@trebired/git-host 2.1.0 → 3.0.0

package/dist/core/actions/planner.js

@@ -0,0 +1,106 @@
+import { GitHostError } from "../../errors.js";
+import { text } from "../../utils/text.js";
+function cartesianProduct(entries) {
+    if (!entries.length)
+        return [{}];
+    const [[key, values], ...rest] = entries;
+    const remainder = cartesianProduct(rest);
+    const rows = [];
+    for (const value of values) {
+        for (const tail of remainder) {
+            rows.push({
+                [key]: value,
+                ...tail,
+            });
+        }
+    }
+    return rows;
+}
+function matrixKey(matrix) {
+    return Object.entries(matrix)
+        .sort(([left], [right]) => left.localeCompare(right))
+        .map(([key, value]) => `${key}=${String(value)}`)
+        .join("|");
+}
+function expandJobMatrix(job) {
+    const matrix = job.strategy?.matrix;
+    if (!matrix)
+        return [undefined];
+    const baseRows = cartesianProduct(Object.entries(matrix.values || {}));
+    const seen = new Set(baseRows.map((entry) => matrixKey(entry)));
+    const extras = (matrix.include || []).filter((entry) => {
+        const key = matrixKey(entry);
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+    const rows = [...baseRows, ...extras];
+    return rows.length ? rows : [undefined];
+}
+function jobDisplayName(job, matrix) {
+    if (!matrix || !Object.keys(matrix).length)
+        return job.name;
+    const suffix = Object.entries(matrix)
+        .map(([key, value]) => `${key}=${String(value)}`)
+        .join(", ");
+    return `${job.name} (${suffix})`;
+}
+function planWorkflowJobs(workflow) {
+    const planned = [];
+    let index = 0;
+    for (const job of workflow.jobs) {
+        for (const matrix of expandJobMatrix(job)) {
+            planned.push({
+                index,
+                job,
+                ...(matrix ? { matrix } : {}),
+                name: jobDisplayName(job, matrix),
+            });
+            index += 1;
+        }
+    }
+    return planned;
+}
+function assertAcyclicWorkflow(workflow) {
+    const byId = new Map(workflow.jobs.map((job) => [job.id, job]));
+    const visiting = new Set();
+    const visited = new Set();
+    function visit(jobId, trail) {
+        if (visited.has(jobId))
+            return;
+        if (visiting.has(jobId)) {
+            throw new GitHostError("forge_invalid_workflow_definition", `Workflow "${workflow.id}" has a circular needs graph.`, {
+                cycle: [...trail, jobId],
+                workflowId: workflow.id,
+            });
+        }
+        visiting.add(jobId);
+        const job = byId.get(jobId);
+        if (!job) {
+            throw new GitHostError("forge_invalid_workflow_definition", `Workflow "${workflow.id}" references unknown job "${jobId}".`, {
+                jobId,
+                workflowId: workflow.id,
+            });
+        }
+        for (const need of job.needs || []) {
+            visit(need, [...trail, jobId]);
+        }
+        visiting.delete(jobId);
+        visited.add(jobId);
+    }
+    for (const job of workflow.jobs) {
+        visit(job.id, []);
+    }
+}
+function resolveRefName(ref) {
+    const value = text(ref);
+    if (value.startsWith("refs/heads/"))
+        return value.slice("refs/heads/".length);
+    if (value.startsWith("refs/tags/"))
+        return value.slice("refs/tags/".length);
+    const segments = value.split("/");
+    return segments[segments.length - 1] || value;
+}
+export { assertAcyclicWorkflow, planWorkflowJobs, resolveRefName, };
+//# sourceMappingURL=planner.js.map

package/dist/core/actions/planner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"planner.js","sourceRoot":"","sources":["../../../src/core/actions/planner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AASrC,SAAS,gBAAgB,CAAC,OAA0D;IAClF,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC;IACzC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,IAAI,GAAqD,EAAE,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC,IAAI,CAAC;gBACR,CAAC,GAAG,CAAC,EAAE,KAAK;gBACZ,GAAG,IAAI;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAAC,MAAiD;IAClE,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAC1B,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;SAChD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,GAAwB;IAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACrD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CAAC,GAAwB,EAAE,MAAkD;IAClG,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;SAChD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,GAAG,GAAG,CAAC,IAAI,KAAK,MAAM,GAAG,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAA0B;IAClD,MAAM,OAAO,GAAiC,EAAE,CAAC;IACjD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,KAAK,MAAM,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK;gBACL,GAAG;gBACH,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,IAAI,EAAE,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YACH,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,qBAAqB,CAAC,QAA0B;IACvD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAU,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,SAAS,KAAK,CAAC,KAAa,EAAE,KAAe;QAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO;QAC/B,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,aAAa,QAAQ,CAAC,EAAE,+BAA+B,EAAE;gBACnH,KAAK,EAAE,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC;gBACxB,UAAU,EAAE,QAAQ,CAAC,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,YAAY,CAAC,mCAAmC,EAAE,aAAa,QAAQ,CAAC,EAAE,6BAA6B,KAAK,IAAI,EAAE;gBAC1H,KAAK;gBACL,UAAU,EAAE,QAAQ,CAAC,EAAE;aACxB,CAAC,CAAC;QACL,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QACjC,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAChC,KAAK,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC;AAChD,CAAC;AAED,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,cAAc,GACf,CAAC"}

