@stll/oxlint-config 0.12.0 → 0.12.1

package/README.md

@@ -92,6 +92,15 @@ part of major 26 fail.
 Release and publish workflows use exact patch version-file selectors for
 reproducible builds; this repository pins `.node-version` to `26.10.0`.
 The series policy accepts that patch without weakening release validation.
+Runtime images may retain a full SHA256 digest alongside an exact stable patch
+tag: Node must be inside its policy series and match tracked root `.node-version`
+when present; Python must be a patch in its policy series; Bun must equal its
+policy version. Supported image variants remain allowed.
+Digest validation is declaration-only: the guard enforces the exact policy tag
+and a full SHA256 digest, but does not verify that the digest belongs to the tag.
+Dependabot refreshes digests per repository; a shared tag-to-digest map would
+require a tooling release for every base-image digest bump across repositories,
+which costs more than it buys.
 GitHub JavaScript action host runtimes (`runs.using`) are platform-managed
 and do not select the project toolchain Node version.
 
@@ -198,10 +207,11 @@ Add an explicit declaration to tracked root `stll-toolchain.json`:
 }
 ```
 
-Services are optional within the declared list: use `[]` for runtimes and
-dependencies only. No `cloud` declaration means no cloud setup script.
-`envFile` must be a canonical repository-relative path; its existing parent
-must be safe at runtime. Track an exact stable Node patch in root
+Services are optional: omit `services` or use `[]` for runtimes and dependencies
+only. No `cloud` declaration means no cloud setup script. `envFile` is required
+with services and rejected without services; runtime-only scripts emit no
+environment file code. With services, `envFile` must be a canonical
+repository-relative path; its existing parent must be safe at runtime. Track an exact stable Node patch in root
 `.node-version` within the shared Node series. Generate and commit the script:
 
 ```sh

package/dist/toolchain-guard.cjs

@@ -291,19 +291,28 @@ const parseCloudSetup = (input) => {
 	if (input === void 0) return void 0;
 	if (typeof input !== "object" || input === null || Array.isArray(input)) throw new Error("cloud must be an object");
 	for (const key of Object.keys(input)) if (key !== "services" && key !== "install" && key !== "envFile") throw new Error(`unsupported cloud key: ${key}`);
-	if (!("services" in input) || !Array.isArray(input.services)) throw new Error("cloud.services must be an explicit array");
+	const selected = "services" in input ? input.services : [];
+	if (!Array.isArray(selected)) throw new Error("cloud.services must be an array when provided");
 	if (!("install" in input) || input.install !== "bun install --frozen-lockfile") throw new Error(`cloud.install must be exactly ${cloudInstallCommand}`);
+	const seen = /* @__PURE__ */ new Set();
+	const services = Array.from(selected, (service) => {
+		if (!cloudService(service)) throw new Error("cloud.services contains an unsupported service");
+		if (seen.has(service)) throw new Error(`cloud.services contains duplicate service: ${service}`);
+		seen.add(service);
+		return service;
+	});
+	if (services.length === 0) {
+		if ("envFile" in input) throw new Error("cloud.envFile is not allowed without services");
+		return {
+			services,
+			install: cloudInstallCommand
+		};
+	}
 	if (!("envFile" in input) || typeof input.envFile !== "string") throw new Error("cloud.envFile must be a canonical repository-relative path");
 	const envFile = input.envFile;
 	if (envFile.startsWith("/") || /^[A-Za-z]:/.test(envFile) || envFile.includes("\\") || /\p{Cc}/u.test(envFile) || envFile.split("/").some((part) => part === "" || part === "." || part === "..")) throw new Error("cloud.envFile must be a canonical repository-relative path");
-	const seen = /* @__PURE__ */ new Set();
 	return {
-		services: Array.from(input.services, (service) => {
-			if (!cloudService(service)) throw new Error("cloud.services contains an unsupported service");
-			if (seen.has(service)) throw new Error(`cloud.services contains duplicate service: ${service}`);
-			seen.add(service);
-			return service;
-		}),
+		services,
 		install: cloudInstallCommand,
 		envFile
 	};
@@ -515,8 +524,7 @@ NODE_DIR="/opt/stll-cloud/node/$NODE_VERSION"
 BUN_DIR="/opt/stll-cloud/bun/$BUN_VERSION"
 export PATH="$NODE_DIR/bin:$BUN_DIR:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 BUN_CACHE="/var/cache/stll-cloud/bun/$OUTPUT_UID"
-ENV_FILE=@ENV_FILE@
-ENV_MARKER='@ENV_MARKER@'
+@ENV_ASSIGNMENTS@
 [[ -f "$REPO_ROOT/.node-version" && ! -L "$REPO_ROOT/.node-version" ]] || fail 'A regular root .node-version is required'
 [[ "$(awk 'NF { if (++count > 1 || NF != 1) exit 1; value=$1 } END { if (count != 1) exit 1; print value }' "$REPO_ROOT/.node-version")" == "$NODE_VERSION" ]] || fail 'Node selector changed; regenerate cloud-setup.sh'
 cd -- "$REPO_ROOT"
@@ -585,6 +593,21 @@ dependency_install() {
 @SERVICE_INSTALL@
 @SERVICE_START@
 
