@yunuseon/kayra 0.7.1 → 0.8.0

package/cli/dist/deployer/deployer.js

@@ -0,0 +1,282 @@
+import { randomBytes } from "node:crypto";
+import { appendFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { createInterface } from "node:readline";
+import { Readable } from "node:stream";
+import { all, err, ok } from "../result.js";
+import { field, registered } from "./app.js";
+import { appName, appOwner, jobOwner, newRunId, sha } from "./brand.js";
+import { matches, parseCron } from "./cron.js";
+import { statusRequest } from "./forge.js";
+import { json, send } from "./http.js";
+import { spawnLines } from "./process.js";
+import { empty, enqueue, finish } from "./queue.js";
+import { expired, releaseName } from "./records.js";
+import { deploy, renovate } from "./run.js";
+import { runsOf } from "./store.js";
+const token = (name) => {
+    const path = `/run/platform-secrets/${name}`;
+    return existsSync(path) ? readFileSync(path, "utf8").trim() : "";
+};
+const must = (result) => {
+    if (!result.ok)
+        throw new Error(result.error);
+    return result.value;
+};
+const settings = (env) => {
+    const scripts = env["PLATFORM_SCRIPTS"] ?? "/opt/kayra/scripts/platform";
+    const strings = Object.fromEntries(Object.entries(env).flatMap(([key, value]) => (value === undefined ? [] : [[key, value]])));
+    return {
+        platformDir: env["PLATFORM_DIR"] ?? "/opt/platform",
+        appsDir: env["APPS_DIR"] ?? "/opt/apps",
+        builder: env["BUILDER_URL"] ?? "http://builder:8081",
+        domain: env["DOMAIN"] ?? "localhost",
+        policyScript: join(scripts, "compose-policy.sh"),
+        gcScript: join(scripts, "registry-gc.sh"),
+        renovateImage: env["RENOVATE_IMAGE"] ?? "",
+        renovate: env["PLATFORM_RENOVATE"] === "true" ? must(parseCron(env["RENOVATE_SCHEDULE"] ?? "0 4 * * 1")) : undefined,
+        gc: must(parseCron("0 3 * * *")),
+        poll: must(parseCron("17 * * * *")),
+        env: strings,
+    };
+};
+const runsDir = (s) => join(s.platformDir, "runs");
+const keepRuns = 50;
+const registeredApps = (s) => {
+    const dir = join(s.platformDir, "apps");
+    return (existsSync(dir) ? readdirSync(dir) : []).flatMap((file) => {
+        const name = /^(.+)\.json$/.exec(file)?.[1];
+        const app = name === undefined ? undefined : registered(s.platformDir, name);
+        return app?.ok === true ? [app.value] : [];
+    });
+};
+const builderResolve = async (s, app, ref) => {
+    const response = await fetch(`${s.builder}/resolve`, { method: "POST", body: JSON.stringify({ app: app.name, ref }) }).catch(() => undefined);
+    if (response === undefined)
+        return err("the builder did not answer");
+    const answer = await response.json().catch(() => undefined);
+    const given = typeof answer === "object" && answer !== null ? field(answer, "sha") : undefined;
+    const problem = typeof answer === "object" && answer !== null ? field(answer, "error") : undefined;
+    return typeof given === "string" ? sha(given) : err(typeof problem === "string" ? problem : `resolve: HTTP ${String(response.status)}`);
+};
+/** The builder's NDJSON: log lines as they come, then the bundle or an error. */
+const builderPrepare = async (s, app, commit, log) => {
+    const response = await fetch(`${s.builder}/prepare`, {
+        method: "POST",
+        body: JSON.stringify({ app: app.name, sha: commit }),
+        signal: AbortSignal.timeout(45 * 60_000),
+    }).catch(() => undefined);
+    if (response?.body == null || !response.ok)
+        return err("the builder did not prepare a bundle");
+    const lines = createInterface({ input: Readable.fromWeb(response.body) });
+    const outcome = await Array.fromAsync(lines, (line) => {
+        try {
+            const message = JSON.parse(line);
+            if (typeof message !== "object" || message === null)
+                return undefined;
+            const text = field(message, "log");
+            if (typeof text === "string")
+                log(text);
+            const bundle = field(message, "bundle");
+            const problem = field(message, "error");
+            return bundle !== undefined ? ok(bundle) : typeof problem === "string" ? err(problem) : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    });
+    return outcome.findLast((item) => item !== undefined) ?? err("the builder stopped without a bundle");
+};
+const appSecrets = (app) => {
+    const read = all(app.secrets.map((key) => {