package/dist/core/actions/redaction.d.ts

@@ -0,0 +1,16 @@
+import type { CreateGitForgeActionsOptions, GitForgeWorkflowRun, GitForgeWorkflowRunStep } from "../../types.js";
+declare function collectSensitiveValues(input: {
+    env?: Record<string, string>;
+    secrets?: Record<string, string>;
+    sensitiveKeys?: string[];
+}): string[];
+declare function redactSecrets(input: string, secrets: string[]): string;
+declare function createRunRedactor(input: {
+    actions: CreateGitForgeActionsOptions | undefined;
+    env?: Record<string, string>;
+    run: GitForgeWorkflowRun;
+    secrets: Record<string, string> | undefined;
+    step: GitForgeWorkflowRunStep;
+}): (chunk: string, stream?: "stderr" | "stdout") => Promise<string>;
+export { collectSensitiveValues, createRunRedactor, redactSecrets, };
+//# sourceMappingURL=redaction.d.ts.map

package/dist/core/actions/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/core/actions/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,4BAA4B,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAUhH,iBAAS,sBAAsB,CAAC,KAAK,EAAE;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B,YAMA;AAED,iBAAS,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAMtD;AAED,iBAAS,iBAAiB,CAAC,KAAK,EAAE;IAChC,OAAO,EAAE,4BAA4B,GAAG,SAAS,CAAC;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,GAAG,EAAE,mBAAmB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC5C,IAAI,EAAE,uBAAuB,CAAC;CAC/B,IAOkC,OAAO,MAAM,EAAE,SAAQ,QAAQ,GAAG,QAAmB,qBAYvF;AAED,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,GACd,CAAC"}

package/dist/core/actions/redaction.js

@@ -0,0 +1,43 @@
+function sanitizeSecretValues(values) {
+    return Array.from(new Set([...values].filter((value) => Boolean(value))))
+        .sort((left, right) => right.length - left.length);
+}
+// Gathers every value that must be masked from streamed and persisted output:
+// all values in the secrets map plus, for any caller-declared sensitive key, the
+// resolved value from secrets and from the step environment.
+function collectSensitiveValues(input) {
+    const values = [...Object.values(input.secrets || {})];
+    for (const key of input.sensitiveKeys || []) {
+        values.push(input.secrets?.[key], input.env?.[key]);
+    }
+    return sanitizeSecretValues(values);
+}
+function redactSecrets(input, secrets) {
+    let next = input;
+    for (const secret of secrets) {
+        next = next.split(secret).join("***");
+    }
+    return next;
+}
+function createRunRedactor(input) {
+    const { actions, run, step } = input;
+    const secretValues = collectSensitiveValues({
+        env: input.env,
+        secrets: input.secrets,
+        sensitiveKeys: actions?.environment?.sensitiveKeys,
+    });
+    return async function redactText(chunk, stream = "stdout") {
+        let next = redactSecrets(String(chunk || ""), secretValues);
+        if (actions?.redactOutput) {
+            next = await actions.redactOutput({
+                chunk: next,
+                run,
+                step,
+                stream,
+            });
+        }
+        return next;
+    };
+}
+export { collectSensitiveValues, createRunRedactor, redactSecrets, };
+//# sourceMappingURL=redaction.js.map

package/dist/core/actions/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/core/actions/redaction.ts"],"names":[],"mappings":"AAEA,SAAS,oBAAoB,CAAC,MAAoC;IAChE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SACvF,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,8EAA8E;AAC9E,iFAAiF;AACjF,6DAA6D;AAC7D,SAAS,sBAAsB,CAAC,KAI/B;IACC,MAAM,MAAM,GAA8B,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC;IAClF,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,aAAa,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,OAAiB;IACrD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAM1B;IACC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IACrC,MAAM,YAAY,GAAG,sBAAsB,CAAC;QAC1C,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,aAAa,EAAE,OAAO,EAAE,WAAW,EAAE,aAAa;KACnD,CAAC,CAAC;IACH,OAAO,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,SAA8B,QAAQ;QACpF,IAAI,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;QAC5D,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,IAAI,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC;gBAChC,KAAK,EAAE,IAAI;gBACX,GAAG;gBACH,IAAI;gBACJ,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;AACJ,CAAC;AAED,OAAO,EACL,sBAAsB,EACtB,iBAAiB,EACjB,aAAa,GACd,CAAC"}

