@toon-protocol/rig 4.3.0 → 4.5.0

package/dist/{ci-serve-ZVJBZ3W3.js → ci-serve-PYEHIBN7.js}

@@ -6,7 +6,7 @@ import {
   renderIdentityLine,
   rigVersion,
   withForcedStandalone
-} from "./chunk-5HFOPKAB.js";
+} from "./chunk-UZZ2JKEC.js";
 import {
   CI_MANUAL_TRIGGER_KIND,
   CI_SECRET_UPDATE_KIND,
@@ -19,6 +19,7 @@ import {
   buildCiWorkflowProgress,
   buildCiWorkflowResult,
   collectRepoObjects,
+  containsSecretValue,
   decryptSecretUpdate,
   discoverWorkflows,
   effectiveSecrets,
@@ -34,19 +35,21 @@ import {
   parseCiServiceControl,
   parseRepoAddress,
   parseWorkflow,
+  redactSecretValues,
   repoAddress,
   runGit,
   selectServiceRequests,
   validateSecretUpdate,
   writeGitObjects
-} from "./chunk-3RWM7PBM.js";
+} from "./chunk-S2BMLXAD.js";
 import {
+  ARWEAVE_GATEWAYS,
   REPOSITORY_STATE_KIND,
   authorizedStatusAuthors,
   defaultWebSocketFactory,
   fetchRemoteState,
   queryRelay
-} from "./chunk-GWA3CSUR.js";
+} from "./chunk-HMED76GU.js";
 import {
   ChannelMapStore,
   channelStatus,
@@ -881,6 +884,7 @@ async function saveSecrets(stateDir, secrets) {
 }
 
 // src/ci/coordinator.ts
+var DEFAULT_CONCURRENCY = 1;
 var DEFAULT_RUN_TIMEOUT_MS = 30 * 60 * 1e3;
 var DEFAULT_ADVERTISEMENT_TTL = 30 * 60;
 var RENEW_FRACTION = 5 / 6;
@@ -935,7 +939,7 @@ var Serial = class {
 async function startCoordinator(opts) {
   const me = opts.coordinatorPubkey.toLowerCase();
   const { publisher, relayUrl, runner } = opts;
-  const concurrency = Math.max(1, opts.concurrency ?? 1);
+  const concurrency = Math.max(1, opts.concurrency ?? DEFAULT_CONCURRENCY);
   const timeoutMs = opts.timeoutMs ?? DEFAULT_RUN_TIMEOUT_MS;
   const clock = opts.clock ?? nowSeconds;
   const scheduler = opts.scheduler ?? realScheduler;
@@ -1108,6 +1112,7 @@ async function startCoordinator(opts) {
   await advertise();
   const queue = [];
   const activeAborts = /* @__PURE__ */ new Set();
+  const activeRuns = /* @__PURE__ */ new Set();
   let active = 0;
   let inflight = 0;
   const idleWaiters = [];
@@ -1135,13 +1140,22 @@ async function startCoordinator(opts) {
       jobs: []
     };
     const now = clock();
-    await publish(buildCiWorkflowResult({ ...base, conclusion }, now));
+    const resultEventId = await publish(
+      buildCiWorkflowResult({ ...base, conclusion }, now)
+    );
     await publish(
       buildCiWorkflowProgress(
         { ...base, status: "concluded", conclusion, expiresAt: now + adTtl },
         now
       )
     );
+    opts.onRunConcluded?.({
+      runId: run.runId,
+      repoAddr: run.repo.addr,
+      trigger: run.trigger,
+      conclusion,
+      resultEventId
+    });
   };
   const executeRun = async (run) => {
     const { repo, trigger, workflow } = run;
@@ -1210,6 +1224,7 @@ async function startCoordinator(opts) {
     scheduleRenew();
     const abort = new AbortController();
     activeAborts.add(abort);
+    run.abort = abort;
     let timedOut = false;
     const timeoutHandle = scheduler.setTimeout(() => {
       timedOut = true;
@@ -1246,7 +1261,7 @@ async function startCoordinator(opts) {
       ]);
     } catch (err) {
       log(
-        `[ci] ${label}: runner failed: ${err instanceof Error ? err.message : String(err)}`
+        `[ci] ${label}: runner failed: ${redactSecretValues(err instanceof Error ? err.message : String(err), Object.values(run.secrets))}`
       );
       result = {
         conclusion: "startup_failure",
@@ -1261,12 +1276,15 @@ async function startCoordinator(opts) {
     }
     let conclusion = result.conclusion;
     if (timedOut) conclusion = "timed_out";
-    else if (stopping && abort.signal.aborted) conclusion = "cancelled";
+    else if (run.superseded || stopping && abort.signal.aborted)
