@tahminator/pipeline 1.0.92 → 1.0.93-beta.g8cbdf33f

package/README.md

@@ -30,6 +30,56 @@ bun run src/index.ts
 > [!WARNING]
 > This repository is iterating quickly & as such may have rough edges. I will always be happy to respond to & fix any issues anyone may have :)
 
+## CI script checks
+
+Enable `LINT_CI` to typecheck and lint your CI scripts without a `test` script:
+
+```yaml
+- uses: tahminator/pipeline/actions/setup@<published-commit-sha>
+  with:
+    GITHUB_SCRIPTS_DIR: ./.github/scripts
+    LINT_CI: true
+```
+
+The setup action installs the CI package's dependencies with
+`bun install --frozen-lockfile`, then runs these internal Bun scripts from
+`GITHUB_SCRIPTS_DIR`:
+
+1. `src/internal/tsc.ts`: runs the package's TypeScript compiler with
+   `--noEmit --project tsconfig.json`.
+2. `src/internal/lint.ts`: runs the package's Oxlint with its
+   `oxlint.config.ts`, using
+   [native configuration loading](https://oxc.rs/docs/guide/usage/linter/config.html).
+
+Both tools resolve from the CI scripts package, not from the action's dependencies.
+Add them as devDependencies in that package and commit the updated `package.json`
+and `bun.lock`:
+
+```sh
+bun add --cwd .github/scripts -d typescript oxlint
+```
+
+Provide `tsconfig.json` and `oxlint.config.ts` in that directory. For example:
+
+```ts
+// .github/scripts/oxlint.config.ts
+export default {
+  ignorePatterns: ["node_modules/**"],
+  rules: {
+    "no-debugger": "error",
+    "no-unused-vars": "error",
+  },
+};
+```
+
+Missing tools, launchers, or configs produce actionable errors. Type errors or
+lint errors fail the step; a failed typecheck stops before linting. No tools are
+downloaded by these scripts, no files are emitted or autofixed, and no tests run.
+`LINT_CI` remains disabled by default.
+
+Previously, `LINT_CI` invoked the consumer's `test` script. It now runs only these
+two checks; a `test` script is neither required nor invoked.
+
 ## Slash commands action
 
 Use [`actions/commands`](./actions/commands/README.md) to run your repository's workflows from PR comments such as `/merge` or `/ai`.
@@ -333,6 +383,8 @@ The diff is split per Kubernetes object (matched by API group, kind, namespace a
 
 Interface with Docker to build & deploy images
 
+`buildImage` runs BuildKit on the runner's network with `--network host`, so every `RUN` instruction can reach whatever the runner can, including hosts on the Headscale VPN connected by the setup action. Dockerfiles don't need `RUN --network=host`.
+
 ```ts
 // https://www.typescriptlang.org/docs/handbook/release-notes/typescript-5-2.html#using-declarations-and-explicit-resource-management
 await using client = await DockerClient.create(
@@ -423,6 +475,18 @@ View the [action file](./actions/setup/action.yaml) for all available inputs.
       cargo-nextest@0.9.100
 ```
 
+Language toolchains are installed and cached by the setup action, so jobs don't need separate `setup-go` / `setup-java` / `rust-toolchain` steps:
+
+```yaml
+- uses: tahminator/pipeline/actions/setup@<version>
+  with:
+    INSTALL_GO: "true" # version read from GO_VERSION_FILE (default go.mod) unless GO_VERSION is set
+    INSTALL_JAVA: "true" # JAVA_VERSION "21", JAVA_DISTRIBUTION "temurin", JAVA_CACHE "maven" by default
+    INSTALL_RUST: "true" # also caches the Cargo registry and target dir
+    RUST_TOOLCHAIN: "1.93.0"
+    RUST_COMPONENTS: "clippy, rustfmt"
+```
+
 ### `NPMClient`
 
 Interface with NPM registry in order to publish packages to `npmjs.com`

package/dist/docker/client.js

@@ -48,7 +48,10 @@ export class DockerClient {
         console.log("Building image with following tags:");
         tags.forEach((tag) => console.log(Utils.Colors.cyan(tag)));
         try {
-            await $ `docker buildx create --use --name ${dockerRepository}-builder`;
+            await $ `docker buildx create --use --name ${dockerRepository}-builder \
+                --driver docker-container \
+                --driver-opt network=host \
+                --buildkitd-flags ${"--allow-insecure-entitlement network.host"}`;
         }
         catch {
             await $ `docker buildx use ${dockerRepository}-builder`;
@@ -68,6 +71,8 @@ export class DockerClient {
               --cache-from=type=gha \
               --cache-to=type=gha,mode=max \
               ${buildArgFlags} \
+              --network host \
+              --allow network.host \
               ${tagFlags} \
               .`;
         console.log(shouldUpload ?

package/dist/internal/lint.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/internal/lint.js

@@ -0,0 +1,31 @@
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+let launcher;
+try {
+    const manifest = Bun.resolveSync("oxlint/package.json", process.cwd());
+    launcher = join(dirname(manifest), "bin/oxlint");
+}
+catch (error) {
+    if (!(error instanceof Error) ||
+        !("code" in error) ||
+        (error.code !== "MODULE_NOT_FOUND" && error.code !== "ERR_MODULE_NOT_FOUND")) {
+        throw error;
+    }
+}
+if (!launcher || !existsSync(launcher)) {
+    console.error("pipeline: Oxlint is missing. Add oxlint as a devDependency to your CI scripts package.json by running `bun add -d oxlint` in that directory.");
+    process.exit(1);
+}
+if (!existsSync("oxlint.config.ts")) {
+    console.error("pipeline: Missing oxlint.config.ts. Add it to your CI scripts package directory.");
+    process.exit(1);
+}
+const result = Bun.spawnSync([process.execPath, launcher], {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+});
+if (result.signalCode)
+    process.kill(process.pid, result.signalCode);
+else
+    process.exitCode = result.exitCode;

package/dist/internal/tsc.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/internal/tsc.js

@@ -0,0 +1,31 @@
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+let launcher;
+try {
+    const manifest = Bun.resolveSync("typescript/package.json", process.cwd());
+    launcher = join(dirname(manifest), "bin/tsc");
+}
+catch (error) {
+    if (!(error instanceof Error) ||
+        !("code" in error) ||
+        (error.code !== "MODULE_NOT_FOUND" && error.code !== "ERR_MODULE_NOT_FOUND")) {
+        throw error;
+    }
+}
+if (!launcher || !existsSync(launcher)) {
+    console.error("pipeline: TypeScript is missing. Add typescript as a devDependency to your CI scripts package.json by running `bun add -d typescript` in that directory.");
+    process.exit(1);
+}
+if (!existsSync("tsconfig.json")) {
+    console.error("pipeline: Missing tsconfig.json. Add it to your CI scripts package directory.");
+    process.exit(1);
+}
+const result = Bun.spawnSync([process.execPath, launcher, "--noEmit", "--project", "tsconfig.json"], {
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+});
+if (result.signalCode)
+    process.kill(process.pid, result.signalCode);
+else
+    process.exitCode = result.exitCode;

package/package.json

@@ -3,7 +3,7 @@
   "type": "module",
   "author": "Tahmid Ahmed",
   "description": "A collection of Bun shell scripts that can be re-used in various CICD pipelines.",
-  "version": "1.0.92",
+  "version": "1.0.93-beta.g8cbdf33f",
   "repository": {
     "url": "git+https://github.com/tahminator/pipeline.git"
   },