@wtfalch/foundry 0.72.0 → 0.72.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/native-build.d.ts
CHANGED
|
@@ -34,7 +34,9 @@ export interface NativeBuildDispatchDeps {
|
|
|
34
34
|
timeoutMs?: number;
|
|
35
35
|
}
|
|
36
36
|
/**
|
|
37
|
-
* Dispatches `build-app.yml` with exactly `{ runId, origin }` as its inputs
|
|
37
|
+
* Dispatches `build-app.yml` with exactly `{ runId, origin }` as its inputs,
|
|
38
|
+
* plus `runSecret` when the caller gives one (boule#433: Boule mints it per
|
|
39
|
+
* run and requires it at build-keys; never logged here):
|
|
38
40
|
* `runId` is the run the caller (Archon, behind its own `/api/native/builds`
|
|
39
41
|
* route) already made, `origin` is the company's Boule address the job
|
|
40
42
|
* reports its status back to and trades its OIDC token for keys at. Foundry
|
|
@@ -44,6 +46,7 @@ export interface NativeBuildDispatchDeps {
|
|
|
44
46
|
export declare function dispatchNativeBuild(deps: NativeBuildDispatchDeps, run: {
|
|
45
47
|
runId: string;
|
|
46
48
|
origin: string;
|
|
49
|
+
runSecret?: string;
|
|
47
50
|
}): Promise<void>;
|
|
48
51
|
/**
|
|
49
52
|
* @deprecated foundry#987: Archon's native-build route checks the company's own org credential
|
package/dist/native-build.js
CHANGED
|
@@ -33,7 +33,9 @@ export class NativeBuildDispatchError extends Error {
|
|
|
33
33
|
}
|
|
34
34
|
}
|
|
35
35
|
/**
|
|
36
|
-
* Dispatches `build-app.yml` with exactly `{ runId, origin }` as its inputs
|
|
36
|
+
* Dispatches `build-app.yml` with exactly `{ runId, origin }` as its inputs,
|
|
37
|
+
* plus `runSecret` when the caller gives one (boule#433: Boule mints it per
|
|
38
|
+
* run and requires it at build-keys; never logged here):
|
|
37
39
|
* `runId` is the run the caller (Archon, behind its own `/api/native/builds`
|
|
38
40
|
* route) already made, `origin` is the company's Boule address the job
|
|
39
41
|
* reports its status back to and trades its OIDC token for keys at. Foundry
|
|
@@ -55,7 +57,11 @@ export async function dispatchNativeBuild(deps, run) {
|
|
|
55
57
|
},
|
|
56
58
|
body: JSON.stringify({
|
|
57
59
|
ref: NATIVE_BUILD_WORKFLOW_REF,
|
|
58
|
-
inputs: {
|
|
60
|
+
inputs: {
|
|
61
|
+
runId: run.runId,
|
|
62
|
+
origin: run.origin,
|
|
63
|
+
...(run.runSecret ? { runSecret: run.runSecret } : {}),
|
|
64
|
+
},
|
|
59
65
|
}),
|
|
60
66
|
signal: AbortSignal.timeout(timeoutMs),
|
|
61
67
|
});
|
|
@@ -2226,6 +2226,8 @@ export async function provisionAuthStack(scope, deps, target, input) {
|
|
|
2226
2226
|
key: 'CUSTOM_REQUEST_HEADERS',
|
|
2227
2227
|
value: `Host:${hostname},X-Forwarded-Proto:https`,
|
|
2228
2228
|
},
|
|
2229
|
+
// #1086: the login builds redirects for an unbound host from this, never from a header.
|
|
2230
|
+
{ key: 'ZITADEL_DOMAIN', value: hostname },
|
|
2229
2231
|
{ key: 'OTEL_NODE_RESOURCE_DETECTORS', value: 'none' },
|
|
2230
2232
|
{ key: 'API_CACHE_CONFIG', value: '{"defaultMinutes":2,"longMinutes":5}' },
|
|
2231
2233
|
// #405: the login app's own requestId-free fallback (`resolveRedirectUri`
|