@tahminator/pipeline 1.0.91 → 1.0.92-beta.g1f7c613a

package/README.md

@@ -327,12 +327,14 @@ await flux.diff({
 
 Each Kustomization is rendered as `kustomize build` of `spec.path` with `targetNamespace`, `namePrefix`, `nameSuffix`, `components`, `images`, `patches` and `commonMetadata` applied on top, followed by `postBuild.substitute`. Paths without a `kustomization.yaml` get one generated, as Flux does. Values from `postBuild.substituteFrom` live in the cluster, so those variables are left as-is and listed in the diff's notes. A build failure is shown in the comment instead of being skipped. `HelmRelease` objects are diffed as manifests; charts are not templated.
 
-The diff is split per Kubernetes object (matched by API group, kind, namespace and name), and each object is labelled with the file that defines it, taken from kustomize's `originAnnotations`. Generated ConfigMaps and Secrets point at the `kustomization.yaml` whose generator creates them. Files that only patch an object are not recorded, so a change made by a patch is attributed to the object's original file. A renamed object (e.g. a new generator hash suffix) shows as one removal and one addition.
+The diff is split per Kubernetes object (matched by API group, kind, namespace and name), and each object is labelled with the file that defines it, taken from kustomize's `originAnnotations`. Generated ConfigMaps and Secrets point at the `kustomization.yaml` whose generator creates them, and are matched without their content-hash suffix, so editing a generator's data shows as a line diff of the same object rather than a removal and an addition. Files that only patch an object are not recorded, so a change made by a patch is attributed to the object's original file. Any other renamed object shows as one removal and one addition.
 
 ### `DockerClient`
 
 Interface with Docker to build & deploy images
 
+`buildImage` runs BuildKit on the runner's network with `--network host`, so every `RUN` instruction can reach whatever the runner can, including hosts on the Headscale VPN connected by the setup action. Dockerfiles don't need `RUN --network=host`.
+
 ```ts
 // https://www.typescriptlang.org/docs/handbook/release-notes/typescript-5-2.html#using-declarations-and-explicit-resource-management
 await using client = await DockerClient.create(
@@ -423,6 +425,18 @@ View the [action file](./actions/setup/action.yaml) for all available inputs.
       cargo-nextest@0.9.100
 ```
 
+Language toolchains are installed and cached by the setup action, so jobs don't need separate `setup-go` / `setup-java` / `rust-toolchain` steps:
+
+```yaml
+- uses: tahminator/pipeline/actions/setup@<version>
+  with:
+    INSTALL_GO: "true" # version read from GO_VERSION_FILE (default go.mod) unless GO_VERSION is set
+    INSTALL_JAVA: "true" # JAVA_VERSION "21", JAVA_DISTRIBUTION "temurin", JAVA_CACHE "maven" by default
+    INSTALL_RUST: "true" # also caches the Cargo registry and target dir
+    RUST_TOOLCHAIN: "1.93.0"
+    RUST_COMPONENTS: "clippy, rustfmt"
+```
+
 ### `NPMClient`
 
 Interface with NPM registry in order to publish packages to `npmjs.com`

package/dist/docker/client.js

@@ -48,7 +48,10 @@ export class DockerClient {
         console.log("Building image with following tags:");
         tags.forEach((tag) => console.log(Utils.Colors.cyan(tag)));
         try {
-            await $ `docker buildx create --use --name ${dockerRepository}-builder`;
+            await $ `docker buildx create --use --name ${dockerRepository}-builder \
+                --driver docker-container \
+                --driver-opt network=host \
+                --buildkitd-flags ${"--allow-insecure-entitlement network.host"}`;
         }
         catch {
             await $ `docker buildx use ${dockerRepository}-builder`;
@@ -68,6 +71,8 @@ export class DockerClient {
               --cache-from=type=gha \
               --cache-to=type=gha,mode=max \
               ${buildArgFlags} \
+              --network host \
+              --allow network.host \
               ${tagFlags} \
               .`;
         console.log(shouldUpload ?

package/dist/flux/client.js

@@ -4,7 +4,7 @@ import { tmpdir } from "node:os";
 import path from "node:path";
 import { findFluxKustomizations } from "./discover";
 import { formatFluxDiff, label } from "./format";
-import { renderKustomization } from "./render";
+import { objectKey, renderKustomization } from "./render";
 import {} from "./types";
 /** GitHub rejects comment bodies above 65536 characters. */
 const MAX_COMMENT_LENGTH = 65_536;
@@ -155,21 +155,14 @@ export class FluxClient {
         }
     }
 }
-/**
- * Pairs base and head objects by API group, kind, namespace and name, and diffs the ones whose
- * rendered YAML differs. An apiVersion bump within a group is a change, not a remove + add.
- */
+/** Pairs base and head objects by {@link objectKey} and diffs the ones whose rendered YAML differs. */
 async function diffObjects(baseObjects, headObjects, nextDir) {
-    const key = (object) => {
-        const group = object.apiVersion.includes("/") ? object.apiVersion.split("/")[0] : "";
-        return [group, object.kind, object.namespace, object.name].join("\0");
-    };
     const pairs = new Map();
     for (const object of baseObjects) {
-        pairs.set(key(object), { base: object });
+        pairs.set(objectKey(object), { base: object });
     }
     for (const object of headObjects) {
-        const k = key(object);
+        const k = objectKey(object);
         pairs.set(k, { ...pairs.get(k), head: object });
     }
     const diffs = await Promise.all([...pairs.values()].map(async ({ base, head }) => {