+        const path = join("/run/app-secrets", app.name, key);
+        return existsSync(path) ? ok([key, readFileSync(path, "utf8")]) : err(`${app.name}: secret ${key} is missing; run kayra apps`);
+    }));
+    return read.ok ? ok(Object.fromEntries(read.value)) : read;
+};
+const target = (s, who, id) => `https://deploy.${s.domain}/runs/${who}/${id}`;
+const effects = (s, who, id, log) => ({
+    log,
+    resolve: (app, ref) => builderResolve(s, app, ref),
+    prepare: (app, commit) => builderPrepare(s, app, commit, log),
+    exec: (argv, options) => spawnLines(argv, { ...options, timeoutMs: 20 * 60_000 }, log),
+    secrets: appSecrets,
+    workdir: (bundle, images) => {
+        const dir = mkdtempSync(join(tmpdir(), `${id}-`));
+        writeFileSync(join(dir, "images.env"), images);
+        bundle.compose.forEach((file) => {
+            mkdirSync(dirname(join(dir, file.path)), { recursive: true });
+            writeFileSync(join(dir, file.path), file.content);
+        });
+        return Promise.resolve(dir);
+    },
+    record: (app, commit, images) => {
+        const dir = join(s.platformDir, "releases", app.name);
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(join(dir, releaseName(new Date(), commit)), images);
+        return Promise.resolve();
+    },
+    status: async (app, commit, context, state, description) => {
+        const request = statusRequest(app.repo, commit, { context, state, description, target: target(s, who, id) }, token("GIT_TOKEN"));
+        if (request === undefined) {
+            log(`(no commit status: ${app.repo} is on no forge kayra knows)`);
+            return;
+        }
+        const response = await fetch(request.url, { method: "POST", headers: request.headers, body: request.body }).catch(() => undefined);
+        if (response?.ok !== true)
+            log(`(commit status ${context} not posted: ${response === undefined ? "no answer" : `HTTP ${String(response.status)}`})`);
+    },
+});
+const describe = (request) => request.work.kind === "deploy"
+    ? { what: `deploy ${request.work.ref}`, why: request.work.why }
+    : { what: `${request.work.job}${request.work.dryRun ? " (dry run)" : ""}`, why: "schedule" };
+const work = async (s, request, fx) => {
+    if (request.work.kind === "deploy") {
+        const app = registered(s.platformDir, request.work.app);
+        if (!app.ok) {
+            fx.log(app.error);
+            return { ok: false };
+        }
+        return deploy(app.value, request.work.ref, { appsDir: s.appsDir, policyScript: s.policyScript }, fx);
+    }
+    const argv = request.work.job === "gc" ? ["bash", s.gcScript] : renovate(s.env, request.work.dryRun, s.renovateImage);
+    const env = request.work.job === "renovate" ? { RENOVATE_TOKEN: token("RENOVATE_TOKEN") } : {};
+    const exit = await fx.exec(argv, { cwd: s.platformDir, env });
+    return { ok: exit.code === 0 };
+};
+/** The daemon's one mutable cell: the queue, swapped whole on every change. */
+// eslint-disable-next-line functional/prefer-immutable-types -- the daemon's state lives here, nowhere else
+const cell = { queue: empty(2) };
+/** Applies a change to the queue and starts what it lets start; returns those. */
+const swap = (s, change) => {
+    const next = change(cell.queue);
+    // eslint-disable-next-line functional/immutable-data -- the daemon's state lives here, nowhere else
+    cell.queue = next.queue;
+    next.start.forEach((request) => {
+        void start(s, request);
+    });
+    return next.start;
+};
+const start = async (s, request) => {
+    const id = newRunId(new Date(), randomBytes(3).toString("hex"));
+    const dir = join(runsDir(s), request.owner, id);
+    mkdirSync(dir, { recursive: true });
+    const { what, why } = describe(request);
+    const begun = { id, owner: request.owner, what, why, state: "running", started: new Date().toISOString() };
+    writeFileSync(join(dir, "meta.json"), JSON.stringify(begun));
+    const log = (line) => {
+        appendFileSync(join(dir, "log"), `${new Date().toISOString().slice(11, 19)} ${line}\n`);
+    };
+    const outcome = await work(s, request, effects(s, request.owner, id, log)).catch((error) => {
+        log(`deployer: ${String(error)}`);
+        return { ok: false };
+    });
+    const ended = {
+        ...begun,
+        ...(outcome.sha === undefined ? {} : { sha: outcome.sha }),
+        state: outcome.ok ? "success" : "failure",
+        finished: new Date().toISOString(),
+    };