package/dist/core/actions/release_assets.d.ts

@@ -0,0 +1,31 @@
+import type { GitForgeRelease, GitForgeReleaseAsset, GitForgeReleaseStorage } from "../../types/forge/releases.js";
+type ReleaseAssetArchiveFormat = "tar.gz" | "zip";
+declare function releaseAssetStoragePath(input: {
+    assetId: string;
+    fileName: string;
+    releaseAssetsRoot: string;
+    releaseId: string;
+    repositoryId: string;
+}): string;
+declare function compressDirectoryToArchive(input: {
+    destinationPath: string;
+    format: ReleaseAssetArchiveFormat;
+    sourcePath: string;
+}): Promise<{
+    size: number;
+}>;
+declare function publishReleaseAsset(input: {
+    assetName: string;
+    format: ReleaseAssetArchiveFormat;
+    releaseAssetsRoot: string;
+    releaseId?: string;
+    releases: GitForgeReleaseStorage;
+    repositoryId: string;
+    sourcePath: string;
+    tagName: string;
+}): Promise<{
+    asset: GitForgeReleaseAsset;
+    release: GitForgeRelease;
+}>;
+export { compressDirectoryToArchive, publishReleaseAsset, releaseAssetStoragePath, };
+//# sourceMappingURL=release_assets.d.ts.map

package/dist/core/actions/release_assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release_assets.d.ts","sourceRoot":"","sources":["../../../src/core/actions/release_assets.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,eAAe,EACf,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AAGvC,KAAK,yBAAyB,GAAG,QAAQ,GAAG,KAAK,CAAC;AAOlD,iBAAS,uBAAuB,CAAC,KAAK,EAAE;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;CACtB,UAOA;AAuBD,iBAAe,0BAA0B,CAAC,KAAK,EAAE;IAC/C,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,yBAAyB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;CACpB;;GAyBA;AAmCD,iBAAe,mBAAmB,CAAC,KAAK,EAAE;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,yBAAyB,CAAC;IAClC,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,sBAAsB,CAAC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,eAAe,CAAA;CAAE,CAAC,CAsCrE;AAED,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,GACxB,CAAC"}

