@secureci/cli 1.0.1 → 1.2.0

package/dist/runner/container-policy.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.invalidImageReason = invalidImageReason;
 exports.unsafeServiceOptions = unsafeServiceOptions;
+exports.splitReservedOptions = splitReservedOptions;
 exports.unsafeServiceVolumeReason = unsafeServiceVolumeReason;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -125,6 +126,37 @@ function unsafeServiceOptions(args) {
     }
     return found;
 }
+/**
+ * Split `args` into the options to pass on and the `reserved` ones (by
+ * flag name, in order), dropping a reserved option's value too. Values of
+ * other options are kept as they are, so `--health-cmd --entrypoint` stays.
+ */
+function splitReservedOptions(args, reserved) {
+    const kept = [];
+    const dropped = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        let name;
+        let takesNext = false;
+        if (arg.startsWith('--')) {
+            const [flag, value] = arg.split(/=(.*)/s);
+            name = flag;
+            takesNext = value === undefined && VALUE_OPTIONS.has(flag);
+        }
+        else if (arg.startsWith('-') && arg.length > 1) {
+            name = arg.slice(0, 2);
+            takesNext = arg.length === 2 && SHORT_VALUE_OPTIONS.has(name);
+        }
+        const span = takesNext ? args.slice(i, i + 2) : [arg];
+        if (name !== undefined && reserved.has(name))
+            dropped.push(name);
+        else
+            kept.push(...span);
+        if (takesNext)
+            i++;
+    }
+    return { kept, dropped };
+}
 const VOLUME_NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
 function realpathOrSelf(p) {
     try {

package/dist/runner/container-runtime.js

@@ -34,6 +34,7 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CONTAINER_EXCHANGE_DIR = exports.CONTAINER_WORKDIR = void 0;
+exports.registryOf = registryOf;
 exports.resolveContainerRuntime = resolveContainerRuntime;
 exports._resetRuntimeCacheForTests = _resetRuntimeCacheForTests;
 const child_process_1 = require("child_process");
@@ -50,6 +51,18 @@ const RUNTIME_BINARIES = {
     podman: 'podman',
     containerd: 'nerdctl'
 };
+/**
+ * The registry an image reference pulls from: its first path component
+ * when that names a host (has a `.` or `:`, or is `localhost`), else
+ * Docker Hub.
+ */
+function registryOf(image) {
+    const slash = image.indexOf('/');
+    if (slash === -1)
+        return 'docker.io';
+    const first = image.slice(0, slash);
+    return /[.:]/.test(first) || first === 'localhost' ? first : 'docker.io';
+}
 exports.CONTAINER_WORKDIR = '/secureci-workspace';
 exports.CONTAINER_EXCHANGE_DIR = '/secureci-exchange';
 /**
@@ -232,6 +245,7 @@ class CliContainerRuntime {
             'exec',
             '-w',
             options.workingDir || exports.CONTAINER_WORKDIR,
+            ...(options.user ? ['-u', options.user] : []),
             ...env.args
         ];
         if (options.args) {
@@ -294,7 +308,64 @@ class CliContainerRuntime {
             // Best effort: the container may already be gone
         }
     }
-    runCli(args, timeoutMs, env) {
+    async pull(image, auth) {
+        const invalid = (0, container_policy_1.invalidImageReason)(image);
+        if (invalid)
+            return { success: false, error: invalid };
+        const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'secureci-auth-'));
+        fs.chmodSync(dir, 0o700);
+        try {
+            const clientEnv = { ...process.env };
+            if (this.name === 'podman') {
+                clientEnv.REGISTRY_AUTH_FILE = path.join(dir, 'auth.json');
+            }
+            else {
+                clientEnv.DOCKER_CONFIG = dir;
+                // A docker context lives in the user's config dir: pin its
+                // endpoint so the private config dir talks to the same engine.