+    writeFileSync(join(dir, "meta.json"), JSON.stringify(ended));
+    expired(readdirSync(join(runsDir(s), request.owner)), keepRuns).forEach((old) => {
+        rmSync(join(runsDir(s), request.owner, old), { recursive: true, force: true });
+    });
+    readdirSync(tmpdir())
+        .filter((name) => name.startsWith(`${id}-`))
+        .forEach((name) => {
+        rmSync(join(tmpdir(), name), { recursive: true, force: true });
+    });
+    swap(s, (queue) => finish(queue, request.owner));
+};
+const deployRequest = (app, ref, why) => ({
+    owner: appOwner(app.name),
+    work: { kind: "deploy", app: app.name, ref, why },
+});
+const jobRequest = (job, dryRun) => ({ owner: jobOwner(job), work: { kind: "job", job, dryRun } });
+/** The webhook's fallback: an app whose ref moved to a commit no run has tried yet. */
+const poll = async (s) => {
+    await Promise.all(registeredApps(s).map(async (app) => {
+        const commit = await builderResolve(s, app, app.ref);
+        const last = runsOf(runsDir(s), appOwner(app.name)).find((run) => run.sha !== undefined);
+        if (commit.ok && commit.value !== last?.sha)
+            swap(s, (queue) => enqueue(queue, deployRequest(app, app.ref, "poll")));
+    }));
+};
+const tick = (s, at) => {
+    if (matches(s.poll, at))
+        void poll(s);
+    if (matches(s.gc, at))
+        swap(s, (queue) => enqueue(queue, jobRequest("gc", false)));
+    if (s.renovate !== undefined && matches(s.renovate, at))
+        swap(s, (queue) => enqueue(queue, jobRequest("renovate", false)));
+};
+const schedule = (s) => {
+    const wait = 60_000 - (Date.now() % 60_000) + 500;
+    setTimeout(() => {
+        tick(s, new Date());
+        schedule(s);
+    }, wait);
+};
+const handle = (handler) => (request, response) => {
+    handler(request, response).catch((error) => {
+        console.error(error);
+        if (!response.headersSent)
+            send(response, 500, "internal error\n");
+    });
+};
+const accept = (s, response, request) => {
+    const started = swap(s, (queue) => enqueue(queue, request)).includes(request);
+    send(response, 202, started ? `${request.owner}: started\n` : `${request.owner}: queued, after what runs now\n`);
+};
+const control = async (s, request, response) => {
+    const path = new URL(request.url ?? "/", "http://deployer").pathname;
+    const input = await json(request);
+    if (request.method !== "POST" || typeof input !== "object" || input === null) {
+        send(response, 400, "bad request\n");
+        return;
+    }
+    if (path === "/deploy") {
+        const name = field(input, "app");
+        const ref = field(input, "ref");
+        const why = field(input, "why") === "rollback" ? "rollback" : "deploy";
+        const app = registered(s.platformDir, typeof name === "string" ? name : "");
+        if (!app.ok) {
+            send(response, 404, `${app.error}\n`);
+            return;
+        }
+        accept(s, response, deployRequest(app.value, typeof ref === "string" && ref !== "" ? ref : app.value.ref, why));
+        return;
+    }
+    const job = field(input, "job");
+    if (path === "/job" && (job === "gc" || job === "renovate")) {
+        if (job === "renovate" && s.renovate === undefined) {
+            send(response, 409, "this server has no renovate_repositories\n");
+            return;
+        }
+        accept(s, response, jobRequest(job, field(input, "dryRun") === true));
+        return;
+    }
+    send(response, 404, "not found\n");
+};
+export const serveDeployer = (env) => {
+    const s = settings(env);
+    createServer(handle(async (request, response) => {
+        const name = /^\/push\/([^/]+)$/.exec(new URL(request.url ?? "/", "http://deployer").pathname)?.[1];
+        const app = name === undefined || !appName(name).ok ? undefined : registered(s.platformDir, name);
+        if (request.method !== "POST" || app === undefined) {
+            send(response, 404, "not found\n");
+            return;
+        }
+        if (!app.ok) {
+            send(response, 404, `${app.error}\n`);
+            return;
+        }
+        accept(s, response, deployRequest(app.value, app.value.ref, "push"));
+        return Promise.resolve();
+    })).listen(8090);
+    createServer(handle((request, response) => control(s, request, response))).listen(8091, "127.0.0.1");
+    schedule(s);
+    console.log(`deployer: :8090 pushes, 127.0.0.1:8091 control; renovate ${s.renovate === undefined ? "off" : "on"}`);
+};