package/dist/core/actions/release_assets.js

@@ -0,0 +1,114 @@
+import fs from "node:fs";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { GitHostError } from "../../errors.js";
+import { text } from "../../utils/text.js";
+function sanitizeAssetFileNameComponent(value) {
+    const next = text(value).replace(/[^a-zA-Z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+    return next || "asset";
+}
+function releaseAssetStoragePath(input) {
+    return path.join(input.releaseAssetsRoot, input.repositoryId, input.releaseId, `${input.assetId}-${sanitizeAssetFileNameComponent(input.fileName)}`);
+}
+function archiveContentType(format) {
+    return format === "zip" ? "application/zip" : "application/gzip";
+}
+function shellQuotePosix(value) {
+    return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function runArchiveCommand(command) {
+    return new Promise((resolve, reject) => {
+        const child = spawn("/bin/sh", ["-lc", command], { stdio: ["ignore", "ignore", "pipe"] });
+        let stderr = "";
+        child.stderr?.setEncoding("utf8");
+        child.stderr?.on("data", (chunk) => {
+            stderr += chunk;
+        });
+        child.on("error", reject);
+        child.on("close", (code) => resolve({ exitCode: typeof code === "number" ? code : 1, stderr }));
+    });
+}
+async function compressDirectoryToArchive(input) {
+    if (!fs.existsSync(input.sourcePath)) {
+        throw new GitHostError("forge_actions_runner_failed", `Path "${input.sourcePath}" does not exist.`, {
+            sourcePath: input.sourcePath,
+        });
+    }
+    fs.mkdirSync(path.dirname(input.destinationPath), { recursive: true });
+    fs.rmSync(input.destinationPath, { force: true });
+    const parentDir = path.dirname(input.sourcePath);
+    const baseName = path.basename(input.sourcePath);
+    const command = input.format === "zip"
+        ? `cd ${shellQuotePosix(parentDir)} && zip -rq ${shellQuotePosix(input.destinationPath)} ${shellQuotePosix(baseName)}`
+        : `tar -czf ${shellQuotePosix(input.destinationPath)} -C ${shellQuotePosix(parentDir)} ${shellQuotePosix(baseName)}`;
+    const result = await runArchiveCommand(command);
+    if (result.exitCode !== 0 || !fs.existsSync(input.destinationPath)) {
+        throw new GitHostError("forge_actions_runner_failed", `Failed to create ${input.format} archive for release asset.`, {
+            destinationPath: input.destinationPath,
+            exitCode: result.exitCode,
+            sourcePath: input.sourcePath,
+            stderr: result.stderr,
+        });
+    }
+    return { size: fs.statSync(input.destinationPath).size };
+}
+async function findReleaseByTag(releases, repositoryId, tagName) {
+    const existing = await releases.listReleases(repositoryId);
+    return existing.find((release) => release.tag_name === tagName) || null;
+}
+// The actions runtime only has the raw release storage, not the orchestrated
+// GitForge.createRelease() (which validates actors, creates the git tag, resolves
+// target_ref, and runs the host's normalizeAssets hook) — that method lives one
+// layer up and isn't constructed yet when the actions runtime is wired together.
+// Rather than half-reimplement release creation here with a worse-validated path,
+// this step requires the release to already exist: either create it first (via the
+// release UI/API, which is also what a `release.create`-triggered workflow already
+// has), or trigger this workflow from `release.create` so `github.event.release_id`
+// is populated automatically.
+async function resolveTargetRelease(input) {
+    if (input.releaseId) {
+        const byId = await input.releases.readRelease(input.repositoryId, input.releaseId);
+        if (byId)
+            return byId;
+    }
+    const byTag = await findReleaseByTag(input.releases, input.repositoryId, input.tagName);
+    if (byTag)
+        return byTag;
+    throw new GitHostError("forge_actions_runner_failed", `No release exists for tag "${input.tagName}". Create the release first, then re-run, or trigger this workflow from a release.create event.`, { repositoryId: input.repositoryId, tagName: input.tagName });
+}
+async function publishReleaseAsset(input) {
+    const release = await resolveTargetRelease({
+        releaseId: input.releaseId,
+        releases: input.releases,
+        repositoryId: input.repositoryId,
+        tagName: input.tagName,
+    });
+    const assetId = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+    const fileName = `${input.assetName}${input.format === "zip" ? ".zip" : ".tar.gz"}`;
+    const destinationPath = releaseAssetStoragePath({
+        assetId,
+        fileName,
+        releaseAssetsRoot: input.releaseAssetsRoot,
+        releaseId: release.id,
+        repositoryId: input.repositoryId,
+    });
+    const compressed = await compressDirectoryToArchive({
+        destinationPath,
+        format: input.format,
+        sourcePath: input.sourcePath,
+    });
+    const asset = {
+        content_type: archiveContentType(input.format),
+        id: assetId,
+        name: fileName,
+        size: compressed.size,
+        storage_pointer: destinationPath,
+    };
+    const updated = await input.releases.updateRelease(input.repositoryId, release.id, {
+        assets: [...release.assets.filter((existing) => existing.name !== fileName), asset],
+        updated_at: new Date().toISOString(),
+    });
+    return { asset, release: updated || { ...release, assets: [...release.assets, asset] } };
+}
+export { compressDirectoryToArchive, publishReleaseAsset, releaseAssetStoragePath, };
+//# sourceMappingURL=release_assets.js.map

package/dist/core/actions/release_assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release_assets.js","sourceRoot":"","sources":["../../../src/core/actions/release_assets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAM/C,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAI3C,SAAS,8BAA8B,CAAC,KAAa;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACnF,OAAO,IAAI,IAAI,OAAO,CAAC;AACzB,CAAC;AAED,SAAS,uBAAuB,CAAC,KAMhC;IACC,OAAO,IAAI,CAAC,IAAI,CACd,KAAK,CAAC,iBAAiB,EACvB,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,SAAS,EACf,GAAG,KAAK,CAAC,OAAO,IAAI,8BAA8B,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CACrE,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAiC;IAC3D,OAAO,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,kBAAkB,CAAC;AACnE,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,KAAK,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAIzC;IACC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,YAAY,CAAC,6BAA6B,EAAE,SAAS,KAAK,CAAC,UAAU,mBAAmB,EAAE;YAClG,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;IACL,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAElD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK;QACpC,CAAC,CAAC,MAAM,eAAe,CAAC,SAAS,CAAC,eAAe,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE;QACtH,CAAC,CAAC,YAAY,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,OAAO,eAAe,CAAC,SAAS,CAAC,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;IAEvH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,YAAY,CAAC,6BAA6B,EAAE,oBAAoB,KAAK,CAAC,MAAM,6BAA6B,EAAE;YACnH,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,QAAgC,EAAE,YAAoB,EAAE,OAAe;IACrG,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;IAC3D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC;AAC1E,CAAC;AAED,6EAA6E;AAC7E,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,kFAAkF;AAClF,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,8BAA8B;AAC9B,KAAK,UAAU,oBAAoB,CAAC,KAKnC;IACC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QACnF,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACxF,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,MAAM,IAAI,YAAY,CACpB,6BAA6B,EAC7B,8BAA8B,KAAK,CAAC,OAAO,iGAAiG,EAC5I,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAC7D,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,KASlC;IACC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,OAAO,EAAE,KAAK,CAAC,OAAO;KACvB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACxF,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IACpF,MAAM,eAAe,GAAG,uBAAuB,CAAC;QAC9C,OAAO;QACP,QAAQ;QACR,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,YAAY,EAAE,KAAK,CAAC,YAAY;KACjC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC;QAClD,eAAe;QACf,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,KAAK,CAAC,UAAU;KAC7B,CAAC,CAAC;IAEH,MAAM,KAAK,GAAyB;QAClC,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC;QAC9C,EAAE,EAAE,OAAO;QACX,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,eAAe,EAAE,eAAe;KACjC,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,EAAE;QACjF,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,KAAK,CAAC;QACnF,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC,CAAC;IAEH,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;AAC3F,CAAC;AAED,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,uBAAuB,GACxB,CAAC"}