+@ENV_FUNCTIONS@
+
+if [[ "$MODE" == install ]]; then
+  install_runtimes
+  install_services
+  dependency_install
+  exit 0
+fi
+runtime_ready
+@ENV_VALIDATE@
+prepare_state
+start_services
+@ENV_WRITE@
+`;
+const environmentFunctions = String.raw`
 validate_environment() {
   local part target="$REPO_ROOT" env_path="$REPO_ROOT/$ENV_FILE" first_line temporary
   while IFS= read -r part; do
@@ -611,20 +634,6 @@ write_environment() {
   chown "$OUTPUT_UID:$OUTPUT_GID" "$temporary"
   mv -f -- "$temporary" "$env_path"
 }
-
-if [[ "$MODE" == install ]]; then
-  install_runtimes
-  install_services
-  dependency_install
-  exit 0
-fi
-runtime_ready
-DATABASE_URL=''
-REDIS_URL=''
-validate_environment
-prepare_state
-start_services
-write_environment
 `;
 const shellQuote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
 const generateCloudSetup = ({ policy, cloud, nodeVersion }) => {
@@ -636,8 +645,10 @@ const generateCloudSetup = ({ policy, cloud, nodeVersion }) => {
 	const replacements = /* @__PURE__ */ new Map([
 		["@BUN@", policy.bun],
 		["@NODE@", exactNode],
-		["@ENV_FILE@", shellQuote(selected.envFile)],
-		["@ENV_MARKER@", cloudEnvironmentMarker],
+		["@ENV_ASSIGNMENTS@", selected.envFile === void 0 ? "" : `ENV_FILE=${shellQuote(selected.envFile)}\nENV_MARKER=${shellQuote(cloudEnvironmentMarker)}`],
+		["@ENV_FUNCTIONS@", selected.envFile === void 0 ? "" : environmentFunctions],
+		["@ENV_VALIDATE@", selected.envFile === void 0 ? "" : "DATABASE_URL=''\nREDIS_URL=''\nvalidate_environment"],
+		["@ENV_WRITE@", selected.envFile === void 0 ? "" : "write_environment"],
 		["@SERVICE_INSTALL@", renderCloudServiceInstall({
 			services,
 			postgres: policy.postgres,
@@ -2198,31 +2209,71 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 		});
 	});
 	const checkRuntimeImage = ({ image, line, label }) => {
-		if (typeof image !== "string" || image.includes("$")) {
+		const unknownRuntime = () => {
 			add({
 				rule: "runtime-docker",
 				line,
 				message: `cannot determine ${label} runtime; use a static image or a reasoned runtime-docker opt-out`
 			});
+		};
+		if (typeof image !== "string") {
+			unknownRuntime();
+			return;
+		}
+		const canonical = canonicalDockerRuntime(image);
+		const structuralImage = canonical.replace(/\$\{[^}]*\}|\$[A-Za-z_][A-Za-z_\d]*/g, (variable) => "x".repeat(variable.length));
+		const digestSeparator = structuralImage.indexOf("@");
+		const reference = digestSeparator < 0 ? canonical : canonical.slice(0, digestSeparator);
+		const structuralReference = digestSeparator < 0 ? structuralImage : structuralImage.slice(0, digestSeparator);
+		const managedFamily = /^(node|python|oven\/bun)(?=:|$)/i.exec(structuralReference)?.[1];
+		const tagSeparator = managedFamily === void 0 ? structuralReference.lastIndexOf(":") : structuralReference.indexOf(":", managedFamily.length);