+                if (this.name === 'docker' && !process.env.DOCKER_HOST) {
+                    const context = await this.runCli([
+                        'context',
+                        'inspect',
+                        '--format',
+                        '{{.Endpoints.docker.Host}}'
+                    ]);
+                    const host = context.stdout.trim();
+                    if (context.success && host)
+                        clientEnv.DOCKER_HOST = host;
+                }
+            }
+            const transport = {
+                args: [],
+                clientEnv,
+                cleanup: () => { }
+            };
+            const login = await this.runCli([
+                'login',
+                '--username',
+                auth.username,
+                '--password-stdin',
+                auth.registry
+            ], undefined, transport, auth.password);
+            if (!login.success) {
+                return {
+                    success: false,
+                    error: `login to ${auth.registry} failed: ${login.stderr.trim() || `exit code ${login.exitCode}`}`
+                };
+            }
+            const pulled = await this.runCli(['pull', image], undefined, transport);
+            return pulled.success
+                ? { success: true }
+                : {
+                    success: false,
+                    error: pulled.stderr.trim() || `exit code ${pulled.exitCode}`
+                };
+        }
+        finally {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+    }
+    runCli(args, timeoutMs, env, input) {
         const startTime = Date.now();
         return new Promise((resolve) => {
             let child;
@@ -305,6 +376,8 @@ class CliContainerRuntime {
                 env?.cleanup();
                 throw err;
             }
+            if (input !== undefined)
+                child.stdin.end(input);
             let stdout = '';
             let stderr = '';
             let timedOut = false;

package/dist/runner/docker-action.js

@@ -131,7 +131,7 @@ async function executeDockerAction(action, actionPath, step, actionInputs, calle
             image,
             args,
             entrypoint: action.runs.entrypoint,
-            workingDir: process.cwd(),
+            workingDir: runtime.workspace,
             readOnlyPaths: (0, job_container_1.protectedWorkspacePaths)(options),
             exchangeDir,
             env: {

package/dist/runner/executor.js

@@ -49,6 +49,7 @@ const job_plan_1 = require("./job-plan");
 const job_runtime_1 = require("./job-runtime");
 const job_container_1 = require("./job-container");
 const steps_1 = require("./steps");
+const checkout_1 = require("./checkout");
 const actions_1 = require("./actions");
 const scheduler_1 = require("./scheduler");
 // Public API, kept here so `executor` stays the entry point.
@@ -161,6 +162,20 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                 return { success: false, jobs: [], duration: Date.now() - startTime };
             }
             logger_1.logger.info(`Executing workflow: ${parsed.file.name}`);
+            const concurrencyMode = options.concurrency ?? 'serialize';
+            if (parsed.file.concurrency && !internal.groups) {
+                logger_1.logger.info("workflow-level concurrency: isn't applied in a local run: there are no other runs to queue behind or cancel");
+            }
+            const notCancelling = Object.entries(parsed.file.jobs)
+                .filter(([, job]) => typeof job.concurrency === 'object' &&
+                job.concurrency['cancel-in-progress'] !== undefined &&
+                job.concurrency['cancel-in-progress'] !== false)
+                .map(([id]) => `jobs.${id}`);
+            if (concurrencyMode === 'serialize' && notCancelling.length > 0) {
+                logger_1.logger.info(`cancel-in-progress isn't applied with --concurrency serialize (${notCancelling.join(', ')}): jobs in a group run one at a time, all of them; pass --concurrency github to cancel as GitHub does`);
+            }
+            const groups = internal.groups ??
+                new scheduler_1.ConcurrencyGroups(concurrencyMode, (message) => logger_1.logger.info(message));
             options = {
                 ...options,
                 inputs: {
@@ -258,6 +273,40 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                 // Each combination's result and outputs, by combination index.
                 const unitResults = [];
                 const unitOutputs = [];
+                // `concurrency:`: each combination waits for its group (with the
+                // group evaluated for its matrix values) before taking a slot.
