hammerkit 1.10.0 → 1.11.1

package/build.schema.json

@@ -141,7 +141,15 @@
                           "type": "object",
                           "properties": {
                             "export": {
-                              "type": "boolean"
+                              "anyOf": [
+                                {
+                                  "type": "boolean"
+                                },
+                                {
+                                  "type": "string",
+                                  "const": "always"
+                                }
+                              ]
                             },
                             "resetOnChange": {
                               "type": "boolean"
@@ -151,6 +159,9 @@
                             },
                             "name": {
                               "type": "string"
+                            },
+                            "readOnly": {
+                              "type": "boolean"
                             }
                           },
                           "required": [
@@ -170,6 +181,33 @@
                   "timeout": {
                     "type": "string"
                   },
+                  "secrets": {
+                    "type": "array",
+                    "items": {
+                      "type": "object",
+                      "properties": {
+                        "from": {
+                          "type": "string",
+                          "pattern": "^(env|file):.+$"
+                        },
+                        "env": {
+                          "type": "string",
+                          "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
+                        },
+                        "path": {
+                          "type": "string"
+                        },
+                        "cache": {
+                          "type": "boolean"
+                        }
+                      },
+                      "required": [
+                        "from"
+                      ],
+                      "additionalProperties": false,
+                      "description": "secret from env:NAME or file:path, injected as env or a read-only file"
+                    }
+                  },
                   "image": {
                     "type": "string"
                   },
@@ -228,6 +266,9 @@
                   "timeout": {
                     "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/timeout"
                   },
+                  "secrets": {
+                    "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/secrets"
+                  },
                   "platform": {
                     "type": "object",
                     "properties": {
@@ -341,6 +382,16 @@
                       "cmd"
                     ],
                     "additionalProperties": false
+                  },
+                  "init": {
+                    "type": "string",
+                    "description": "task run once the service is healthy, before dependents start"
+                  },
+                  "secrets": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/definitions/hammerkit/properties/tasks/additionalProperties/anyOf/0/properties/secrets/items"
+                    }
                   }
                 },
                 "required": [

package/dist/cli.js

@@ -57,6 +57,7 @@ class Cli {
                         cacheReadOnly: options?.cacheReadOnly ?? false,
                         timeout: options?.timeout ?? null,
                         skipDeps: options?.skipDeps ?? true,
+                        wait: options?.wait ?? 'ready',
                     });
                 }
                 const result = (0, get_scheduler_execute_result_1.getSchedulerExecuteResult)(workTree);

package/dist/executer/container-secrets.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.removeContainerSecrets = exports.resolveSecretEnvs = exports.prepareContainerSecrets = exports.getSecretDirectory = void 0;
+const path_1 = require("path");
+const promises_1 = require("fs/promises");
+const work_secret_1 = require("../planner/work-secret");
+const get_cache_directory_1 = require("../optimizer/get-cache-directory");
+const execute_docker_1 = require("./execute-docker");
+// Where values of env-sourced file targets are written while their container
+// runs: owner-only, outside the project, removed with the container.
+function getSecretDirectory(instanceId) {
+    return (0, path_1.join)((0, get_cache_directory_1.getHammerkitDirectory)(), 'secrets', instanceId);
+}
+exports.getSecretDirectory = getSecretDirectory;
+// Resolve every secret before the container starts, so a missing source fails
+// naming the secret and nothing has run yet.
+async function prepareContainerSecrets(secrets, instanceId, environment) {
+    const result = { env: {}, binds: [] };
+    for (const secret of secrets) {
+        if (secret.target.type === 'env') {
+            result.env[secret.target.name] = await (0, work_secret_1.resolveSecretValue)(secret, environment);
+            continue;
+        }
+        if (secret.source.type === 'file') {
+            await (0, work_secret_1.resolveSecretValue)(secret, environment);
+            result.binds.push(`${secret.source.path}:${(0, execute_docker_1.convertToPosixPath)(secret.target.path)}:ro`);
+            continue;
+        }
+        const directory = getSecretDirectory(instanceId);
+        await (0, promises_1.mkdir)(directory, { recursive: true, mode: 0o700 });
+        await (0, promises_1.chmod)(directory, 0o700);
+        const file = (0, path_1.join)(directory, getSecretFileName(secret));
+        await (0, promises_1.writeFile)(file, await (0, work_secret_1.resolveSecretValue)(secret, environment), { mode: 0o600 });
+        // the mode only applies on create, a leftover file is tightened too
+        await (0, promises_1.chmod)(file, 0o600);
+        result.binds.push(`${file}:${(0, execute_docker_1.convertToPosixPath)(secret.target.path)}:ro`);
+    }
+    return result;
+}
+exports.prepareContainerSecrets = prepareContainerSecrets;
+// A local task only takes env targets, file targets are refused when planning.
+async function resolveSecretEnvs(secrets, environment) {
+    const envs = {};
+    for (const secret of secrets) {
+        if (secret.target.type === 'env') {
+            envs[secret.target.name] = await (0, work_secret_1.resolveSecretValue)(secret, environment);
+        }
+    }
+    return envs;
+}
+exports.resolveSecretEnvs = resolveSecretEnvs;
+async function removeContainerSecrets(instanceId) {
+    await (0, promises_1.rm)(getSecretDirectory(instanceId), { recursive: true, force: true });
+}
+exports.removeContainerSecrets = removeContainerSecrets;
+function getSecretFileName(secret) {
+    return (0, work_secret_1.getSecretName)(secret).replace(/[^A-Za-z0-9._-]+/g, '_');
+}
+//# sourceMappingURL=container-secrets.js.map