package/dist/core/actions/runner/launch.d.ts

@@ -0,0 +1,5 @@
+import type { CreateGitForgeActionsOptions } from "../../../types.js";
+import type { RunnerLaunch } from "../types.js";
+declare function resolveRunnerLaunch(options: CreateGitForgeActionsOptions | undefined): RunnerLaunch;
+export { resolveRunnerLaunch };
+//# sourceMappingURL=launch.d.ts.map

package/dist/core/actions/runner/launch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch.d.ts","sourceRoot":"","sources":["../../../../src/core/actions/runner/launch.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAGlE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAoFlD,iBAAS,mBAAmB,CAAC,OAAO,EAAE,4BAA4B,GAAG,SAAS,GAAG,YAAY,CAqB5F;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/core/actions/runner/launch.js

@@ -0,0 +1,100 @@
+import { spawnSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { GitHostError } from "../../../errors.js";
+import { text } from "../../../utils/text.js";
+const RUNNER_BINARY_NAMES = {
+    "darwin-arm64": "git-host-actions-runner-darwin-arm64",
+    "darwin-x64": "git-host-actions-runner-darwin-x64",
+    "linux-arm64": "git-host-actions-runner-linux-arm64-gnu",
+    "linux-x64": "git-host-actions-runner-linux-x64-gnu",
+};
+let sourceCheckoutGoRunnerPath;
+function findPackageRoot(startPath) {
+    let current = path.resolve(startPath);
+    while (current !== path.dirname(current)) {
+        if (fs.existsSync(path.join(current, "package.json"))) {
+            return current;
+        }
+        current = path.dirname(current);
+    }
+    throw new GitHostError("forge_actions_runner_not_found", "Unable to resolve the package root for the actions runner.");
+}
+function packageRootIsSourceCheckout(packageRoot) {
+    return fs.existsSync(path.join(packageRoot, ".git"));
+}
+function resolvePackagedRunnerPath(options) {
+    const explicit = text(options?.runnerBinaryPath);
+    if (explicit)
+        return explicit;
+    const packageRoot = findPackageRoot(path.dirname(fileURLToPath(import.meta.url)));
+    if (packageRootIsSourceCheckout(packageRoot)) {
+        return null;
+    }
+    const key = `${process.platform}-${process.arch}`;
+    const binary = RUNNER_BINARY_NAMES[key];
+    if (!binary)
+        return null;
+    const candidate = path.join(packageRoot, "bin", binary);
+    return fs.existsSync(candidate) ? candidate : null;
+}
+function resolveGoFallbackCommand() {
+    if (sourceCheckoutGoRunnerPath !== undefined) {
+        return sourceCheckoutGoRunnerPath
+            ? { args: [], command: sourceCheckoutGoRunnerPath }
+            : null;
+    }
+    const packageRoot = findPackageRoot(path.dirname(fileURLToPath(import.meta.url)));
+    const sourcePath = path.join(packageRoot, "go", "cmd", "git-host-actions-runner");
+    if (!fs.existsSync(sourcePath)) {
+        sourceCheckoutGoRunnerPath = null;
+        return null;
+    }
+    const probe = spawnSync("go", ["version"], {
+        encoding: "utf8",
+    });
+    if (probe.status !== 0) {
+        sourceCheckoutGoRunnerPath = null;
+        return null;
+    }
+    const binaryDirectory = path.join(os.tmpdir(), "@trebired-git-host-actions-runner", `${process.platform}-${process.arch}`);
+    const binaryPath = path.join(binaryDirectory, "git-host-actions-runner");
+    fs.mkdirSync(binaryDirectory, { recursive: true });
+    const build = spawnSync("go", ["build", "-o", binaryPath, "./go/cmd/git-host-actions-runner"], {
+        cwd: packageRoot,
+        encoding: "utf8",
+    });
+    if (build.status !== 0 || !fs.existsSync(binaryPath)) {
+        sourceCheckoutGoRunnerPath = null;
+        return null;
+    }
+    sourceCheckoutGoRunnerPath = binaryPath;
+    return {
+        args: [],
+        command: binaryPath,
+    };
+}
+function resolveRunnerLaunch(options) {
+    const packaged = resolvePackagedRunnerPath(options);
+    if (packaged) {
+        return {
+            args: [],
+            command: packaged,
+            kind: "go",
+        };
+    }
+    const goFallback = resolveGoFallbackCommand();
+    if (goFallback) {
+        return {
+            ...goFallback,
+            kind: "go",
+        };
+    }
+    return {
+        kind: "node",
+    };
+}
+export { resolveRunnerLaunch };
+//# sourceMappingURL=launch.js.map