+                const concurrencySpec = typeof job.concurrency === 'string'
+                    ? { group: job.concurrency }
+                    : job.concurrency;
+                const concurrencyGate = concurrencySpec
+                    ? {
+                        gate: (index, abort) => {
+                            const values = selected[index].values;
+                            const ctx = { ...jobIfCtx, matrix: values };
+                            let group = '';
+                            try {
+                                group = (0, expression_1.substituteExpressions)(String(concurrencySpec.group ?? ''), ctx).trim();
+                            }
+                            catch (error) {
+                                logger_1.logger.warn(`jobs.${jobId}.concurrency: ${error instanceof Error ? error.message : String(error)}; running without a group`);
+                            }
+                            if (!group)
+                                return Promise.resolve(() => undefined);
+                            return groups.enter(group, (0, job_plan_1.isTruthySetting)(concurrencySpec['cancel-in-progress'], ctx), abort, labelOf(values));
+                        },
+                        onGateCancelled: (index) => {
+                            const { index: combinationIndex, values } = selected[index];
+                            unitResults[combinationIndex] = {
+                                job: labelOf(values),
+                                success: false,
+                                cancelled: true,
+                                steps: [],
+                                duration: 0
+                            };
+                            return { result: 'cancelled' };
+                        }
+                    }
+                    : {};
                 let outcomes;
                 if (job.uses) {
                     // A reusable workflow call (once per matrix combination). The
@@ -266,7 +315,7 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                         const { index: combinationIndex, values: matrixValues } = selected[index];
                         const label = labelOf(matrixValues);
                         return tagged(label, async () => {
-                            const reusableResult = await executeReusableWorkflowJob(label, job, filePath, options, { ...jobIfCtx, matrix: matrixValues }, { slots, signal });
+                            const reusableResult = await executeReusableWorkflowJob(label, job, filePath, options, { ...jobIfCtx, matrix: matrixValues }, { slots, signal, groups });
                             const cancelled = !reusableResult.success && signal.aborted;
                             unitResults[combinationIndex] = cancelled
                                 ? { ...reusableResult, cancelled: true }
@@ -281,7 +330,12 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                                         : 'failure'
                             };
                         }, true);
-                    }, { failFast, maxParallel, signal: internal.signal });
+                    }, {
+                        failFast,
+                        maxParallel,
+                        signal: internal.signal,
+                        ...concurrencyGate
+                    });
                 }
                 else {
                     // Outputs so far, as each combination's result reports them.
@@ -291,11 +345,20 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                     // its running step killed and its containers removed.
                     const runCombination = async (jobIndex, matrixValues, signal) => {
                         const jobLabel = labelOf(matrixValues);
-                        const runtime = (0, job_runtime_1.createJobRuntime)(github, runDir, {
-                            shell: job.defaults?.run?.shell ?? parsed.file.defaults?.run?.shell,
+                        // With --isolate-workspace, the job (and github.workspace) gets
+                        // its own copy of the working copy.
+                        const workspace = options.isolateWorkspace
+                            ? (0, checkout_1.createIsolatedWorkspace)(process.cwd(), runDir)
+                            : process.cwd();
+                        const comboGithub = options.isolateWorkspace
+                            ? { ...github, workspace }
+                            : github;
+                        const runtime = (0, job_runtime_1.createJobRuntime)(comboGithub, runDir, {
+                            shell: job.defaults?.run?.shell ??
+                                parsed.file.defaults?.run?.shell,
                             workingDirectory: job.defaults?.run?.['working-directory'] ??
