@toon-protocol/rig 4.4.0 → 4.6.0

package/dist/{ci-serve-P4HOLAMP.js → ci-serve-AYFZOY4O.js}

@@ -6,7 +6,7 @@ import {
   renderIdentityLine,
   rigVersion,
   withForcedStandalone
-} from "./chunk-CTRP2UAQ.js";
+} from "./chunk-X232W4TG.js";
 import {
   CI_MANUAL_TRIGGER_KIND,
   CI_SECRET_UPDATE_KIND,
@@ -19,6 +19,7 @@ import {
   buildCiWorkflowProgress,
   buildCiWorkflowResult,
   collectRepoObjects,
+  containsSecretValue,
   decryptSecretUpdate,
   discoverWorkflows,
   effectiveSecrets,
@@ -34,19 +35,22 @@ import {
   parseCiServiceControl,
   parseRepoAddress,
   parseWorkflow,
+  redactSecretValues,
   repoAddress,
   runGit,
   selectServiceRequests,
   validateSecretUpdate,
   writeGitObjects
-} from "./chunk-RL5XUWR4.js";
+} from "./chunk-DCGV6ALH.js";
 import {
+  ARWEAVE_GATEWAYS,
   REPOSITORY_STATE_KIND,
   authorizedStatusAuthors,
   defaultWebSocketFactory,
   fetchRemoteState,
+  parseStateRefTags,
   queryRelay
-} from "./chunk-GWA3CSUR.js";
+} from "./chunk-JBFBD7HV.js";
 import {
   ChannelMapStore,
   channelStatus,
@@ -881,6 +885,7 @@ async function saveSecrets(stateDir, secrets) {
 }
 