package/dist/core/actions/runner/launch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"launch.js","sourceRoot":"","sources":["../../../../src/core/actions/runner/launch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAIrC,MAAM,mBAAmB,GAAG;IAC1B,cAAc,EAAE,sCAAsC;IACtD,YAAY,EAAE,oCAAoC;IAClD,aAAa,EAAE,yCAAyC;IACxD,WAAW,EAAE,uCAAuC;CACpB,CAAC;AAEnC,IAAI,0BAAqD,CAAC;AAE1D,SAAS,eAAe,CAAC,SAAiB;IACxC,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,OAAO,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACtD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IACD,MAAM,IAAI,YAAY,CAAC,gCAAgC,EAAE,4DAA4D,CAAC,CAAC;AACzH,CAAC;AAED,SAAS,2BAA2B,CAAC,WAAmB;IACtD,OAAO,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,yBAAyB,CAAC,OAAiD;IAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,IAAI,2BAA2B,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAuC,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACxD,OAAO,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,SAAS,wBAAwB;IAC/B,IAAI,0BAA0B,KAAK,SAAS,EAAE,CAAC;QAC7C,OAAO,0BAA0B;YAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,0BAA0B,EAAE;YACnD,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,yBAAyB,CAAC,CAAC;IAClF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,0BAA0B,GAAG,IAAI,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE;QACzC,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,0BAA0B,GAAG,IAAI,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,mCAAmC,EAAE,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3H,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;IACzE,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,kCAAkC,CAAC,EAAE;QAC7F,GAAG,EAAE,WAAW;QAChB,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,0BAA0B,GAAG,IAAI,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0BAA0B,GAAG,UAAU,CAAC;IACxC,OAAO;QACL,IAAI,EAAE,EAAE;QACR,OAAO,EAAE,UAAU;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAiD;IAC5E,MAAM,QAAQ,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,EAAE;YACR,OAAO,EAAE,QAAQ;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,wBAAwB,EAAE,CAAC;IAC9C,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,GAAG,UAAU;YACb,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;KACb,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/core/actions/runner/protocol.d.ts

@@ -0,0 +1,7 @@
+import type { ActionsRunnerEvent, ActionsRunnerInput, ExecuteActionsRunnerInput, RunnerStepState } from "../types.js";
+declare function normalizeRunnerInput(input: ExecuteActionsRunnerInput): ActionsRunnerInput;
+declare function parseRunnerEvent(line: string): ActionsRunnerEvent;
+declare function updateLastStep(event: ActionsRunnerEvent, state: RunnerStepState): void;
+declare function appendPreview(current: string, chunk: string): string;
+export { appendPreview, normalizeRunnerInput, parseRunnerEvent, updateLastStep, };
+//# sourceMappingURL=protocol.d.ts.map

package/dist/core/actions/runner/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../../../src/core/actions/runner/protocol.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,EAChB,MAAM,eAAe,CAAC;AAavB,iBAAS,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,kBAAkB,CAuBlF;AAED,iBAAS,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAmB1D;AAED,iBAAS,cAAc,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,eAAe,QAOxE;AAED,iBAAS,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,UAGpD;AAED,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,GACf,CAAC"}