+      conclusion = "cancelled";
+    const secretValues = Object.values(run.secrets);
     for (const job of result.jobs) {
-      const { tail, omitted } = logTail(job.log);
+      const jobLog = redactSecretValues(job.log, secretValues);
+      const { tail, omitted } = logTail(jobLog);
       const logReceipt = await serial.run(
         () => uploadBlob({
-          body: Buffer.from(job.log, "utf-8"),
+          body: Buffer.from(jobLog, "utf-8"),
           contentType: "text/plain; charset=utf-8",
           repoId: repo.repoId
         })
@@ -1275,6 +1293,12 @@ async function startCoordinator(opts) {
       for (const artifact of job.artifacts) {
         try {
           const body = await readFile2(artifact.path);
+          if (containsSecretValue(body, secretValues)) {
+            log(
+              `[ci] ${label}: artifact ${redactSecretValues(artifact.filename, secretValues)} not uploaded \u2014 it contains an injected secret`
+            );
+            continue;
+          }
           const receipt = await serial.run(
             () => uploadBlob({
               body,
@@ -1289,7 +1313,7 @@ async function startCoordinator(opts) {
           });
         } catch (err) {
           log(
-            `[ci] ${label}: artifact ${artifact.filename} skipped: ${err instanceof Error ? err.message : String(err)}`
+            `[ci] ${label}: artifact ${redactSecretValues(`${artifact.filename} skipped: ${err instanceof Error ? err.message : String(err)}`, secretValues)}`
           );
         }
       }
@@ -1325,7 +1349,7 @@ async function startCoordinator(opts) {
       await publish(progress("in_progress"));
     }
     const now = clock();
-    await publish(
+    const resultEventId = await publish(
       buildCiWorkflowResult(
         {
           trigger,
@@ -1341,17 +1365,26 @@ async function startCoordinator(opts) {
     );
     await publish(progress("concluded", conclusion));
     log(`[ci] ${label}: ${conclusion}`);
+    opts.onRunConcluded?.({
+      runId: run.runId,
+      repoAddr: repo.addr,
+      trigger,
+      conclusion,
+      resultEventId
+    });
   };
   const pump = () => {
     while (active < concurrency && queue.length > 0 && !stopping) {
       const run = queue.shift();
       active += 1;
       inflight += 1;
+      activeRuns.add(run);
       void executeRun(run).catch((err) => {
         log(
           `[ci] run ${run.runId.slice(0, 8)} failed: ${err instanceof Error ? err.message : String(err)}`
         );
       }).finally(async () => {
+        activeRuns.delete(run);
         active -= 1;
         inflight -= 1;
         await releaseCheckout(run.checkout);
@@ -1411,6 +1444,27 @@ async function startCoordinator(opts) {
     );
     pump();
   };
+  const supersedePrRuns = async (repo, prEventId, updateEventId) => {
+    const samePr = (run) => run.repo === repo && run.trigger.pr?.prEventId === prEventId;
+    const why = `superseded by PR update ${updateEventId.slice(0, 8)} \u2014 cancelled`;
+    for (const run of queue.filter(samePr)) {
+      queue.splice(queue.indexOf(run), 1);
+      run.superseded = true;
+      log(
+        `[ci] ${repo.repoId} ${run.workflow.path}@${run.trigger.commit.slice(0, 7)} [${run.runId.slice(0, 8)}]: queued run ${why}`
+      );
+      await concludeWithoutJobs(run, "cancelled", void 0);
+      await releaseCheckout(run.checkout);
+    }
+    for (const run of activeRuns) {
+      if (!samePr(run) || run.superseded) continue;
+      run.superseded = true;
+      log(
+        `[ci] ${repo.repoId} ${run.workflow.path}@${run.trigger.commit.slice(0, 7)} [${run.runId.slice(0, 8)}]: ${why}`
+      );
+      run.abort?.abort();
