@valbuild/cli 0.137.0 → 0.138.1

package/src/publish/reportCiRun.test.ts

@@ -0,0 +1,110 @@
+import os from "os";
+import path from "path";
+import fs from "fs";
+import { ciReportFromEnv, reportCiRun } from "./reportCiRun";
+
+const actions = {
+  GITHUB_SHA: "abc123",
+  GITHUB_REF_NAME: "main",
+  GITHUB_SERVER_URL: "https://github.com",
+  GITHUB_REPOSITORY: "acme/site",
+  GITHUB_RUN_ID: "42",
+};
+
+describe("what a CI report says", () => {
+  test("takes the commit, the branch and the run from GitHub Actions", () => {
+    expect(ciReportFromEnv({ status: "failed" }, actions)).toEqual({
+      status: "ok",
+      report: {
+        status: "failed",
+        commit: "abc123",
+        branch: "main",
+        url: "https://github.com/acme/site/actions/runs/42",
+      },
+    });
+  });
+
+  test("a flag wins over the environment", () => {
+    const read = ciReportFromEnv(
+      { status: "succeeded", commit: "def456", url: "https://ci.example/1" },
+      actions,
+    );
+    expect(read).toMatchObject({
+      report: { commit: "def456", url: "https://ci.example/1" },
+    });
+  });
+
+  test("a status that is neither, or no commit, is refused by name", () => {
+    expect(ciReportFromEnv({ status: "passed" }, actions)).toMatchObject({
+      status: "error",
+      message: expect.stringContaining('"passed"'),
+    });
+    expect(ciReportFromEnv({ status: "failed" }, {})).toMatchObject({
+      status: "error",
+      message: expect.stringContaining("GITHUB_SHA"),
+    });
+  });
+});
+
+describe("sending it", () => {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "val-ci-report-"));
+  const report = {
+    status: "failed" as const,
+    commit: "abc123",
+    url: "https://github.com/acme/site/actions/runs/42",
+  };
+
+  test("posts the report to content with the project token", async () => {
+    const sent: { url: string; auth: string | null; body: unknown }[] = [];
+    const fetchImpl: typeof fetch = async (input, init) => {
+      const headers = new Headers(init?.headers);
+      sent.push({
+        url: String(input),
+        auth: headers.get("Authorization"),
+        body: JSON.parse(String(init?.body)),
+      });
+      return new Response(JSON.stringify({ recorded: true }), {
+        status: 200,
+        headers: { "Content-Type": "application/json" },
+      });
+    };
+    const result = await reportCiRun({
+      root,
+      report,
+      env: {
+        VAL_PROJECT_TOKEN: "val_pt_secret",
+        VAL_CONTENT_URL: "https://content.test",
+      },
+      fetchImpl,
+    });
+    expect(result).toEqual({ status: "reported" });
+    expect(sent).toEqual([
+      {
+        url: "https://content.test/v1/ci-runs",
+        auth: "Bearer val_pt_secret",
+        body: report,
+      },
+    ]);
+  });
+
+  test("a refusal is said, not thrown", async () => {
+    const fetchImpl: typeof fetch = async () =>
+      new Response(JSON.stringify({ message: "Unauthorized" }), {
+        status: 401,
+        headers: { "Content-Type": "application/json" },
+      });
+    const result = await reportCiRun({
+      root,
+      report,
+      env: {
+        VAL_PROJECT_TOKEN: "val_pt_revoked",
+        VAL_CONTENT_URL: "https://content.test",
+      },
+      fetchImpl,
+    });
+    expect(result).toMatchObject({
+      status: "error",
+      message: expect.stringContaining("401"),
+    });
+  });
+});