package/dist/core/actions/runner/protocol.js

@@ -0,0 +1,66 @@
+import { GitHostError } from "../../../errors.js";
+import { text } from "../../../utils/text.js";
+function normalizeStepEnv(step) {
+    if (!step.metadata?.env || typeof step.metadata.env !== "object") {
+        return undefined;
+    }
+    return Object.fromEntries(Object.entries(step.metadata.env)
+        .map(([key, value]) => [text(key), text(value)])
+        .filter(([key, value]) => key && value));
+}
+function normalizeRunnerInput(input) {
+    return {
+        branch: text(input.run.branch),
+        commit_hash: text(input.run.commit_hash),
+        env: input.actions?.env,
+        heartbeat_interval_ms: input.heartbeatIntervalMs,
+        ref: text(input.run.ref, "HEAD"),
+        release_id: text(input.run.release_id),
+        repository_id: input.run.repository_id,
+        repository_path: input.repositoryPath,
+        run_id: input.run.id,
+        shell: text(input.actions?.shell, "bash"),
+        steps: input.steps.map((step) => ({
+            command: step.command,
+            env: normalizeStepEnv(step),
+            id: step.id,
+            index: step.index,
+            name: step.name,
+            shell: text(step.metadata?.shell),
+        })),
+        workflow_id: input.run.workflow_id,
+        workspace_root: input.workspaceRoot,
+    };
+}
+function parseRunnerEvent(line) {
+    const parsed = JSON.parse(line);
+    if (!parsed || typeof parsed !== "object" || typeof parsed.type !== "string") {
+        throw new GitHostError("forge_actions_runner_protocol_error", "Actions runner emitted an invalid event payload.", {
+            line,
+        });
+    }
+    if (parsed.type !== "run.status"
+        && parsed.type !== "step.started"
+        && parsed.type !== "step.output"
+        && parsed.type !== "step.heartbeat"
+        && parsed.type !== "step.finished") {
+        throw new GitHostError("forge_actions_runner_protocol_error", `Actions runner emitted unsupported event "${parsed.type}".`, {
+            line,
+        });
+    }
+    return parsed;
+}
+function updateLastStep(event, state) {
+    if ("step_index" in event && typeof event.step_index === "number") {
+        state.lastStepIndex = event.step_index;
+    }
+    if ("step_name" in event && typeof event.step_name === "string") {
+        state.lastStepName = event.step_name;
+    }
+}
+function appendPreview(current, chunk) {
+    const next = `${current}${chunk}`;
+    return next.length <= 4000 ? next : next.slice(-4000);
+}
+export { appendPreview, normalizeRunnerInput, parseRunnerEvent, updateLastStep, };
+//# sourceMappingURL=protocol.js.map

package/dist/core/actions/runner/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../../../src/core/actions/runner/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE7C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AASrC,SAAS,gBAAgB,CAAC,IAA6B;IACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAA8B,CAAC;SACzD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAU,CAAC;SACxD,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,CAAC,CAC1C,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAgC;IAC5D,OAAO;QACL,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAC9B,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;QACxC,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,GAAG;QACvB,qBAAqB,EAAE,KAAK,CAAC,mBAAmB;QAChD,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC;QAChC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;QACtC,aAAa,EAAE,KAAK,CAAC,GAAG,CAAC,aAAa;QACtC,eAAe,EAAE,KAAK,CAAC,cAAc;QACrC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE;QACpB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;QACzC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAChC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE,gBAAgB,CAAC,IAAI,CAAC;YAC3B,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;SAClC,CAAC,CAAC;QACH,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW;QAClC,cAAc,EAAE,KAAK,CAAC,aAAa;KACpC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkD,CAAC;IACjF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7E,MAAM,IAAI,YAAY,CAAC,qCAAqC,EAAE,kDAAkD,EAAE;YAChH,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,IACE,MAAM,CAAC,IAAI,KAAK,YAAY;WACzB,MAAM,CAAC,IAAI,KAAK,cAAc;WAC9B,MAAM,CAAC,IAAI,KAAK,aAAa;WAC7B,MAAM,CAAC,IAAI,KAAK,gBAAgB;WAChC,MAAM,CAAC,IAAI,KAAK,eAAe,EAClC,CAAC;QACD,MAAM,IAAI,YAAY,CAAC,qCAAqC,EAAE,6CAA6C,MAAM,CAAC,IAAI,IAAI,EAAE;YAC1H,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAA4B,CAAC;AACtC,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB,EAAE,KAAsB;IACvE,IAAI,YAAY,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAClE,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC;IACzC,CAAC;IACD,IAAI,WAAW,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChE,KAAK,CAAC,YAAY,GAAG,KAAK,CAAC,SAAS,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAe,EAAE,KAAa;IACnD,MAAM,IAAI,GAAG,GAAG,OAAO,GAAG,KAAK,EAAE,CAAC;IAClC,OAAO,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,cAAc,GACf,CAAC"}

