@xemahq/repo-build-tooling 0.29.0 → 0.30.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xemahq/repo-build-tooling",
-  "version": "0.29.0",
+  "version": "0.30.0",
   "description": "Dev-time build tooling shared by every Xema repository. Ships as plain ESM, depending only on @xemahq/release-policy for registry access, so the published artifact is the reviewed source.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
@@ -46,12 +46,13 @@
     "./service-image": "./src/service-image.mjs"
   },
   "dependencies": {
+    "@xemahq/contracts": "^0.117.1",
     "@xemahq/release-policy": "^16.0.0"
   },
   "scripts": {
     "test": "node src/scrub-swagger-plugin-paths.mjs --self-test && node --test src/check-workspace-range-matches-local.test.mjs && node --test src/check-no-vendored-deps.test.mjs && node --test src/readiness.test.mjs && node --test src/composed-image.test.mjs && node --test src/composed-image-coordinate-cli.test.mjs && node --test src/declaration-refusal.test.mjs && node --test src/smoke-refusal.test.mjs && node --test src/load-image.test.mjs && node --test src/composed-image-coordinate.test.mjs && node --test src/composed-image-dockerfile.test.mjs && node --test src/service-bootstrap.test.mjs && node --test src/service-bootstrap-protocols.test.mjs && node --test src/composed-image-prebuilt-dockerfile.test.mjs && node --test src/composed-image-in-image-closure.test.mjs && node --test src/composed-image-stage.test.mjs && node --test src/composed-image-stage-tree.test.mjs && node --test src/composed-image-install.test.mjs && node --test src/composed-image-proof.test.mjs && node --test src/composed-image-pnpm-context.test.mjs && node --test src/composed-image-sync-injected.test.mjs && node --test src/composed-image-prisma-check.test.mjs && node --test src/composed-image-prisma-engine.test.mjs && node --test src/composed-migrate.test.mjs && node --test src/promote-image.test.mjs && node --test src/arm64-supplement-needed.test.mjs && node --test src/service-image.test.mjs && node --test src/image-cpu-arch.test.mjs && node --test src/staged-image-proof.test.mjs && node --test src/effective-input.test.mjs"
   },
   "xemaRelease": {
-    "sourceDigest": "sha256:a5327bf366fb31aeef8adb584888e52a5ae4da7aa5602eb672eb2876ed912a8b"
+    "sourceDigest": "sha256:4e12229e82ad289a206a1869e7811343c54502c154d87fd652c435de2263d0d2"
   }
 }

package/src/effective-input.mjs

@@ -22,9 +22,11 @@
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import { readFileSync, readlinkSync, writeFileSync } from 'node:fs';
-import { join, posix, resolve } from 'node:path';
+import { join, posix, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+import { effectiveInputTag } from '@xemahq/contracts/distribution';
+
 import { invokedDirectly } from './invoked-directly.mjs';
 import { rootBuildInputNames } from './staged-image-proof.mjs';
 
@@ -32,7 +34,7 @@ export const KEY_SCHEMA = 1;
 /** Build args that are a root-relative path or the commit, never part of the key. */
 export const NON_CONTENT_BUILD_ARGS = Object.freeze(['REPO_DIR', 'SERVICE_PATH', 'BUILD_SHA']);
 const DIGEST_PINNED = /^[^\s@]+@sha256:[0-9a-f]{64}$/;
-const COMPILE_ROOT_FILE = /^(\.npmrc|tsconfig[^/]*\.json)$/;
+const COMPILE_ROOT_FILE = /^(\.npmrc|turbo\.json|tsconfig[^/]*\.json)$/;
 const DEPENDENCY_SECTIONS = ['dependencies', 'devDependencies', 'optionalDependencies'];
 const sha256 = (bytes) => createHash('sha256').update(bytes).digest('hex');
 
@@ -278,20 +280,27 @@ export function trackedFiles(root, dir) {
   return files;
 }
 
+/** `{ fileName: bytes }` of the root files that steer the compile and the build: `.npmrc`, `turbo.json`, `tsconfig*.json`. */
+export function readRootConfig(root) {
+  return Object.fromEntries(rootBuildInputNames(root).filter((n) => COMPILE_ROOT_FILE.test(n)).map((n) => [n, readFileSync(join(root, n))]));
+}
+
 /** The key and parts of each of `services`, from one package-graph query and one read of the lockfile and tooling. */
 export function effectiveInputKeys({ root, services, platform, baseImage, dockerfile, scripts, buildArgs = {} }) {
   if (!Array.isArray(services) || services.length === 0) throw new Error('at least one service is required');
-  const names = scripts.map((x) => posix.basename(x));
+  // A script is named by its root-relative path, so two files called `action.yml` in different directories are distinct.
+  const scriptName = (x) => relative(root, resolve(root, x)).split(sep).join('/');
+  const names = scripts.map(scriptName);
   const duplicate = names.find((n, i) => names.indexOf(n) !== i);
-  if (duplicate !== undefined) throw new Error(`two --script files are named '${duplicate}': the key names scripts by file name`);
+  if (duplicate !== undefined) throw new Error(`--script '${duplicate}' is passed twice`);
   const graph = packageGraph(root);
   const toolManifest = JSON.parse(readFileSync(join(HERE, '..', 'package.json'), 'utf8'));
-  const rootConfig = Object.fromEntries(rootBuildInputNames(root).filter((n) => COMPILE_ROOT_FILE.test(n)).map((n) => [n, readFileSync(join(root, n))]));
+  const rootConfig = readRootConfig(root);
   const lockText = readFileSync(join(root, 'pnpm-lock.yaml'), 'utf8');
   const install = installInputs({ lockText, packageJson: readFileSync(join(root, 'package.json'), 'utf8'), workspaceYaml: readFileSync(join(root, 'pnpm-workspace.yaml'), 'utf8') });
   const tooling = {
     dockerfile: readFileSync(dockerfile),
-    scripts: Object.fromEntries(scripts.map((s) => [posix.basename(s), readFileSync(s)])),
+    scripts: Object.fromEntries(scripts.map((s) => [scriptName(s), readFileSync(resolve(root, s))])),
     buildArgs,
     stageTool: { name: toolManifest.name, version: toolManifest.version },
   };
@@ -320,15 +329,6 @@ export function effectiveInputKey({ service, ...options }) {
   return effectiveInputKeys({ ...options, services: [service] })[service];
 }
 