package/dist/executer/deadline.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withDeadline = void 0;
+const abort_event_1 = require("../utils/abort-event");
+// An abort signal that follows `parent` and additionally fires after `timeout`
+// ms, so a task deadline reuses the runtimes' existing abort/cleanup path.
+function withDeadline(parent, timeout) {
+    const controller = new AbortController();
+    let expired = false;
+    const parentListener = (0, abort_event_1.listenOnAbort)(parent, () => controller.abort());
+    const timer = timeout === null
+        ? null
+        : setTimeout(() => {
+            expired = true;
+            controller.abort();
+        }, timeout);
+    return {
+        signal: controller.signal,
+        expired: () => expired,
+        clear() {
+            if (timer) {
+                clearTimeout(timer);
+            }
+            parentListener.close();
+        },
+    };
+}
+exports.withDeadline = withDeadline;
+//# sourceMappingURL=deadline.js.map

package/dist/executer/docker-service.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.dockerService = void 0;
+exports.dockerService = exports.buildServiceCreateOptions = void 0;
 const work_service_1 = require("../planner/work-service");
 const run_labels_1 = require("../docker/run-labels");
+const service_hostname_1 = require("../planner/utils/service-hostname");
+const service_definition_1 = require("../planner/service-definition");
 const abort_1 = require("./abort");
 const execute_docker_1 = require("./execute-docker");
 const stream_1 = require("../docker/stream");
@@ -13,11 +15,59 @@ const check_readiness_1 = require("./check-readiness");
 const main_process_user_1 = require("./main-process-user");
 const execution_steps_1 = require("./execution-steps");
 const docker_task_1 = require("./docker-task");
+const container_secrets_1 = require("./container-secrets");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
 const get_service_containers_1 = require("./get-service-containers");
 const work_instance_id_1 = require("../planner/work-instance-id");
 const work_healthcheck_1 = require("../planner/work-healthcheck");
 const HEALTHCHECK_INTERVAL_MS = 1000;
+function buildServiceCreateOptions(item, options, network, secrets) {
+    const envs = (0, replace_env_variables_1.getEnvironmentVariables)(item.data.envs);
+    const command = (0, work_service_1.getServiceCommand)(item.data);
+    return {
+        Image: item.data.image,
+        Hostname: (0, service_hostname_1.getServiceHostname)(item.name),
+        Env: Object.entries({ ...envs, ...secrets.env }).map(([key, value]) => `${key}=${value}`),
+        Labels: {
+            app: 'hammerkit',
+            'hammerkit-id': (0, work_instance_id_1.getWorkInstanceId)(item),
+            ...(0, run_labels_1.getRunLabels)(),
+            'hammerkit-type': 'service',
+            'hammerkit-state': options.stateKey,
+            'hammerkit-daemon': options.daemon ? 'true' : 'false',
+            'hammerkit-definition': (0, service_definition_1.getServiceDefinitionHash)(item),
+        },
+        ExposedPorts: item.data.ports.reduce((map, port) => {
+            map[`${port.containerPort}/tcp`] = {};
+            return map;
+        }, {}),
+        Entrypoint: command.entrypoint ?? undefined,
+        Cmd: command.cmd ?? undefined,
+        WorkingDir: (0, execute_docker_1.convertToPosixPath)((0, work_service_1.getServiceWorkingDir)(item.data)),
+        HostConfig: {
+            ExtraHosts: network.hosts,
+            Links: network.links,
+            Binds: [
+                ...item.data.src.map((s) => `${s.absolutePath}:${s.absolutePath}`),
+                ...item.data.mounts.map((v) => `${v.localPath}:${(0, execute_docker_1.convertToPosixPath)(v.containerPath)}${v.readOnly ? ':ro' : ''}`),
+                ...item.data.volumes.map((v) => `${v.name}:${(0, execute_docker_1.convertToPosixPath)(v.containerPath)}${v.readOnly ? ':ro' : ''}`),
+                ...secrets.binds,
+            ],
+            // host ports are for `hammerkit up` and local tasks; container tasks
