars,
                             job: { status: 'success' },
@@ -526,6 +545,9 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                         }
                         finally {
                             await stopping;
+                            if (options.isolateWorkspace) {
+                                (0, checkout_1.removeIsolatedWorkspace)(workspace);
+                            }
                         }
                         const jobSuccess = stepResults.every((s) => s.success || s.step['continue-on-error']);
                         // Job-level continue-on-error (often

package/dist/runner/expression.js

@@ -6,6 +6,7 @@ exports.substituteExpressions = substituteExpressions;
 exports.substituteRecord = substituteRecord;
 exports.withImplicitSuccess = withImplicitSuccess;
 exports.evaluateCondition = evaluateCondition;
+exports.staticCondition = staticCondition;
 exports.ifEvaluationError = ifEvaluationError;
 exports.validateExpression = validateExpression;
 exports.expressionDataFlow = expressionDataFlow;
@@ -388,16 +389,46 @@ function callFunction(name, rawArgs, ctx) {
 }
 /** The `*` filter in `x.*` / `x[*]`, as opposed to a `'*'` key. */
 const STAR = Symbol('*');
+/**
+ * A value static evaluation (`staticCondition`) doesn't know, with its
+ * truthiness when that is known anyway (`unknown || true` is truthy).
+ */
+class Unknown {
+    constructor(truthy) {
+        this.truthy = truthy;
+    }
+}
+/** Contexts an expression may name; static evaluation knows only some. */
+const NAMED_CONTEXTS = new Set([
+    'env',
+    'inputs',
+    'secrets',
+    'steps',
+    'github',
+    'matrix',
+    'needs',
+    'job',
+    'runner',
+    'vars',
+    'strategy'
+]);
+/** Truthiness of a (possibly Unknown) value; undefined when unknown. */
+function truthOf(value) {
+    return value instanceof Unknown ? value.truthy : toBoolean(unwrap(value));
+}
 class Parser {
     /**
      * With a scope, only check names and syntax; with `flow`, compute data
      * flow (Flow values) instead. Either way nothing is evaluated.
      */
-    constructor(tokens, ctx, scope, flow = false) {
+    constructor(tokens, ctx, scope, flow = false, 
+    /** Static evaluation: only these contexts are known (see Unknown). */
+    known) {
         this.tokens = tokens;
         this.ctx = ctx;
         this.scope = scope;
         this.flow = flow;
+        this.known = known;
         this.pos = 0;
     }
     peek() {
@@ -429,6 +460,16 @@ class Parser {
         while (this.isOp('||')) {
             this.next();
             const right = this.parseAnd();
+            if (this.known) {
+                const l = truthOf(left);
+                left =
+                    l === true
+                        ? left
+                        : l === false
+                            ? right
+                            : new Unknown(truthOf(right) === true ? true : undefined);
+                continue;
+            }
             left = this.flow
                 ? Flow.union(left, right)
                 : toBoolean(unwrap(left))
@@ -442,6 +483,16 @@ class Parser {
         while (this.isOp('&&')) {
             this.next();
             const right = this.parseEquality();
+            if (this.known) {
+                const l = truthOf(left);
+                left =
+                    l === false
+                        ? left
+                        : l === true
+                            ? right
+                            : new Unknown(truthOf(right) === false ? false : undefined);
+                continue;
+            }
             left = this.flow
                 ? Flow.union(left, right)
                 : toBoolean(unwrap(left))
@@ -455,6 +506,10 @@ class Parser {
         while (this.isOp('==', '!=')) {
             const op = this.next().value;
             const right = this.parseComparison();
+            if (left instanceof Unknown || right instanceof Unknown) {
+                left = new Unknown();
+                continue;
+            }
             const eq = looseEquals(unwrap(left), unwrap(right));
             left = op === '==' ? eq : !eq;
         }
@@ -465,6 +520,10 @@ class Parser {
         while (this.isOp('<', '<=', '>', '>=')) {