package/cli/dist/deployer/forge.js

@@ -0,0 +1,25 @@
+/**
+ * A commit status on the app's forge, linking to the run: GitHub's REST API,
+ * or for any other host Forgejo's (Gitea's statuses endpoint). Undefined for a
+ * repo URL neither understands.
+ */
+export const statusRequest = (repo, commit, status, token) => {
+    const match = /^(https?:\/\/[^/]+)\/([^/]+)\/([^/]+?)(\.git)?\/?$/.exec(repo);
+    if (match === null)
+        return undefined;
+    const [, origin, owner, name] = match;
+    if (origin === undefined || owner === undefined || name === undefined)
+        return undefined;
+    const body = JSON.stringify({ state: status.state, context: status.context, description: status.description, target_url: status.target });
+    return origin === "https://github.com"
+        ? {
+            url: `https://api.github.com/repos/${owner}/${name}/statuses/${commit}`,
+            headers: { Authorization: `Bearer ${token}`, Accept: "application/vnd.github+json", "Content-Type": "application/json" },
+            body,
+        }
+        : {
+            url: `${origin}/api/v1/repos/${owner}/${name}/statuses/${commit}`,
+            headers: { Authorization: `token ${token}`, "Content-Type": "application/json" },
+            body,
+        };
+};

package/cli/dist/deployer/http.js

@@ -0,0 +1,22 @@
+/** The request body, refused past `limit` bytes. */
+export const body = async (request, limit = 1 << 20) => {
+    const chunks = await Array.fromAsync(request, (chunk) => chunk);
+    const all = Buffer.concat(chunks);
+    return all.length > limit ? undefined : all;
+};
+export const json = async (request) => {
+    const raw = await body(request);
+    if (raw === undefined)
+        return undefined;
+    try {
+        const parsed = JSON.parse(raw.toString("utf8"));
+        return parsed;
+    }
+    catch {
+        return undefined;
+    }
+};
+export const send = (response, status, text, type = "text/plain; charset=utf-8") => {
+    response.writeHead(status, { "Content-Type": type });
+    response.end(text);
+};