                                 parsed.file.defaults?.run?.['working-directory']
-                        });
+                        }, workspace);
                         runtime.signal = signal;
                         // Workflow-level env can't reference `env` itself; job-level
                         // env sees the workflow env plus matrix (matching GitHub's
@@ -303,17 +366,17 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                         const workflowEnv = {
                             ...options.env,
                             ...(0, expression_1.substituteRecord)(parsed.file.env, {
-                                ...(0, expression_1.createContext)({ ...options.env }, inputs, options.secrets, github),
+                                ...(0, expression_1.createContext)({ ...options.env }, inputs, options.secrets, comboGithub),
                                 vars
                             })
                         };
                         const jobEnv = (0, expression_1.substituteRecord)(job.env, {
-                            ...(0, expression_1.createContext)(workflowEnv, inputs, options.secrets, github, matrixValues),
+                            ...(0, expression_1.createContext)(workflowEnv, inputs, options.secrets, comboGithub, matrixValues),
                             needs,
                             vars
                         });
                         const jobCtx = {
-                            ...(0, expression_1.createContext)({ ...workflowEnv, ...jobEnv }, inputs, options.secrets, github, matrixValues),
+                            ...(0, expression_1.createContext)({ ...workflowEnv, ...jobEnv }, inputs, options.secrets, comboGithub, matrixValues),
                             needs,
                             vars,
                             job: { status: 'success' },
@@ -521,11 +584,17 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                             finally {
                                 signal.removeEventListener('abort', onAbort);
                                 await stopping;
+                                if (options.isolateWorkspace) {
+                                    await (0, job_container_1.clearIsolatedWorkspace)(runtime);
+                                }
                                 await (0, job_container_1.stopJobContainer)(runtime);
                             }
                         }
                         finally {
                             await stopping;
+                            if (options.isolateWorkspace) {
+                                (0, checkout_1.removeIsolatedWorkspace)(workspace);
+                            }
                         }
                         const jobSuccess = stepResults.every((s) => s.success || s.step['continue-on-error']);
                         // Job-level continue-on-error (often
@@ -555,6 +624,7 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                         maxParallel,
                         slots,
                         signal: internal.signal,
+                        ...concurrencyGate,
                         onFailFast: () => logger_1.logger.info(concurrent
                             ? `Cancelling remaining matrix jobs for ${jobId} (fail-fast)`
                             : `Skipping remaining matrix jobs for ${jobId} (fail-fast)`)

package/dist/runner/expression.js

@@ -1,11 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createContext = createContext;
+exports.knownPrefix = knownPrefix;
 exports.resolveExpressionValue = resolveExpressionValue;
 exports.substituteExpressions = substituteExpressions;
 exports.substituteRecord = substituteRecord;
 exports.withImplicitSuccess = withImplicitSuccess;
 exports.evaluateCondition = evaluateCondition;
+exports.staticCondition = staticCondition;
 exports.ifEvaluationError = ifEvaluationError;
 exports.validateExpression = validateExpression;
 exports.expressionDataFlow = expressionDataFlow;
@@ -388,16 +390,69 @@ function callFunction(name, rawArgs, ctx) {
 }
 /** The `*` filter in `x.*` / `x[*]`, as opposed to a `'*'` key. */
 const STAR = Symbol('*');
+/**
+ * A value static evaluation (`staticCondition`) doesn't know, with its
+ * truthiness when that is known anyway (`unknown || true` is truthy).
+ */
+class Unknown {
+    constructor(truthy) {
+        this.truthy = truthy;
+    }
+}
+/**
+ * A string static evaluation knows only the start of (lower-cased), e.g.
+ * `github.ref` on a tags-only push: `refs/tags/`. Decides `==` / `!=`
+ * against a literal that can't share the prefix and `startsWith`.