             const op = this.next().value;
             const right = this.parseUnary();
+            if (left instanceof Unknown || right instanceof Unknown) {
+                left = new Unknown();
+                continue;
+            }
             const c = compare(unwrap(left), unwrap(right));
             left =
                 !Number.isNaN(c) &&
@@ -481,7 +540,11 @@ class Parser {
     parseUnary() {
         if (this.isOp('!')) {
             this.next();
-            return !toBoolean(unwrap(this.parseUnary()));
+            const operand = this.parseUnary();
+            if (operand instanceof Unknown) {
+                return new Unknown(operand.truthy === undefined ? undefined : !operand.truthy);
+            }
+            return !toBoolean(unwrap(operand));
         }
         return this.parsePostfix(this.parsePrimary());
     }
@@ -509,7 +572,12 @@ class Parser {
                 }
                 else {
                     const key = unwrap(this.parseOr());
-                    value = this.access(value, typeof key === 'number' || key instanceof Flow ? key : toText(key));
+                    value =
+                        key instanceof Unknown
+                            ? new Unknown()
+                            : this.access(value, typeof key === 'number' || key instanceof Flow
+                                ? key
+                                : toText(key));
                 }
                 this.expect('rbracket');
             }
@@ -526,6 +594,12 @@ class Parser {
             // `.*` and a computed key (`x[matrix.field]`) may be any key.
             return value.member(key === STAR || key instanceof Flow ? '*' : String(key).toLowerCase());
         }
+        if (this.known) {
+            if (value instanceof Unknown)
+                return new Unknown();
+            const result = key === STAR ? star(value) : member(value, key);
+            return result === undefined ? new Unknown() : result;
+        }
         if (key === STAR)
             return star(value);
         return member(value, key);
@@ -566,6 +640,8 @@ class Parser {
                     }
                     if (this.flow)
                         return flowCall(tok.value, args);
+                    if (this.known)
+                        return this.staticCall(tok.value, args);
                     return callFunction(tok.value, args, this.ctx);
                 }
                 if (this.scope) {
@@ -576,12 +652,34 @@ class Parser {
                 }
                 if (this.flow)
                     return new Flow([[lower]]);
+                if (this.known) {
+                    if (!NAMED_CONTEXTS.has(lower)) {
+                        throw new Error(`Unrecognized named-value: '${tok.value}'`);
+                    }
+                    return lower in this.known ? this.known[lower] : new Unknown();
+                }
                 return rootContext(lower, this.ctx);
             }
             default:
                 throw new Error(`Unexpected token: ${tok.type}`);
         }
     }
+    /**
+     * A function call in static evaluation: `success()` and `always()` hold
+     * for a step that runs at all; other status functions, `hashFiles` and
+     * calls with an unknown argument are unknown.
+     */
+    staticCall(name, args) {
+        checkCall(name, args.length);
+        const lower = name.toLowerCase();
+        if (lower === 'success' || lower === 'always')
+            return true;
+        if (['failure', 'cancelled', 'hashfiles'].includes(lower) ||
+            args.some((arg) => arg instanceof Unknown)) {
+            return new Unknown();
+        }
+        return callFunction(name, args, this.ctx);
+    }
 }
 function evaluate(expr, ctx) {
     return new Parser(tokenize(expr), ctx).parse();
@@ -670,6 +768,30 @@ function evaluateCondition(expr, ctx) {
     // it fails the step or job), never a condition that passes.
     return toBoolean(evaluate(trimmed, ctx));
 }
+/**
+ * Whether an `if:` holds when only the `known` contexts are known, e.g.
+ * `{ github: { event_name: 'push' } }`: true or false when that settles
+ * it, undefined when it depends on anything else (or can't be parsed).
+ * Used to check a contract without running the workflow.