package/src/publish/reportCiRun.ts

@@ -0,0 +1,105 @@
+import { type CiRunReportBody } from "@valbuild/shared/internal";
+import { findAndEvalValConfigFile } from "../utils/evalValConfigFile";
+import { getContentHost, postJson, ContentHostError } from "./contentHost";
+import { resolvePublishCredential } from "./credentials";
+
+/**
+ * `val ci-report` -- CI saying how its build of a commit went.
+ *
+ * The last step of a connected project's workflow, run whether the build
+ * passed or not. Content learns a build failed from this and nothing else,
+ * so it needs no GitHub permission to tell an editor "Published, not on the
+ * site yet: the build failed" (valbuild/home, docs/app-mode.md, "Failures":
+ * after the seal). The run's address goes with it, for "View run".
+ *
+ * Everything has a default from GitHub Actions' own environment -- the
+ * commit it checked out, the branch it ran for, the run's URL -- so the step
+ * is one line. Never fails the job over a report it could not send: the
+ * build's own result is what the job's status is, and a report is advice.
+ */
+export type CiReport = {
+  status: "failed" | "succeeded";
+  commit: string;
+  branch?: string;
+  url?: string;
+};
+
+export function ciReportFromEnv(
+  options: {
+    status: string | undefined;
+    commit?: string;
+    branch?: string;
+    url?: string;
+  },
+  env: NodeJS.ProcessEnv = process.env,
+): { status: "ok"; report: CiReport } | { status: "error"; message: string } {
+  const status = options.status;
+  if (status !== "failed" && status !== "succeeded") {
+    return {
+      status: "error",
+      message: `--status is "failed" or "succeeded"${status === undefined ? "" : `, not "${status}"`}.`,
+    };
+  }
+  const commit = options.commit ?? env.GITHUB_SHA ?? env.VAL_GIT_COMMIT;
+  if (!commit) {
+    return {
+      status: "error",
+      message:
+        "No commit to report on: pass --commit, or run this in GitHub Actions (GITHUB_SHA).",
+    };
+  }
+  const branch = options.branch ?? env.GITHUB_REF_NAME ?? env.VAL_GIT_BRANCH;
+  const url =
+    options.url ??
+    (env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY && env.GITHUB_RUN_ID
+      ? `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}`
+      : undefined);
+  return {
+    status: "ok",
+    report: {
+      status,
+      commit,
+      ...(branch ? { branch } : {}),
+      ...(url ? { url } : {}),
+    },
+  };
+}
+
+export async function reportCiRun(options: {
+  root: string;
+  report: CiReport;
+  env?: NodeJS.ProcessEnv;
+  fetchImpl?: typeof fetch;
+}): Promise<{ status: "reported" } | { status: "error"; message: string }> {
+  const env = options.env ?? process.env;
+  const config = await findAndEvalValConfigFile(options.root).catch(() => null);
+  const credential = await resolvePublishCredential({
+    root: options.root,
+    project: config?.project ?? env.VAL_PROJECT ?? null,
+    env,
+    ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+  });
+  if (credential.status === "error") {
+    return { status: "error", message: credential.message };
+  }
+  const body: CiRunReportBody = options.report;
+  try {
+    await postJson({
+      url: `${getContentHost(env)}/v1/ci-runs`,
+      headers: { Authorization: `Bearer ${credential.credential.token}` },
+      body,
+      ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
+    });
+    return { status: "reported" };
+  } catch (e) {
+    return {
+      status: "error",
+      message:
+        e instanceof ContentHostError
+          ? `Content did not take the report (${e.statusCode}): ${e.message}`
+          : e instanceof Error
+            ? e.message
+            : String(e),
+    };
+  }
+}

package/src/publish/runPublish.ts

@@ -1,13 +1,17 @@
 import { safeReadGit } from "@valbuild/server";
+import fs from "fs";
 import path from "path";
 import { findAndEvalValConfigFile } from "../utils/evalValConfigFile";
 import {
   Artifact,
+  CollectedArtifacts,
+  DEFAULT_ARTIFACTS_DIR,
   buildHashOf,
   collectArtifacts,
   layerRevOf,
   resolveArtifactsDir,
 } from "./artifacts";
+import { BuiltArtifacts, buildArtifacts } from "./buildArtifacts";
 import {
   PublishClient,
   UploadError,
@@ -31,7 +35,10 @@ import {
 
 export type PublishOptions = {
   root?: string;
-  /** The directory whose layout is the artifact namespace. */
+  /**
+   * The directory whose layout is the artifact namespace: publish a build made
+   * elsewhere. Without it (and without a `.val/publish`), the checkout is built.
+   */
   artifacts?: string;
   commit?: string;
   branch?: string;
@@ -108,29 +115,33 @@ export async function runPublish(
     ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
   const root = options.root ? path.resolve(options.root) : process.cwd();
 
-  const dir = resolveArtifactsDir({
-    root,
-    ...(options.artifacts ? { dir: options.artifacts } : {}),
-  });
-  if (dir.status === "error") {
-    return { status: "error", message: dir.message };
-  }
-  const collected = await collectArtifacts(dir.dir);
-  for (const skipped of collected.skipped) {
-    log(`Skipped ${skipped}`);
-  }
-  if (collected.artifacts.length === 0) {
+  /*
+   * Upload-only when there is a build to upload: `--artifacts`, or the
+   * directory it defaults to. Otherwise this builds the checkout -- which is
+   * what a CI runner has, and `.val/` is never committed, so a fresh checkout
+   * always builds.
+   */
+  const prebuilt =
+    options.artifacts !== undefined ||
+    fs.existsSync(path.join(root, DEFAULT_ARTIFACTS_DIR));
+  if (!prebuilt && !fs.existsSync(path.join(root, "package.json"))) {
     return {
       status: "error",
-      message: `There is nothing in ${dir.dir}. Build the project before publishing it.`,
+      message:
+        `Nothing to publish: ${root} has no package.json to build, and no --artifacts were given.\n\n` +
+        "Run this in the project, or point at a build made elsewhere:\n\n" +
+        "    npx val publish --artifacts <directory>",
     };
   }
 