+    }
+  };
   let checkoutCounter = 0;
   const handleTrigger = async (t) => {
     const { repo } = t;
@@ -1672,6 +1726,7 @@ async function startCoordinator(opts) {
       );
       return;
     }
+    await supersedePrRuns(repo, pr.id, ev.id);
     await handleTrigger({
       repo,
       reason: "pull_request",
@@ -1966,15 +2021,22 @@ Options:
                          or hex; NIP-C1 operator policy); repeatable \u2014 for
                          running your own coordinator against a repo you do
                          not maintain; such runs show as lower trust
-  --concurrency <n>      runs executed at once (default 1); more queue
-  --timeout <seconds>    wall-clock budget per run \u2192 timed_out (default 1800)
-  --gateway <url>        gateway that serves the store's raw bytes, for log +
-                         artifact links (default: ${PREFERRED_GATEWAY})
+  --concurrency <n>      runs executed at once (default ${DEFAULT_CONCURRENCY}); more queue
+  --timeout <seconds>    wall-clock budget per run \u2192 timed_out
+                         (default ${DEFAULT_RUN_TIMEOUT_MS / 1e3})
+  --gateway <url>        gateway that serves the store's raw bytes: where log +
+                         artifact links point, and the first place the
+                         coordinator reads objects from (<url>/raw/<txId>)
+                         before the shared gateway list (default:
+                         RIG_ARWEAVE_GATEWAY, else ${PREFERRED_GATEWAY})
   --act-bin <path>       the act executable (default: RIG_ACT_BIN, else PATH)
   --platform <label=img> runs-on label \u2192 Docker image; repeatable
                          (default: ubuntu-latest=${DEFAULT_ACT_PLATFORMS["ubuntu-latest"]})
   --workdir <dir>        where commits are checked out for runs (default:
                          <state-dir>/work)
+  --once                 stop after the first run concludes (its Workflow
+                         Result and final progress marker are on the relay);
+                         ignored or refused triggers do not count
   --json                 emit ONE JSON document describing the coordinator
                          at start; everything else goes to stderr
   --standalone           accepted for symmetry; the coordinator always runs
@@ -2008,6 +2070,7 @@ function parseServeArgs(args) {
       "act-bin": { type: "string" },
       platform: { type: "string", multiple: true },
       workdir: { type: "string" },
+      once: { type: "boolean", default: false },
       json: { type: "boolean", default: false },
       standalone: { type: "boolean", default: false },
       "no-daemon": { type: "boolean", default: false },
@@ -2062,7 +2125,11 @@ function parseServeArgs(args) {
       throw new ServeUsageError(`${flag} expects a positive integer`);
     return n;
   };
-  const concurrency = positiveInt("--concurrency", values.concurrency, 1);
+  const concurrency = positiveInt(
+    "--concurrency",
+    values.concurrency,
+    DEFAULT_CONCURRENCY
+  );
   const timeoutMs = positiveInt("--timeout", values.timeout, DEFAULT_RUN_TIMEOUT_MS / 1e3) * 1e3;
   let platforms;
   if (values.platform && values.platform.length > 0) {
@@ -2083,10 +2150,11 @@ function parseServeArgs(args) {
     requesters,
     concurrency,
     timeoutMs,
-    gateway: values.gateway ?? PREFERRED_GATEWAY,
+    ...values.gateway !== void 0 ? { gateway: values.gateway } : {},
     ...values["act-bin"] !== void 0 ? { actBin: values["act-bin"] } : {},
     ...platforms ? { platforms } : {},
     ...values.workdir !== void 0 ? { workdir: values.workdir } : {},
+    once: values.once,
     json: values.json
   };
 }
@@ -2147,7 +2215,7 @@ function makeAffordabilityCheck(args) {