+ */
+class KnownPrefix extends Unknown {
+    constructor(prefix) {
+        super(prefix !== '' ? true : undefined);
+        this.prefix = prefix;
+    }
+}
+/** A string known to start with `prefix` (compared case-insensitively). */
+function knownPrefix(prefix) {
+    return new KnownPrefix(prefix.toLowerCase());
+}
+/** False when `a == b` can't hold because of a known prefix, else undefined. */
+function prefixRulesOutEquality(a, b) {
+    const [known, other] = a instanceof KnownPrefix ? [a, unwrap(b)] : [b, unwrap(a)];
+    if (!(known instanceof KnownPrefix) || typeof other !== 'string') {
+        return false;
+    }
+    return !other.toLowerCase().startsWith(known.prefix);
+}
+/** Contexts an expression may name; static evaluation knows only some. */
+const NAMED_CONTEXTS = new Set([
+    'env',
+    'inputs',
+    'secrets',
+    'steps',
+    'github',
+    'matrix',
+    'needs',
+    'job',
+    'runner',
+    'vars',
+    'strategy'
+]);
+/** Truthiness of a (possibly Unknown) value; undefined when unknown. */
+function truthOf(value) {
+    return value instanceof Unknown ? value.truthy : toBoolean(unwrap(value));
+}
 class Parser {
     /**
      * With a scope, only check names and syntax; with `flow`, compute data
      * flow (Flow values) instead. Either way nothing is evaluated.
      */
-    constructor(tokens, ctx, scope, flow = false) {
+    constructor(tokens, ctx, scope, flow = false, 
+    /** Static evaluation: only these contexts are known (see Unknown). */
+    known) {
         this.tokens = tokens;
         this.ctx = ctx;
         this.scope = scope;
         this.flow = flow;
+        this.known = known;
         this.pos = 0;
     }
     peek() {
@@ -429,6 +484,16 @@ class Parser {
         while (this.isOp('||')) {
             this.next();
             const right = this.parseAnd();
+            if (this.known) {
+                const l = truthOf(left);
+                left =
+                    l === true
+                        ? left
+                        : l === false
+                            ? right
+                            : new Unknown(truthOf(right) === true ? true : undefined);
+                continue;
+            }
             left = this.flow
                 ? Flow.union(left, right)
                 : toBoolean(unwrap(left))
@@ -442,6 +507,16 @@ class Parser {
         while (this.isOp('&&')) {
             this.next();
             const right = this.parseEquality();
+            if (this.known) {
+                const l = truthOf(left);
+                left =
+                    l === false
+                        ? left
+                        : l === true
+                            ? right
+                            : new Unknown(truthOf(right) === false ? false : undefined);
+                continue;
+            }
             left = this.flow
                 ? Flow.union(left, right)
                 : toBoolean(unwrap(left))
@@ -455,6 +530,14 @@ class Parser {
         while (this.isOp('==', '!=')) {
             const op = this.next().value;
             const right = this.parseComparison();
+            if (prefixRulesOutEquality(left, right)) {
+                left = op !== '==';
+                continue;
+            }
+            if (left instanceof Unknown || right instanceof Unknown) {
+                left = new Unknown();
+                continue;
+            }
             const eq = looseEquals(unwrap(left), unwrap(right));
             left = op === '==' ? eq : !eq;
         }
@@ -465,6 +548,10 @@ class Parser {
         while (this.isOp('<', '<=', '>', '>=')) {
             const op = this.next().value;
             const right = this.parseUnary();
+            if (left instanceof Unknown || right instanceof Unknown) {
+                left = new Unknown();
+                continue;
+            }
             const c = compare(unwrap(left), unwrap(right));
             left =
                 !Number.isNaN(c) &&
@@ -481,7 +568,11 @@ class Parser {
     parseUnary() {
         if (this.isOp('!')) {
             this.next();
-            return !toBoolean(unwrap(this.parseUnary()));
+            const operand = this.parseUnary();
+            if (operand instanceof Unknown) {
+                return new Unknown(operand.truthy === undefined ? undefined : !operand.truthy);
+            }
+            return !toBoolean(unwrap(operand));
         }
         return this.parsePostfix(this.parsePrimary());
     }
@@ -509,7 +600,12 @@ class Parser {
                 }
                 else {
                     const key = unwrap(this.parseOr());
-                    value = this.access(value, typeof key === 'number' || key instanceof Flow ? key : toText(key));
+                    value =
+                        key instanceof Unknown
+                            ? new Unknown()
+                            : this.access(value, typeof key === 'number' || key instanceof Flow
+                                ? key
+                                : toText(key));
                 }
                 this.expect('rbracket');
             }
@@ -526,6 +622,12 @@ class Parser {
             // `.*` and a computed key (`x[matrix.field]`) may be any key.