package/cli/dist/deployer/main.js

@@ -0,0 +1,19 @@
+#!/usr/bin/env node
+import { serveBuilder } from "./builder.js";
+import { ctl } from "./ctl.js";
+import { serveDeployer } from "./deployer.js";
+/** One program, three roles: `builder`, `deployer` (the two daemons) and `ctl` (the operator, inside the deployer). */
+const [role, ...args] = process.argv.slice(2);
+if (role === "builder")
+    serveBuilder(process.env);
+else if (role === "deployer")
+    serveDeployer(process.env);
+else if (role === "ctl") {
+    // eslint-disable-next-line functional/immutable-data -- the exit status; process.exit() could cut piped output short
+    process.exitCode = await ctl(args);
+}
+else {
+    console.error("usage: main.ts builder | deployer | ctl …");
+    // eslint-disable-next-line functional/immutable-data -- the exit status
+    process.exitCode = 2;
+}

package/cli/dist/deployer/page.js

@@ -0,0 +1,32 @@
+import { log, meta, owners, runsOf } from "./store.js";
+/** The read-only runs pages at deploy.<domain>, behind Authelia: what Jenkins' job pages were for. */
+const escape = (text) => text.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;");
+const shell = (title, content) => `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escape(title)}</title>
+<style>
+:root { color-scheme: light dark; --fg: #1d1d1f; --bg: #fafafa; --muted: #6e6e73; --line: #e0e0e0; --ok: #1a7f37; --bad: #cf222e; --run: #9a6700; }
+@media (prefers-color-scheme: dark) { :root { --fg: #e6e6e6; --bg: #161618; --muted: #9a9aa0; --line: #2c2c30; --ok: #3fb950; --bad: #f85149; --run: #d29922; } }
+body { font: 15px/1.5 system-ui, sans-serif; color: var(--fg); background: var(--bg); margin: 0 auto; max-width: 72rem; padding: 1.5rem 1rem; }
+h1 { font-size: 1.3rem; } h2 { font-size: 1.05rem; margin-top: 2rem; }
+a { color: inherit; } table { border-collapse: collapse; width: 100%; }
+td { padding: .3rem .6rem .3rem 0; border-bottom: 1px solid var(--line); vertical-align: top; }
+.muted { color: var(--muted); } .success { color: var(--ok); } .failure { color: var(--bad); } .running { color: var(--run); }
+code, pre { font: 13px/1.45 ui-monospace, monospace; } pre { white-space: pre-wrap; overflow-wrap: anywhere; }
+</style></head><body>${content}</body></html>
+`;
+const row = (run) => `<tr><td><a href="/runs/${escape(run.owner)}/${escape(run.id)}"><code>${escape(run.id)}</code></a></td>` +
+    `<td class="${run.state}">${run.state}</td><td>${escape(run.what)}</td><td class="muted">${run.why}</td>` +
+    `<td><code>${run.sha === undefined ? "" : run.sha.slice(0, 12)}</code></td></tr>`;
+export const page = (runs) => {
+    const sections = owners(runs).map((who) => `<h2>${escape(who)}</h2><table>${runsOf(runs, who).slice(0, 10).map(row).join("")}</table>`);
+    return shell("Runs", `<h1>Runs</h1>${sections.length === 0 ? `<p class="muted">Nothing has run yet.</p>` : sections.join("")}`);
+};
+export const runPage = (runs, who, id) => {
+    const found = meta(runs, who, id);
+    if (found === undefined)
+        return shell("Not found", `<p><a href="/">Runs</a> · no run ${escape(id)}</p>`);
+    return shell(`${who} ${id}`, `<p><a href="/">Runs</a> · ${escape(who)}</p><h1 class="${found.state}">${escape(found.what)} — ${found.state}</h1>` +
+        `<p class="muted">${found.why}, started ${escape(found.started)}${found.finished === undefined ? "" : `, finished ${escape(found.finished)}`}</p>` +
+        `<pre>${escape(log(runs, who, id) ?? "")}</pre>`);
+};