-/**
- * The one place a key becomes its registry tag: `ei-<key>`. INTERIM: this is to move to `@xemahq/contracts/distribution`
- * (edition's ruling), the single home of the prefix; until it is published this is the one copy.
- */
-export function effectiveInputTag(key) {
-  if (!/^[0-9a-f]{64}$/.test(key)) throw new Error(`'${key}' is not an effective-input key (64 lowercase hex)`);
-  return `ei-${key}`;
-}
-
 /**
  * The `--out` map: per service `{ schema, platform, key, parts, tag }`. `tag` is built only by `effectiveInputTag`, so a consumer
  * (release-policy's `prepare --effective-inputs`) reads it here and declares no prefix.

package/src/effective-input.test.mjs

@@ -6,7 +6,9 @@ import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { test } from 'node:test';
 
-import { canonicalJson, closureIn, effectiveInput, effectiveInputKeys, effectiveInputRecord, effectiveInputTag, installInputs, lockfileSlice, parseArgs, trackedFiles } from './effective-input.mjs';
+import { effectiveInputTag } from '@xemahq/contracts/distribution';
+
+import { canonicalJson, closureIn, effectiveInput, effectiveInputKeys, effectiveInputRecord, installInputs, lockfileSlice, parseArgs, readRootConfig, trackedFiles } from './effective-input.mjs';
 
 const DIGEST = `ghcr.io/x/node-runtime@sha256:${'a'.repeat(64)}`;
 const lock = (prefix, settings = 'autoInstallPeers: true') => `lockfileVersion: '9.0'
@@ -146,6 +148,7 @@ test('each input class changes the key', () => {
       'base image digest': keyOf(ws, { baseImage: `ghcr.io/x/node-runtime@sha256:${'b'.repeat(64)}` }),
       arch: keyOf(ws, { platform: 'linux/amd64' }),
       'root compile config': keyOf(ws, { rootConfig: { ...base.rootConfig, '.npmrc': 'a=c' } }),
+      'root turbo config': keyOf(ws, { rootConfig: { ...base.rootConfig, 'turbo.json': '{"tasks":{}}' } }),
     };
     for (const [name, key] of Object.entries(variants)) assert.notEqual(key, original, `${name} must change the key`);
     assert.equal(new Set(Object.values(variants)).size, Object.keys(variants).length, 'the classes are distinct');
@@ -204,13 +207,6 @@ test('the command line takes repeated build args and refuses a duplicate', () =>
   assert.throws(() => parseArgs([...argv, '--build-arg', 'A=2']), /given twice/);
 });
 
-test('the tag is ei-<key>, and a bad key is refused', () => {
-  const key = 'a'.repeat(64);
-  assert.equal(effectiveInputTag(key), `ei-${key}`);
-  assert.throws(() => effectiveInputTag('abc'), /not an effective-input key/);
-  assert.throws(() => effectiveInputTag('ei-' + key), /not an effective-input key/);
-});
-
 test('the closure is walked transitively from the package graph, including a package with no build task, and refuses an unknown service', () => {
   const graph = new Map([
     ['svc', { name: 'svc', dir: 'apps/svc', dependencies: ['mid', 'external'] }],
@@ -244,8 +240,26 @@ test('a lockfileVersion other than 9.0 is refused by name', () => {
   }
 });
 
-test('two scripts with the same file name are refused', () => {
-  assert.throws(() => effectiveInputKeys({ root: '.', services: ['s'], platform: 'linux/arm64', baseImage: DIGEST, dockerfile: 'D', scripts: ['a/x.mjs', 'b/x.mjs'] }), /two --script files are named 'x.mjs'/);
+test('the same script passed twice is refused', () => {
+  assert.throws(() => effectiveInputKeys({ root: '.', services: ['s'], platform: 'linux/arm64', baseImage: DIGEST, dockerfile: 'D', scripts: ['a/x.mjs', './a/x.mjs'] }), /--script 'a\/x.mjs' is passed twice/);
+});
+
+test('editing the root turbo.json changes the key, through the real root-file read', () => {
+  const ws = workspace('');
+  try {
+    execFileSync('git', ['init', '-q'], { cwd: ws.root });
+    writeFileSync(join(ws.root, '.npmrc'), 'a=b');
+    writeFileSync(join(ws.root, 'turbo.json'), '{"tasks":{"build":{}}}');
+    for (const f of ['.npmrc', 'turbo.json']) execFileSync('git', ['add', f], { cwd: ws.root });
+    const keyNow = () => keyOf(ws, { rootConfig: readRootConfig(ws.root) });
+    assert.deepEqual(Object.keys(readRootConfig(ws.root)).sort(), ['.npmrc', 'turbo.json']);
+    const before = keyNow();
+    assert.equal(keyNow(), before);
+    writeFileSync(join(ws.root, 'turbo.json'), '{"tasks":{"build":{"outputs":["dist/**"]}}}');
+    assert.notEqual(keyNow(), before);
+  } finally {
+    rmSync(ws.root, { recursive: true });
+  }
 });
 
 test('the --out map carries the tag per service, from effectiveInputTag', () => {