             return value.member(key === STAR || key instanceof Flow ? '*' : String(key).toLowerCase());
         }
+        if (this.known) {
+            if (value instanceof Unknown)
+                return new Unknown();
+            const result = key === STAR ? star(value) : member(value, key);
+            return result === undefined ? new Unknown() : result;
+        }
         if (key === STAR)
             return star(value);
         return member(value, key);
@@ -566,6 +668,8 @@ class Parser {
                     }
                     if (this.flow)
                         return flowCall(tok.value, args);
+                    if (this.known)
+                        return this.staticCall(tok.value, args);
                     return callFunction(tok.value, args, this.ctx);
                 }
                 if (this.scope) {
@@ -576,12 +680,46 @@ class Parser {
                 }
                 if (this.flow)
                     return new Flow([[lower]]);
+                if (this.known) {
+                    if (!NAMED_CONTEXTS.has(lower)) {
+                        throw new Error(`Unrecognized named-value: '${tok.value}'`);
+                    }
+                    return lower in this.known ? this.known[lower] : new Unknown();
+                }
                 return rootContext(lower, this.ctx);
             }
             default:
                 throw new Error(`Unexpected token: ${tok.type}`);
         }
     }
+    /**
+     * A function call in static evaluation: `success()` and `always()` hold
+     * for a step that runs at all; other status functions, `hashFiles` and
+     * calls with an unknown argument are unknown.
+     */
+    staticCall(name, args) {
+        checkCall(name, args.length);
+        const lower = name.toLowerCase();
+        if (lower === 'success' || lower === 'always')
+            return true;
+        if (lower === 'startswith' && args[0] instanceof KnownPrefix) {
+            const search = unwrap(args[1]);
+            if (typeof search === 'string') {
+                const { prefix } = args[0];
+                const wanted = search.toLowerCase();
+                if (prefix.startsWith(wanted))
+                    return true;
+                if (!wanted.startsWith(prefix))
+                    return false;
+            }
+            return new Unknown();
+        }
+        if (['failure', 'cancelled', 'hashfiles'].includes(lower) ||
+            args.some((arg) => arg instanceof Unknown)) {
+            return new Unknown();
+        }
+        return callFunction(name, args, this.ctx);
+    }
 }
 function evaluate(expr, ctx) {
     return new Parser(tokenize(expr), ctx).parse();
@@ -670,6 +808,30 @@ function evaluateCondition(expr, ctx) {
     // it fails the step or job), never a condition that passes.
     return toBoolean(evaluate(trimmed, ctx));
 }
+/**
+ * Whether an `if:` holds when only the `known` contexts are known, e.g.
+ * `{ github: { event_name: 'push' } }`: true or false when that settles
+ * it, undefined when it depends on anything else (or can't be parsed).
+ * Used to check a contract without running the workflow.
+ */
+function staticCondition(expr, known) {
+    if (expr === undefined || typeof expr === 'boolean')
+        return expr ?? true;
+    let trimmed = expr.trim();
+    const wrapped = trimmed.match(/^\$\{\{([\s\S]*)\}\}$/);
+    if (wrapped)
+        trimmed = wrapped[1].trim();
+    if (trimmed === '')
+        return true;
+    try {
+        return truthOf(new Parser(tokenize(trimmed), createContext(), undefined, false, {
+            ...known
+        }).parse());
+    }
+    catch {
+        return undefined;
+    }
+}
 /** The error for an `if:` that couldn't be evaluated, worded like GitHub's. */
 function ifEvaluationError(target, error) {
     return `Error when evaluating 'if' for ${target}. ${error instanceof Error ? error.message : String(error)}`;