-  const layer = await layerRevOf(collected.artifacts);
-  if (layer.status === "error") {
-    return { status: "error", message: layer.message };
+  let collected: CollectedArtifacts | null = null;
+  let layerRev: string | null = null;
+  if (prebuilt) {
+    const fromDir = await collectPrebuilt(root, options.artifacts, log);
+    if (fromDir.status === "error") return fromDir;
+    collected = fromDir.collected;
+    layerRev = fromDir.layerRev;
   }
-  const layerRev = options.layerRev ?? layer.layerRev;
 
   const git = await resolveGit({ root, options, env });
   if (git.status === "error") {
@@ -138,9 +149,10 @@ export async function runPublish(
   }
 
   const config = await findAndEvalValConfigFile(root).catch(() => null);
+  const project = config?.project ?? env.VAL_PROJECT ?? null;
   const credential = await resolvePublishCredential({
     root,
-    project: config?.project ?? env.VAL_PROJECT ?? null,
+    project,
     env,
     ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
   });
@@ -148,13 +160,45 @@ export async function runPublish(
     return { status: "error", message: credential.message };
   }
 
+  const contentHost = getContentHost(env);
   const client = createPublishClient({
-    host: getContentHost(env),
+    host: contentHost,
     token: credential.credential.token,
     ...(options.fetchImpl ? { fetchImpl: options.fetchImpl } : {}),
   });
 
-  const buildHash = options.buildHash ?? buildHashOf(collected.artifacts);
+  let built: Extract<BuiltArtifacts, { status: "built" }> | null = null;
+  try {
+    if (collected === null) {
+      log("Asking content what to build against");
+      const target = await client.buildTarget();
+      const build = await buildArtifacts({
+        root,
+        target,
+        project: project ?? "",
+        contentHost,
+        git: { commit: git.commit, branch: git.branch },
+        env,
+        log,
+      });
+      if (build.status === "error") {
+        return { status: "error", message: build.message };
+      }
+      built = build;
+      for (const warning of build.warnings) log(`warn: ${warning}`);
+      const fromBuild = await collectPrebuilt(root, build.dir, log);
+      if (fromBuild.status === "error") return fromBuild;
+      collected = fromBuild.collected;
+      // Named when content already holds it; otherwise it is in the directory.
+      layerRev =
+        build.layerRev !== undefined ? build.layerRev : fromBuild.layerRev;
+    }
+  } catch (err) {
+    return errorFrom(err);
+  }
+
+  const buildHash =
+    options.buildHash ?? built?.buildHash ?? buildHashOf(collected.artifacts);
   log(
     `${count(collected.artifacts.length, "artifact")}, ${formatBytes(collected.totalBytes)}` +
       `, at ${git.commit.slice(0, 7)} on ${git.branch}`,
@@ -171,8 +215,8 @@ export async function runPublish(
         buildHash,
         commit: git.commit,
         branch: git.branch,
-        layerRev,
-        linksOwnCss: options.linksOwnCss ?? null,
+        layerRev: options.layerRev ?? layerRev,
+        linksOwnCss: options.linksOwnCss ?? built?.linksOwnCss ?? null,
         artifacts: collected.artifacts.map(({ key, sha256, bytes }) => ({
           key,
           sha256,
@@ -183,7 +227,45 @@ export async function runPublish(
     });
   } catch (err) {
     return errorFrom(err);
+  } finally {
+    // Ours to remove: a build is written to a fresh temporary directory.
+    if (built !== null) {
+      fs.rmSync(built.dir, { recursive: true, force: true });
+    }
+  }
+}
+
+/** A build on disk: its artifacts, and the layer it sends or names. */
+async function collectPrebuilt(
+  root: string,
+  artifacts: string | undefined,
+  log: (line: string) => void,
+): Promise<
+  | { status: "ok"; collected: CollectedArtifacts; layerRev: string | null }
+  | { status: "error"; message: string }
+> {
+  const dir = resolveArtifactsDir({
+    root,
+    ...(artifacts ? { dir: artifacts } : {}),
+  });
+  if (dir.status === "error") {
+    return { status: "error", message: dir.message };
+  }
+  const collected = await collectArtifacts(dir.dir);
+  for (const skipped of collected.skipped) {
+    log(`Skipped ${skipped}`);
+  }
+  if (collected.artifacts.length === 0) {
+    return {
+      status: "error",
+      message: `There is nothing in ${dir.dir}. Build the project before publishing it.`,
+    };
+  }
+  const layer = await layerRevOf(collected.artifacts);
+  if (layer.status === "error") {
+    return { status: "error", message: layer.message };
   }
+  return { status: "ok", collected, layerRev: layer.layerRev };
 }
 
 async function publishDeclaredBuild(args: {