 // src/ci/coordinator.ts
+var DEFAULT_CONCURRENCY = 1;
 var DEFAULT_RUN_TIMEOUT_MS = 30 * 60 * 1e3;
 var DEFAULT_ADVERTISEMENT_TTL = 30 * 60;
 var RENEW_FRACTION = 5 / 6;
@@ -908,19 +913,6 @@ function movedRefs(before, after) {
   }
   return moved;
 }
-function parseRefsTags(ev) {
-  const refs = {};
-  let head = null;
-  for (const [name, v1, v2] of ev.tags) {
-    if (name === "r" && v1 && v2) {
-      if (v1 === "HEAD" && v2.startsWith("ref: ")) head = v2.slice(5);
-      else refs[v1] = v2;
-    } else if (name === "HEAD" && v1?.startsWith("ref: ")) {
-      head = v1.slice(5);
-    }
-  }
-  return { refs, head };
-}
 function tagValues(tags, name) {
   return tags.filter((t) => t[0] === name).map((t) => t[1] ?? "").filter((v) => v !== "");
 }
@@ -935,7 +927,7 @@ var Serial = class {
 async function startCoordinator(opts) {
   const me = opts.coordinatorPubkey.toLowerCase();
   const { publisher, relayUrl, runner } = opts;
-  const concurrency = Math.max(1, opts.concurrency ?? 1);
+  const concurrency = Math.max(1, opts.concurrency ?? DEFAULT_CONCURRENCY);
   const timeoutMs = opts.timeoutMs ?? DEFAULT_RUN_TIMEOUT_MS;
   const clock = opts.clock ?? nowSeconds;
   const scheduler = opts.scheduler ?? realScheduler;
@@ -1257,7 +1249,7 @@ async function startCoordinator(opts) {
       ]);
     } catch (err) {
       log(
-        `[ci] ${label}: runner failed: ${err instanceof Error ? err.message : String(err)}`
+        `[ci] ${label}: runner failed: ${redactSecretValues(err instanceof Error ? err.message : String(err), Object.values(run.secrets))}`
       );
       result = {
         conclusion: "startup_failure",
@@ -1274,11 +1266,13 @@ async function startCoordinator(opts) {
     if (timedOut) conclusion = "timed_out";
     else if (run.superseded || stopping && abort.signal.aborted)
       conclusion = "cancelled";
+    const secretValues = Object.values(run.secrets);
     for (const job of result.jobs) {
-      const { tail, omitted } = logTail(job.log);
+      const jobLog = redactSecretValues(job.log, secretValues);
+      const { tail, omitted } = logTail(jobLog);
       const logReceipt = await serial.run(
         () => uploadBlob({
-          body: Buffer.from(job.log, "utf-8"),
+          body: Buffer.from(jobLog, "utf-8"),
           contentType: "text/plain; charset=utf-8",
           repoId: repo.repoId
         })
@@ -1287,6 +1281,12 @@ async function startCoordinator(opts) {
       for (const artifact of job.artifacts) {
         try {
           const body = await readFile2(artifact.path);
+          if (containsSecretValue(body, secretValues)) {
+            log(
+              `[ci] ${label}: artifact ${redactSecretValues(artifact.filename, secretValues)} not uploaded \u2014 it contains an injected secret`
+            );
+            continue;
+          }
           const receipt = await serial.run(
             () => uploadBlob({
               body,
@@ -1301,7 +1301,7 @@ async function startCoordinator(opts) {
           });
         } catch (err) {
           log(
-            `[ci] ${label}: artifact ${artifact.filename} skipped: ${err instanceof Error ? err.message : String(err)}`
+            `[ci] ${label}: artifact ${redactSecretValues(`${artifact.filename} skipped: ${err instanceof Error ? err.message : String(err)}`, secretValues)}`
           );
         }
       }
@@ -1616,8 +1616,9 @@ async function startCoordinator(opts) {
   const handleRepoState = async (repo, ev) => {
     const cursor = repo.cursor;
     if (repoSeen(repo, ev) || ev.created_at < cursor.lastCreatedAt) return;
-    const { refs, head } = parseRefsTags(ev);
-    if (head) repo.defaultBranch = head;
+    const { refs: refMap, headSymref } = parseStateRefTags(ev.tags);
+    const refs = Object.fromEntries(refMap);
+    if (headSymref) repo.defaultBranch = headSymref;
     const moved = movedRefs(cursor.refs, refs);
     cursor.refs = refs;
     markRepoProcessed(repo, ev);
@@ -2009,10 +2010,14 @@ Options:
                          or hex; NIP-C1 operator policy); repeatable \u2014 for
                          running your own coordinator against a repo you do
                          not maintain; such runs show as lower trust
-  --concurrency <n>      runs executed at once (default 1); more queue
-  --timeout <seconds>    wall-clock budget per run \u2192 timed_out (default 1800)
-  --gateway <url>        gateway that serves the store's raw bytes, for log +
-                         artifact links (default: ${PREFERRED_GATEWAY})
+  --concurrency <n>      runs executed at once (default ${DEFAULT_CONCURRENCY}); more queue
+  --timeout <seconds>    wall-clock budget per run \u2192 timed_out
+                         (default ${DEFAULT_RUN_TIMEOUT_MS / 1e3})
+  --gateway <url>        gateway that serves the store's raw bytes: where log +
+                         artifact links point, and the first place the
+                         coordinator reads objects from (<url>/raw/<txId>)
+                         before the shared gateway list (default:
+                         RIG_ARWEAVE_GATEWAY, else ${PREFERRED_GATEWAY})
   --act-bin <path>       the act executable (default: RIG_ACT_BIN, else PATH)
   --platform <label=img> runs-on label \u2192 Docker image; repeatable
                          (default: ubuntu-latest=${DEFAULT_ACT_PLATFORMS["ubuntu-latest"]})
@@ -2109,7 +2114,11 @@ function parseServeArgs(args) {
       throw new ServeUsageError(`${flag} expects a positive integer`);
     return n;
   };
-  const concurrency = positiveInt("--concurrency", values.concurrency, 1);
+  const concurrency = positiveInt(
+    "--concurrency",
+    values.concurrency,
+    DEFAULT_CONCURRENCY
+  );
   const timeoutMs = positiveInt("--timeout", values.timeout, DEFAULT_RUN_TIMEOUT_MS / 1e3) * 1e3;
   let platforms;
   if (values.platform && values.platform.length > 0) {
@@ -2130,7 +2139,7 @@ function parseServeArgs(args) {
     requesters,
     concurrency,
     timeoutMs,
-    gateway: values.gateway ?? PREFERRED_GATEWAY,
+    ...values.gateway !== void 0 ? { gateway: values.gateway } : {},
     ...values["act-bin"] !== void 0 ? { actBin: values["act-bin"] } : {},
     ...platforms ? { platforms } : {},
     ...values.workdir !== void 0 ? { workdir: values.workdir } : {},
@@ -2230,6 +2239,8 @@ async function runCiServe(args, deps) {
     io.err(CI_SERVE_USAGE);
     return 2;
   }
+  const gateway = (flags.gateway ?? forced.env["RIG_ARWEAVE_GATEWAY"] ?? PREFERRED_GATEWAY).replace(/\/+$/, "");
+  const readGateways = [`${gateway}/raw`, ...ARWEAVE_GATEWAYS];
   let runner;
   if (forced.runner) {
     runner = forced.runner;
@@ -2267,7 +2278,8 @@ async function runCiServe(args, deps) {
       coordinatorPubkey: coordinator,
       publisher: ctx.publisher,
       relayUrl: flags.relay,
-      gatewayUrl: flags.gateway,
+      gatewayUrl: gateway,
+      gateways: readGateways,
       repos: flags.repos,
       runner,
       stateDir,
@@ -2300,7 +2312,7 @@ async function runCiServe(args, deps) {
         coordinator,
         coordinatorNpub: npub,
         relay: flags.relay,
-        gateway: flags.gateway,
+        gateway,
         repos: flags.repos,
         requesters: flags.requesters,
         runner: { family: runner.family, selectors: runner.selectors },
@@ -2357,4 +2369,4 @@ export {
   makeAffordabilityCheck,
   runCiServe
 };
-//# sourceMappingURL=ci-serve-P4HOLAMP.js.map
+//# sourceMappingURL=ci-serve-AYFZOY4O.js.map