+		const hasTag = managedFamily === void 0 ? tagSeparator > structuralReference.lastIndexOf("/") : tagSeparator !== -1;
+		const imageRepository = hasTag ? reference.slice(0, tagSeparator) : reference;
+		if (imageRepository.length === 0 || imageRepository.includes("$")) {
+			unknownRuntime();
+			return;
+		}
+		if (!/^(node|python|oven\/bun)$/i.test(imageRepository)) return;
+		const tool = imageRepository.toLowerCase();
+		if (image.includes("$")) {
+			unknownRuntime();
 			return;
 		}
-		const runtime = /^(node|python|oven\/bun)(?::([^@]+))?(?:@.*)?$/i.exec(canonicalDockerRuntime(image));
-		if (runtime === null) return;
-		const tool = runtime[1]?.toLowerCase();
-		if (image.includes("@")) {
+		const digest = digestSeparator < 0 ? void 0 : canonical.slice(digestSeparator + 1);
+		if (digest !== void 0 && !/^sha256:[a-fA-F\d]{64}$/.test(digest)) {
 			add({
 				rule: tool === "oven/bun" ? "bun-pins" : "runtime-docker",
 				line,
-				message: `${label} ${tool} digest requires an approved digest policy; use a tag-only runtime image`
+				message: `${label} ${tool} digest must be sha256 followed by 64 hexadecimal characters`
 			});
 			return;
 		}
-		const tag = runtime[2];
+		const tag = hasTag ? reference.slice(tagSeparator + 1) : void 0;
 		const variantSuffix = tool === "oven/bun" ? /-(?:alpine|slim|debian)$/ : /-(?:alpine(?:\d+(?:\.\d+)*)?|(?:bookworm|bullseye|trixie|buster)(?:-slim)?|slim)$/;
 		const version = tag?.replace(variantSuffix, "");
 		let expected = policy.bun;
 		if (tool === "node") expected = policy.node;
 		else if (tool === "python") expected = policy.python;
+		if (digest !== void 0) {
+			if (version === void 0 || !/^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/.test(version)) {
+				add({
+					rule: tool === "oven/bun" ? "bun-pins" : "runtime-docker",
+					line,
+					message: `${label} ${tool} digest requires an exact stable patch tag matching ${expected}`
+				});
+				return;
+			}
+			if (tool === "node" && trackedFiles.has(".node-version")) {
+				if (readFile(".node-version")?.trim() !== version) {
+					add({
+						rule: "runtime-docker",
+						line,
+						message: `${label} node digest tag must match tracked .node-version, found ${version}`
+					});
+					return;
+				}
+			}
+		}
 		pin({
 			rule: tool === "oven/bun" ? "bun-pins" : "runtime-docker",
 			value: version,
@@ -2335,14 +2386,6 @@ const checkRuntimeFile = ({ file, text, policy, trackedFiles, readFile, reposito
 			if (from === null || from[1] === void 0) return;
 			argumentScope = "stage";
 			const image = expand(from[1]);
-			if (image.includes("$")) {
-				add({
-					rule: "runtime-docker",
-					line,
-					message: "cannot determine FROM runtime; declare an image ARG default or a reasoned runtime-docker opt-out"
-				});
-				return;
-			}
 			const stage = from[2]?.toLowerCase();
 			const previousStage = stages.has(image.toLowerCase());
 			if (stage !== void 0) stages.add(stage);