+ */
+function staticCondition(expr, known) {
+    if (expr === undefined || typeof expr === 'boolean')
+        return expr ?? true;
+    let trimmed = expr.trim();
+    const wrapped = trimmed.match(/^\$\{\{([\s\S]*)\}\}$/);
+    if (wrapped)
+        trimmed = wrapped[1].trim();
+    if (trimmed === '')
+        return true;
+    try {
+        return truthOf(new Parser(tokenize(trimmed), createContext(), undefined, false, {
+            ...known
+        }).parse());
+    }
+    catch {
+        return undefined;
+    }
+}
 /** The error for an `if:` that couldn't be evaluated, worded like GitHub's. */
 function ifEvaluationError(target, error) {
     return `Error when evaluating 'if' for ${target}. ${error instanceof Error ? error.message : String(error)}`;

package/dist/runner/job-container.js

@@ -50,6 +50,13 @@ const expression_1 = require("./expression");
 const container_runtime_1 = require("./container-runtime");
 const shell_1 = require("./shell");
 const container_policy_1 = require("./container-policy");
+/**
+ * `jobs.<id>.container.options` the CLI sets on the job container itself:
+ * it idles with its own entrypoint and steps run in the mounted workspace.
+ */
+const JOB_CONTAINER_RESERVED = new Set(['--entrypoint', '--workdir', '-w']);
+/** Also reserved when `--container-memory-limit` caps the job container. */
+const MEMORY_OPTIONS = ['--memory', '-m', '--memory-swap'];
 /**
  * Image for jobs whose `runs-on` has no image mapping. Runner-like (Node.js,
  * git, curl and common tools), as used by nektos/act.
@@ -123,14 +130,6 @@ async function startJobContainer(job, ctx, options, runtime, runDir) {
         logger_1.logger.error(noRuntimeMessage(preference));
         return false;
     }
-    if (spec &&
-        'image' in spec &&
-        (('options' in spec && spec.options) ||
-            ('volumes' in spec && spec.volumes) ||
-            ('ports' in spec && spec.ports) ||
-            ('credentials' in spec && spec.credentials))) {
-        logger_1.logger.warn('jobs.<id>.container: only image and env are supported; ignoring options/volumes/ports/credentials.');
-    }
     // `container: ${{ inputs.image || null }}` that comes out empty means no
     // container image, as on GitHub: use the image for runs-on.
     const specImage = spec?.image
@@ -140,19 +139,25 @@ async function startJobContainer(job, ctx, options, runtime, runDir) {
         options.containerImage ||
         runnerImage(job?.['runs-on'], ctx, options);
     const containerEnv = (0, expression_1.substituteRecord)(specImage && spec && 'env' in spec ? spec.env : undefined, ctx);
+    const extras = specImage && spec
+        ? jobContainerExtras(spec, ctx, options, runtime.workspace)
+        : {};
+    if (!extras)
+        return false;
     const exchangeDir = fs.mkdtempSync(path.join(runDir, 'container-'));
     fs.chmodSync(exchangeDir, 0o777);
     fs.copyFileSync(runtime.eventPath, path.join(exchangeDir, 'event.json'));
     logger_1.logger.info(`Starting job container: ${image} (${containerRuntime.name})`);
     const started = await containerRuntime.start({
         image,
-        workingDir: process.cwd(),
+        workingDir: runtime.workspace,
         readOnlyPaths: protectedWorkspacePaths(options),
         exchangeDir,
         env: containerEnv,
         memoryLimit: options.containerMemoryLimit,
         networkDisabled: options.networkDisabled === true,
-        network: runtime.services?.network
+        network: runtime.services?.network,
+        ...extras
     });
     if (!started.success || !started.id) {
         logger_1.logger.error(`Failed to start job container (${image}): ${started.error}`);
@@ -173,6 +178,47 @@ async function startJobContainer(job, ctx, options, runtime, runDir) {
     activeContainers.add(runtime.container);
     return true;
 }
+/**
+ * The `options`, `ports` and `volumes` of `jobs.<id>.container`, checked
+ * with the same policy as service containers: options and host mounts that
+ * would reach this machine are refused (undefined: the job fails), options
+ * the CLI sets itself are dropped with a warning.