package/cli/dist/deployer/process.js

@@ -0,0 +1,31 @@
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import { text } from "node:stream/consumers";
+/** Runs a program; its stderr, and its stdout unless captured, reach `line` one line at a time. */
+export const spawnLines = (argv, options, line) => {
+    const [program, ...args] = argv;
+    const child = spawn(program, args, {
+        cwd: options.cwd,
+        env: { ...process.env, ...options.env },
+        stdio: ["pipe", "pipe", "pipe"],
+        signal: AbortSignal.timeout(options.timeoutMs ?? 30 * 60_000),
+    });
+    // A child may exit before reading its stdin; that EPIPE is no failure of ours.
+    child.stdin.on("error", () => undefined);
+    child.stdin.end(options.stdin ?? "");
+    const stdout = options.capture === true ? text(child.stdout) : Promise.resolve("");
+    if (options.capture !== true)
+        createInterface({ input: child.stdout }).on("line", line);
+    createInterface({ input: child.stderr }).on("line", line);
+    return new Promise((resolve) => {
+        child.on("error", (error) => {
+            line(error.message);
+            resolve({ code: 127, stdout: "" });
+        });
+        child.on("close", (code) => {
+            void stdout.then((captured) => {
+                resolve({ code: code ?? 1, stdout: captured });
+            });
+        });
+    });
+};

package/cli/dist/deployer/queue.js

@@ -0,0 +1,28 @@
+export const empty = (limit) => ({ running: [], waiting: [], limit });
+const exclusive = (request) => request.work.kind === "job" && request.work.job === "gc";
+/** Starts what may start, in order; a waiting exclusive request holds back everything behind it. */
+const fill = (queue) => {
+    const pick = queue.waiting.reduce((so, request) => {
+        if (so.blocked || so.running.some(exclusive))
+            return { ...so, blocked: true };
+        if (exclusive(request)) {
+            return so.running.length === 0
+                ? { running: [request], blocked: true, start: [...so.start, request] }
+                : { ...so, blocked: true };
+        }
+        const free = so.running.length < queue.limit && !so.running.some((running) => running.owner === request.owner);
+        return free ? { ...so, running: [...so.running, request], start: [...so.start, request] } : so;
+    }, { running: queue.running, blocked: false, start: [] });
+    return {
+        queue: { ...queue, running: pick.running, waiting: queue.waiting.filter((request) => !pick.start.includes(request)) },
+        start: pick.start,
+    };
+};
+export const enqueue = (queue, request) => {
+    const waits = queue.waiting.some((waiting) => waiting.owner === request.owner);
+    const waiting = waits
+        ? queue.waiting.map((waiting) => (waiting.owner === request.owner ? request : waiting))
+        : [...queue.waiting, request];
+    return fill({ ...queue, waiting });
+};
+export const finish = (queue, owner) => fill({ ...queue, running: queue.running.filter((running) => running.owner !== owner) });

package/cli/dist/deployer/records.js

@@ -0,0 +1,46 @@
+import { runId, sha } from "./brand.js";
+import { field } from "./app.js";
+/** A release record's name: releases/<app>/<UTC time>-<sha>.env. registry-gc.sh reads the same files. */
+export const releaseName = (at, commit) => `${at.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z")}-${commit}.env`;
+/** Newest first, one per commit: the first is what runs now, the rest are what rollback offers. */
+export const releases = (names) => names
+    .toSorted()
+    .toReversed()
+    .flatMap((name) => {
+    const match = /^(\d{8}T\d{6}Z)-([0-9a-f]{40})\.env$/.exec(name);
+    const commit = sha(match?.[2] ?? "");
+    return match?.[1] === undefined || !commit.ok ? [] : [{ sha: commit.value, time: match[1] }];
+})
+    .filter((release, i, all) => all.findIndex((other) => other.sha === release.sha) === i);
+const whys = ["push", "poll", "deploy", "rollback", "schedule", "manual"];
+const states = ["running", "success", "failure"];
+const isWhy = (value) => whys.some((why) => why === value);
+const isState = (value) => states.some((state) => state === value);
+export const parseMeta = (json) => {
+    if (typeof json !== "object" || json === null)
+        return undefined;
+    const id = runId(String(field(json, "id")));
+    const owner = field(json, "owner");
+    const what = field(json, "what");
+    const why = field(json, "why");
+    const commit = sha(String(field(json, "sha")));
+    const state = field(json, "state");
+    const started = field(json, "started");
+    const finished = field(json, "finished");
+    if (!id.ok || typeof owner !== "string" || typeof what !== "string" || typeof started !== "string")
+        return undefined;
+    if (!isWhy(why) || !isState(state))
+        return undefined;
+    return {
+        id: id.value,
+        owner,
+        what,
+        why,
+        state,
+        started,
+        ...(commit.ok ? { sha: commit.value } : {}),
+        ...(typeof finished === "string" ? { finished } : {}),
+    };
+};
+/** Run directories past the newest `keep`, oldest first: what retention deletes. */
+export const expired = (ids, keep) => ids.toSorted().slice(0, Math.max(0, ids.length - keep));