package/dist/core/actions/runner.d.ts

@@ -0,0 +1,6 @@
+import type { ActionsRunnerExecution, ExecuteActionsRunnerInput } from "./types.js";
+import { resolveActionsWorkspaceRoot } from "./workspace.js";
+declare function executeActionsRunner(input: ExecuteActionsRunnerInput): ActionsRunnerExecution;
+export { executeActionsRunner, resolveActionsWorkspaceRoot, };
+export type { ActionsRunnerEvent, ActionsRunnerExecution, ActionsRunnerHandle, ActionsRunnerInput, ExecuteActionsRunnerInput, } from "./types.js";
+//# sourceMappingURL=runner.d.ts.map

package/dist/core/actions/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../../src/core/actions/runner.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AACpF,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,iBAAS,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,sBAAsB,CAMtF;AAED,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAC5B,CAAC;AAEF,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,YAAY,CAAC"}

package/dist/core/actions/runner.js

@@ -0,0 +1,13 @@
+import { executeGoRunner } from "./go_runner.js";
+import { executeNodeRunner } from "./node_runner.js";
+import { resolveRunnerLaunch } from "./runner/launch.js";
+import { resolveActionsWorkspaceRoot } from "./workspace.js";
+function executeActionsRunner(input) {
+    const launch = resolveRunnerLaunch(input.actions);
+    if (launch.kind === "go") {
+        return executeGoRunner(input, launch);
+    }
+    return executeNodeRunner(input);
+}
+export { executeActionsRunner, resolveActionsWorkspaceRoot, };
+//# sourceMappingURL=runner.js.map

package/dist/core/actions/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../../../src/core/actions/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,gBAAgB,CAAC;AAE7D,SAAS,oBAAoB,CAAC,KAAgC;IAC5D,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED,OAAO,EACL,oBAAoB,EACpB,2BAA2B,GAC5B,CAAC"}

package/dist/core/actions/sandbox.d.ts

@@ -0,0 +1,4 @@
+import type { GitForgeBubblewrapSandboxOptions, GitForgeLocalRunnerChildSpec } from "../../types.js";
+declare function createBubblewrapSandbox(options?: GitForgeBubblewrapSandboxOptions): (child: GitForgeLocalRunnerChildSpec) => GitForgeLocalRunnerChildSpec;
+export { createBubblewrapSandbox, };
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/core/actions/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/core/actions/sandbox.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gCAAgC,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAuCpG,iBAAS,uBAAuB,CAAC,OAAO,GAAE,gCAAqC,IAEjD,OAAO,4BAA4B,KAAG,4BAA4B,CAO/F;AAED,OAAO,EACL,uBAAuB,GACxB,CAAC"}

package/dist/core/actions/sandbox.js

@@ -0,0 +1,46 @@
+import fs from "node:fs";
+// System paths bound read-only so a shell and common tooling can run while the
+// rest of the host filesystem stays invisible to the sandboxed step.
+const DEFAULT_SYSTEM_PATHS = ["/usr", "/bin", "/sbin", "/lib", "/lib64", "/etc"];
+function roBindArgs(paths) {
+    return paths.flatMap((entry) => (fs.existsSync(entry) ? ["--ro-bind", entry, entry] : []));
+}
+function bindArgs(paths) {
+    return paths.flatMap((entry) => ["--bind", entry, entry]);
+}
+function buildBubblewrapArgs(child, options) {
+    const systemPaths = options.systemPaths || DEFAULT_SYSTEM_PATHS;
+    const workspace = child.cwd || process.cwd();
+    return [
+        "--unshare-all",
+        ...(options.allowNetwork ? ["--share-net"] : []),
+        "--die-with-parent",
+        "--proc", "/proc",
+        "--dev", "/dev",
+        "--tmpfs", "/tmp",
+        ...roBindArgs(systemPaths),
+        ...roBindArgs(options.roBind || []),
+        "--bind", workspace, workspace,
+        ...bindArgs(options.bind || []),
+        "--chdir", workspace,
+        "--",
+        child.command,
+        ...child.args,
+    ];
+}
+// Returns a `localRunner.beforeSpawn` hook that wraps each step in bubblewrap
+// (`bwrap`). By default the step gets an isolated filesystem view (read-only
+// system paths plus a writable job workspace), no network, and fresh
+// pid/ipc/uts/user namespaces. Linux-only; requires `bwrap` on PATH.
+function createBubblewrapSandbox(options = {}) {
+    const bwrapPath = options.bwrapPath || "bwrap";
+    return function beforeSpawn(child) {
+        return {
+            ...child,
+            args: buildBubblewrapArgs(child, options),
+            command: bwrapPath,
+        };
+    };
+}
+export { createBubblewrapSandbox, };
+//# sourceMappingURL=sandbox.js.map