     return false;
   };
 }
-function untilStopRequested(signal) {
+function untilStopRequested(signal, firstRun) {
   return new Promise((resolve2) => {
     let settled = false;
     const finish = (reason) => {
@@ -2163,6 +2231,7 @@ function untilStopRequested(signal) {
     signal?.addEventListener("abort", () => finish("abort"), { once: true });
     process.once("SIGINT", onSigint);
     process.once("SIGTERM", onSigterm);
+    void firstRun?.then(finish);
   });
 }
 async function runCiServe(args, deps) {
@@ -2181,6 +2250,8 @@ async function runCiServe(args, deps) {
     io.err(CI_SERVE_USAGE);
     return 2;
   }
+  const gateway = (flags.gateway ?? forced.env["RIG_ARWEAVE_GATEWAY"] ?? PREFERRED_GATEWAY).replace(/\/+$/, "");
+  const readGateways = [`${gateway}/raw`, ...ARWEAVE_GATEWAYS];
   let runner;
   if (forced.runner) {
     runner = forced.runner;
@@ -2210,11 +2281,16 @@ async function runCiServe(args, deps) {
     const stateDir = forced.stateDir ?? defaultCoordinatorStateDir(forced.env, coordinator);
     const workdir = flags.workdir ?? join4(stateDir, "work");
     const version = rigVersion();
+    let concludeFirstRun = () => void 0;
+    const firstRun = flags.once ? new Promise((resolve2) => {
+      concludeFirstRun = resolve2;
+    }) : void 0;
     handle = await startCoordinator({
       coordinatorPubkey: coordinator,
       publisher: ctx.publisher,
       relayUrl: flags.relay,
-      gatewayUrl: flags.gateway,
+      gatewayUrl: gateway,
+      gateways: readGateways,
       repos: flags.repos,
       runner,
       stateDir,
@@ -2232,6 +2308,7 @@ async function runCiServe(args, deps) {
       ...forced.fetchFn ? { fetchFn: forced.fetchFn } : {},
       ...forced.resolveSha ? { resolveSha: forced.resolveSha } : {},
       ...forced.clock ? { clock: forced.clock } : {},
+      ...firstRun ? { onRunConcluded: (run) => concludeFirstRun(run) } : {},
       log: (line) => io.err(line)
     });
     const npub = hexToNpub(coordinator);
@@ -2246,12 +2323,13 @@ async function runCiServe(args, deps) {
         coordinator,
         coordinatorNpub: npub,
         relay: flags.relay,
-        gateway: flags.gateway,
+        gateway,
         repos: flags.repos,
         requesters: flags.requesters,
         runner: { family: runner.family, selectors: runner.selectors },
         concurrency: flags.concurrency,
         timeoutSeconds: flags.timeoutMs / 1e3,
+        once: flags.once,
         stateDir,
         workdir,
         secretsKey: handle.secretsKeyPubkey,
@@ -2273,11 +2351,13 @@ async function runCiServe(args, deps) {
       io.out(`State:       ${stateDir}`);
       io.out("Maintainers authorize this coordinator with:");
       io.out(`  rig ci request ${npub}`);
-      io.out("Listening \u2014 press Ctrl-C to stop.");
+      io.out(
+        flags.once ? "Listening for one run \u2014 stops after it concludes (or Ctrl-C)." : "Listening \u2014 press Ctrl-C to stop."
+      );
     }
-    const reason = await untilStopRequested(forced.signal);
+    const reason = await untilStopRequested(forced.signal, firstRun);
     io.err(
-      `rig ci serve: ${reason} \u2014 stopping (active runs conclude cancelled)`
+      typeof reason === "string" ? `rig ci serve: ${reason} \u2014 stopping (active runs conclude cancelled)` : `rig ci serve: run ${reason.runId.slice(0, 8)} concluded ${reason.conclusion} (result ${reason.resultEventId.slice(0, 8)}) \u2014 --once, stopping`
     );
     await handle.stop();
     handle = void 0;
@@ -2300,4 +2380,4 @@ export {
   makeAffordabilityCheck,
   runCiServe
 };
-//# sourceMappingURL=ci-serve-ZVJBZ3W3.js.map
+//# sourceMappingURL=ci-serve-PYEHIBN7.js.map