package/cli/dist/deployer/run.js

@@ -0,0 +1,76 @@
+import { err, ok } from "../result.js";
+import { imagesEnv, parseBundle } from "./bundle.js";
+import { config, policy, up } from "./compose.js";
+const step = async (fx, label, argv, options) => {
+    fx.log(`── ${label}`);
+    const exit = await fx.exec(argv, options);
+    return exit.code === 0 ? ok(exit.stdout) : err(`${label} failed (exit ${String(exit.code)})`);
+};
+/**
+ * Admission, then up: the compose config of the commit being deployed must
+ * pass the policy before anything starts, and what it checked is what runs.
+ */
+const deployBundle = async (app, bundle, paths, fx) => {
+    const images = imagesEnv(bundle);
+    const secrets = fx.secrets(app);
+    if (!secrets.ok)
+        return secrets;
+    const cwd = await fx.workdir(bundle, images);
+    const resolved = await step(fx, "Admission: compose config", config(app, paths.appsDir, bundle), { cwd, env: secrets.value, capture: true });
+    if (!resolved.ok)
+        return resolved;
+    const admitted = await step(fx, "Admission: policy", policy(app, paths.policyScript), { cwd, env: {}, stdin: resolved.value });
+    if (!admitted.ok)
+        return err("refused by the compose policy");
+    const started = await step(fx, "Up", up(app, paths.appsDir, bundle), { cwd, env: secrets.value });
+    if (!started.ok)
+        return started;
+    await fx.record(app, bundle.sha, images);
+    return ok(images);
+};
+/**
+ * One deploy: the ref to a commit, its images built where missing (kayra/build),
+ * then admitted and started (kayra/deploy). Each phase posts its status on the
+ * commit; a failed build never reaches deploy.
+ */
+export const deploy = async (app, ref, paths, fx) => {
+    fx.log(`Deploying ${app.name} at ${ref}`);
+    const commit = await fx.resolve(app, ref);
+    if (!commit.ok) {
+        fx.log(commit.error);
+        return { ok: false };
+    }
+    const sha = commit.value;
+    fx.log(`── ${ref} is ${sha}`);
+    await fx.status(app, sha, "kayra/build", "pending", "Building images");
+    const raw = await fx.prepare(app, sha);
+    const bundle = raw.ok ? parseBundle(app.name, sha, raw.value) : raw;
+    if (!bundle.ok) {
+        fx.log(bundle.error);
+        await fx.status(app, sha, "kayra/build", "failure", "Build failed");
+        return { ok: false, sha };
+    }
+    await fx.status(app, sha, "kayra/build", "success", "Images built");
+    await fx.status(app, sha, "kayra/deploy", "pending", "Deploying");
+    const deployed = await deployBundle(app, bundle.value, paths, fx);
+    if (!deployed.ok) {
+        fx.log(deployed.error);
+        await fx.status(app, sha, "kayra/deploy", "failure", deployed.error);
+        return { ok: false, sha };
+    }
+    fx.log(`Deployed ${sha}`);
+    await fx.status(app, sha, "kayra/deploy", "success", "Deployed");
+    return { ok: true, sha };
+};
+/** Renovate's settings, as the platform's .env holds them; the optional ones only when set. */
+export const renovate = (env, dryRun, image) => {
+    const optional = ["RENOVATE_ENDPOINT", "RENOVATE_GIT_URL", "RENOVATE_HOST_RULES", "RENOVATE_GITHUB_COM_TOKEN"]
+        .filter((key) => (env[key] ?? "") !== "")
+        .flatMap((key) => ["-e", key]);
+    return [
+        "docker", "run", "--rm", "--network", "platform-internal",
+        "-e", "RENOVATE_TOKEN", "-e", "RENOVATE_PLATFORM", ...optional, "-e", "RENOVATE_REPOSITORIES",
+        "-e", `RENOVATE_DRY_RUN=${dryRun ? "full" : "null"}`, "-e", "LOG_LEVEL=info",
+        image,
+    ];
+};