+            // reach the service over its link, and a run publishing them would
+            // collide with another run on the same host
+            PortBindings: options.publishPorts
+                ? item.data.ports
+                    .filter((p) => !!p.hostPort)
+                    .reduce((map, port) => {
+                    map[`${port.containerPort}/tcp`] = [{ HostPort: `${port.hostPort}` }];
+                    return map;
+                }, {})
+                : {},
+        },
+    };
+}
+exports.buildServiceCreateOptions = buildServiceCreateOptions;
 async function dockerService(docker, item, options, environment) {
     let container = null;
     try {
@@ -30,46 +80,12 @@ async function dockerService(docker, item, options, environment) {
         const serviceContainers = (0, get_service_containers_1.getServiceContainers)(item.needs);
         const network = (0, docker_task_1.getNeedsNetwork)(serviceContainers, item.needs);
         item.status.write('debug', `create container with image ${item.data.image}`);
-        const envs = (0, replace_env_variables_1.getEnvironmentVariables)(item.data.envs);
-        const command = (0, work_service_1.getServiceCommand)(item.data);
-        container = await docker.createContainer({
-            Image: item.data.image,
-            Env: Object.keys(envs).map((k) => `${k}=${envs[k]}`),
-            Labels: {
-                app: 'hammerkit',
-                'hammerkit-id': (0, work_instance_id_1.getWorkInstanceId)(item),
-                ...(0, run_labels_1.getRunLabels)(),
-                'hammerkit-type': 'service',
-                'hammerkit-state': options.stateKey,
-                'hammerkit-daemon': options.daemon ? 'true' : 'false',
-            },
-            ExposedPorts: item.data.ports.reduce((map, port) => {
-                map[`${port.containerPort}/tcp`] = {};
-                return map;
-            }, {}),
-            Entrypoint: command.entrypoint ?? undefined,
-            Cmd: command.cmd ?? undefined,
-            WorkingDir: (0, execute_docker_1.convertToPosixPath)((0, work_service_1.getServiceWorkingDir)(item.data)),
-            HostConfig: {
-                ExtraHosts: network.hosts,
-                Links: network.links,
-                Binds: [
-                    ...item.data.src.map((s) => `${s.absolutePath}:${s.absolutePath}`),
-                    ...item.data.mounts.map((v) => `${v.localPath}:${(0, execute_docker_1.convertToPosixPath)(v.containerPath)}`),
-                    ...item.data.volumes.map((v) => `${v.name}:${(0, execute_docker_1.convertToPosixPath)(v.containerPath)}`),
-                ],
-                PortBindings: item.data.ports
-                    .filter((p) => !!p.hostPort)
-                    .reduce((map, port) => {
-                    map[`${port.containerPort}/tcp`] = [{ HostPort: `${port.hostPort}` }];
-                    return map;
-                }, {}),
-            },
-        });
+        const secrets = await (0, container_secrets_1.prepareContainerSecrets)(item.data.secrets, (0, work_instance_id_1.getWorkInstanceId)(item), environment);
+        container = await docker.createContainer(buildServiceCreateOptions(item, options, network, secrets));
         const stream = await container.attach({ stream: true, stdout: true, stderr: true });
         (0, stream_1.logStream)(item.status, stream);
         await container.start();
-        if (!item.data.healthcheck) {
+        if (!item.data.healthcheck || !options.waitForReady) {
             options.state.set({
                 type: 'running',
                 dns: { containerId: container.id },
@@ -149,6 +165,10 @@ async function dockerService(docker, item, options, environment) {
                 item.status.write('error', `remove of container failed ${(0, log_1.getErrorMessage)(e)}`);
             }
         }
+        // a daemon keeps its secret files until `hammerkit down` stops it
+        if (!options.daemon) {
+            await (0, container_secrets_1.removeContainerSecrets)((0, work_instance_id_1.getWorkInstanceId)(item));
+        }
     }
 }
 exports.dockerService = dockerService;