+ */
+function jobContainerExtras(spec, ctx, options, workspace) {
+    const label = `jobs.${ctx.github.job ?? '<id>'}.container`;
+    const args = spec.options
+        ? (0, shell_1.splitArgs)((0, expression_1.substituteExpressions)(spec.options, ctx))
+        : [];
+    const unsafe = (0, container_policy_1.unsafeServiceOptions)(args);
+    if (unsafe.length > 0) {
+        logger_1.logger.error(`${label}: refusing unsafe options ${[...new Set(unsafe)].join(', ')}: they would give the container access to this machine.`);
+        return undefined;
+    }
+    const reserved = new Set([
+        ...JOB_CONTAINER_RESERVED,
+        ...(options.containerMemoryLimit ? MEMORY_OPTIONS : [])
+    ]);
+    const { kept, dropped } = (0, container_policy_1.splitReservedOptions)(args, reserved);
+    if (dropped.length > 0) {
+        logger_1.logger.warn(`${label}: ignoring options the CLI sets itself: ${[...new Set(dropped)].join(', ')}.`);
+    }
+    const volumes = (spec.volumes ?? []).map((v) => (0, expression_1.substituteExpressions)(v, ctx));
+    for (const volume of volumes) {
+        const reason = (0, container_policy_1.unsafeServiceVolumeReason)(volume, workspace);
+        if (reason) {
+            logger_1.logger.error(`${label}: ${reason}.`);
+            return undefined;
+        }
+    }
+    if (spec.credentials) {
+        logger_1.logger.warn(`${label}: credentials are ignored; log in with \`docker login\` instead.`);
+    }
+    return {
+        extraArgs: kept,
+        ports: (spec.ports ?? []).map((port) => (0, expression_1.substituteExpressions)(String(port), ctx)),
+        volumes
+    };
+}
 /**
  * The image for a job's `runs-on`: the first label with a mapping in
  * `runner-images` (or the built-in one), else the default image, with a
@@ -267,7 +313,7 @@ async function startJobServices(job, ctx, options, runtime) {
             return false;
         }
         for (const volume of volumes) {
-            const reason = (0, container_policy_1.unsafeServiceVolumeReason)(volume, process.cwd());
+            const reason = (0, container_policy_1.unsafeServiceVolumeReason)(volume, runtime.workspace);
             if (reason) {
                 logger_1.logger.error(`services.${serviceId}: ${reason}.`);
                 return false;

package/dist/runner/job-runtime.js

@@ -107,7 +107,7 @@ function runnerContext(runtime) {
     return {
         name: 'secureci',
         os: runtime.runnerEnv.RUNNER_OS,
-        arch: process.arch === 'arm64' ? 'ARM64' : 'X64',
+        arch: runtime.runnerEnv.RUNNER_ARCH,
         temp: runtime.runnerEnv.RUNNER_TEMP,
         tool_cache: runtime.runnerEnv.RUNNER_TOOL_CACHE
     };
@@ -126,12 +126,13 @@ function hostHasBash() {
     }
     return hostBash;
 }
-function createJobRuntime(github, runDir, defaults = {}) {
+function createJobRuntime(github, runDir, defaults = {}, workspace = process.cwd()) {
     const homeDir = process.env.HOME || process.env.USERPROFILE || os.tmpdir();
     const eventPath = path.join(runDir, 'event.json');
     return {
+        workspace,
         runnerEnv: (0, runner_env_1.buildRunnerEnv)(github, {
-            workspace: process.cwd(),
+            workspace,
             eventPath,
             // Per job, so concurrent jobs don't share $RUNNER_TEMP.
             tempDir: fs.mkdtempSync(path.join(runDir, 'tmp-')),