package/cli/dist/deployer/store.js

@@ -0,0 +1,31 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { owner as mintOwner, runId } from "./brand.js";
+import { parseMeta } from "./records.js";
+/** Reading runs/: <owner>/<id>/{meta.json,log}. Only the deployer writes there. */
+const entries = (dir) => (existsSync(dir) ? readdirSync(dir).toSorted() : []);
+export const owners = (runs) => entries(runs).flatMap((name) => {
+    const minted = mintOwner(name);
+    return minted.ok ? [minted.value] : [];
+});
+export const meta = (runs, who, id) => {
+    const path = join(runs, who, id, "meta.json");
+    if (!existsSync(path))
+        return undefined;
+    try {
+        return parseMeta(JSON.parse(readFileSync(path, "utf8")));
+    }
+    catch {
+        return undefined;
+    }
+};
+/** Newest first. */
+export const runsOf = (runs, who) => entries(join(runs, who)).toReversed().flatMap((name) => {
+    const id = runId(name);
+    const found = id.ok ? meta(runs, who, id.value) : undefined;
+    return found === undefined ? [] : [found];
+});
+export const log = (runs, who, id) => {
+    const path = join(runs, who, id, "log");
+    return existsSync(path) ? readFileSync(path, "utf8") : undefined;
+};

package/cli/dist/deployer/webhook.js

@@ -0,0 +1,31 @@
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { field } from "./app.js";
+/**
+ * Whether a webhook was signed with the platform's secret: GitHub's
+ * `X-Hub-Signature-256: sha256=<hex>` (Forgejo sends it too), or Forgejo's own
+ * `X-Forgejo-Signature: <hex>`. HMAC-SHA256 over the raw body.
+ */
+export const signed = (secret, body, headers) => {
+    if (secret === "")
+        return false;
+    const hub = headers["x-hub-signature-256"];
+    const forgejo = headers["x-forgejo-signature"] ?? headers["x-gitea-signature"];
+    const given = typeof hub === "string" && hub.startsWith("sha256=") ? hub.slice(7) : typeof forgejo === "string" ? forgejo : undefined;
+    if (given === undefined || !/^[0-9a-f]{64}$/.test(given))
+        return false;
+    const expected = createHmac("sha256", secret).update(body).digest();
+    return timingSafeEqual(expected, Buffer.from(given, "hex"));
+};
+/** The ref a push event moved (`refs/heads/main`); undefined for any other event, e.g. GitHub's ping. */
+export const pushedRef = (body) => {
+    try {
+        const event = JSON.parse(body.toString("utf8"));
+        if (typeof event !== "object" || event === null)
+            return undefined;
+        const ref = field(event, "ref");
+        return typeof ref === "string" ? ref : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};

package/cli/dist/fleet.js

@@ -39,7 +39,7 @@ const vault = (descriptor) => {
         ? map(absolutePath(file), (path) => ({ kind: "file", file: vaultPasswordFile(path) }))
         : err("vault_password_file must be a path");
 };
-/** Apps live in their own repo: Jenkins clones it over HTTPS, and the app root stays inside it. */
+/** Apps live in their own repo: the builder clones it over HTTPS, and the app root stays inside it. */
 const app = (value) => {
     const entry = mapping(value);
     if (entry === undefined)