package/dist/flux/render.d.ts

@@ -9,9 +9,17 @@ export type RenderedObject = {
      * kustomization.yaml whose generator creates it); `undefined` if kustomize did not record one
      */
     file?: string;
+    /** created by a ConfigMap/Secret generator, so `name` may end in a content hash */
+    generated: boolean;
     /** the object's rendered YAML, without the origin annotation */
     yaml: string;
 };
+/**
+ * Identifies the same object across two renders: API group, kind, namespace and name.
+ * An apiVersion bump within a group keeps the key; generated objects drop the content hash
+ * from their name so an edited ConfigMap/Secret pairs with its previous version.
+ */
+export declare function objectKey(object: RenderedObject): string;
 type RenderedKustomization = {
     /** rendered objects, in kustomize's output order; empty when `error` is set */
     objects: RenderedObject[];

package/dist/flux/render.js

@@ -12,6 +12,19 @@ const SUBSTITUTE_DISABLED = /kustomize\.toolkit\.fluxcd\.io\/substitute:\s*["']?
 const VARIABLE = /\$(\$)?\{([A-Za-z_][A-Za-z0-9_]*)(?:(:?[-=])([^}]*))?\}/g;
 /** kustomize's `originAnnotations` build metadata; records the file that defines each object. */
 const ORIGIN_ANNOTATION = "config.kubernetes.io/origin";
+const GENERATORS = ["ConfigMapGenerator", "SecretGenerator"];
+/** kustomize's name hash: 10 characters from its vowel-free alphabet, appended last. */
+const NAME_HASH = /-[2456789bcdfghkmt]{10}$/;
+/**
+ * Identifies the same object across two renders: API group, kind, namespace and name.
+ * An apiVersion bump within a group keeps the key; generated objects drop the content hash
+ * from their name so an edited ConfigMap/Secret pairs with its previous version.
+ */
+export function objectKey(object) {
+    const group = object.apiVersion.includes("/") ? object.apiVersion.split("/")[0] : "";
+    const name = object.generated ? object.name.replace(NAME_HASH, "") : object.name;
+    return [group, object.kind, object.namespace, name].join("\0");
+}
 /**
  * Renders a Flux `Kustomization` the way kustomize-controller does: `kustomize build` of
  * `spec.path` with the overlay fields from the spec (`targetNamespace`, `namePrefix`,
@@ -86,21 +99,21 @@ export async function renderKustomization(root, kustomization) {
     }
 }
 function toRenderedObject(doc, root, wrapper) {
-    const origin = doc.getIn(["metadata", "annotations", ORIGIN_ANNOTATION]);
+    const raw = doc.getIn(["metadata", "annotations", ORIGIN_ANNOTATION]);
     doc.deleteIn(["metadata", "annotations", ORIGIN_ANNOTATION]);
     const annotations = doc.getIn(["metadata", "annotations"]);
     if (yaml.isMap(annotations) && annotations.items.length === 0) {
         doc.deleteIn(["metadata", "annotations"]);
     }
+    const origin = typeof raw === "string" ? yaml.parse(raw) : null;
     const value = (doc.toJS() ?? {});
     return {
         apiVersion: String(value.apiVersion ?? ""),
         kind: String(value.kind ?? ""),
         namespace: String(value.metadata?.namespace ?? ""),
         name: String(value.metadata?.name ?? ""),
-        file: typeof origin === "string" ?
-            originFile(origin, root, wrapper)
-            : undefined,
+        file: origin ? originFile(origin, root, wrapper) : undefined,
+        generated: GENERATORS.includes(origin?.configuredBy?.kind ?? ""),
         yaml: doc.toString({ lineWidth: 0 }).replace(/^---\n/, ""),
     };
 }
@@ -110,10 +123,9 @@ function toRenderedObject(doc, root, wrapper) {
  * `<repo>//<path>?ref=<ref>`.
  */
 function originFile(origin, root, wrapper) {
-    const parsed = yaml.parse(origin);
-    const file = parsed?.path ?? parsed?.configuredIn;
-    if (parsed?.repo) {
-        return `${parsed.repo}//${file ?? ""}${parsed.ref ? `?ref=${parsed.ref}` : ""}`;
+    const file = origin.path ?? origin.configuredIn;
+    if (origin.repo) {
+        return `${origin.repo}//${file ?? ""}${origin.ref ? `?ref=${origin.ref}` : ""}`;
     }
     return file ? path.relative(root, path.resolve(wrapper, file)) : undefined;
 }

package/package.json

@@ -3,7 +3,7 @@
   "type": "module",
   "author": "Tahmid Ahmed",
   "description": "A collection of Bun shell scripts that can be re-used in various CICD pipelines.",
-  "version": "1.0.91",
+  "version": "1.0.92-beta.g1f7c613a",
   "repository": {
     "url": "git+https://github.com/tahminator/pipeline.git"
   },