package/dist/executer/docker-task.js

@@ -15,6 +15,7 @@ const get_container_binds_1 = require("./get-container-binds");
 const get_service_containers_1 = require("./get-service-containers");
 const work_instance_id_1 = require("../planner/work-instance-id");
 const get_outputs_to_reset_1 = require("../planner/utils/get-outputs-to-reset");
+const container_secrets_1 = require("./container-secrets");
 const container_task_state_1 = require("./container-task-state");
 function getNeedsNetwork(serviceContainers, needs) {
     const links = [];
@@ -34,7 +35,7 @@ function getNeedsNetwork(serviceContainers, needs) {
     return { links, hosts };
 }
 exports.getNeedsNetwork = getNeedsNetwork;
-function buildCreateOptions(item, stateKey, serviceContainers, environment) {
+function buildCreateOptions(item, stateKey, serviceContainers, environment, secrets) {
     const network = getNeedsNetwork(serviceContainers, item.needs);
     const binds = (0, get_container_binds_1.getContainerBinds)(item);
     const envs = (0, replace_env_variables_1.getEnvironmentVariables)(item.data.envs);
@@ -48,7 +49,7 @@ function buildCreateOptions(item, stateKey, serviceContainers, environment) {
         Tty: true,
         Entrypoint: [item.data.shell],
         Cmd: ['-c', 'sleep 3600'],
-        Env: Object.entries({ ...envs, ...home }).map(([key, value]) => `${key}=${value}`),
+        Env: Object.entries({ ...envs, ...home, ...secrets.env }).map(([key, value]) => `${key}=${value}`),
         WorkingDir: (0, execute_docker_1.convertToPosixPath)(item.data.cwd),
         Labels: {
             app: 'hammerkit',
@@ -58,7 +59,10 @@ function buildCreateOptions(item, stateKey, serviceContainers, environment) {
             'hammerkit-state': stateKey,
         },
         HostConfig: {
-            Binds: binds.map((b) => `${b.localPath}:${(0, execute_docker_1.convertToPosixPath)(b.containerPath)}`),
+            Binds: [
+                ...binds.map((b) => `${b.localPath}:${(0, execute_docker_1.convertToPosixPath)(b.containerPath)}${b.readOnly ? ':ro' : ''}`),
+                ...secrets.binds,
+            ],
             ExtraHosts: network.hosts,
             Links: network.links,
             AutoRemove: true,
@@ -84,7 +88,8 @@ async function dockerTask(docker, item, environment, options) {
         await (0, execution_steps_1.prepareVolume)(item, docker);
         (0, abort_1.checkForAbort)(options.abort);
         const serviceContainers = (0, get_service_containers_1.getServiceContainers)(item.needs);
-        const containerOptions = buildCreateOptions(item, options.stateKey, serviceContainers, environment);
+        const secrets = await (0, container_secrets_1.prepareContainerSecrets)(item.data.secrets, (0, work_instance_id_1.getWorkInstanceId)(item), environment);
+        const containerOptions = buildCreateOptions(item, options.stateKey, serviceContainers, environment, secrets);
         (0, print_container_options_1.printContainerOptions)(item.status, containerOptions);
         const succeeded = await (0, using_container_1.usingContainer)(docker, item, containerOptions, async (container) => {
             await (0, execution_steps_1.setUserPermissions)(item, container, environment);
@@ -102,6 +107,7 @@ async function dockerTask(docker, item, environment, options) {
                     throw new abort_1.AbortError();
                 }
                 if (result.result.ExitCode !== 0) {
+                    await exportGenerates(environment, container, item.data.generates.filter((g) => g.exportAlways));
                     options.state.set({
                         stateKey: options.stateKey,
                         type: 'crash',
@@ -110,25 +116,7 @@ async function dockerTask(docker, item, environment, options) {
                     return false;
                 }
             }
-            for (const generate of item.data.generates) {
-                if (!generate.export || generate.inherited || generate.isFile) {
-                    continue;
-                }
-                const readable = await container.getArchive({
-                    path: generate.path,
-                });
-                await environment.file.createDirectory(generate.path);
-                await new Promise((resolve, reject) => {
-                    readable
-                        .pipe((0, tar_1.extract)({
-                        cwd: generate.path,
-                        newer: true,
-                        stripComponents: 1,
-                    }))
-                        .on('close', () => resolve())
-                        .on('error', (err) => reject(err));
-                });
-            }
+            await exportGenerates(environment, container, item.data.generates.filter((g) => g.export));
             return true;
         });
         if (succeeded) {
@@ -150,6 +138,32 @@ async function dockerTask(docker, item, environment, options) {
             });
         }
     }
+    finally {
+        await (0, container_secrets_1.removeContainerSecrets)((0, work_instance_id_1.getWorkInstanceId)(item));
+    }
 }
 exports.dockerTask = dockerTask;
+// Copy exported directory outputs out of the container to the host. File
+// outputs are bind mounts and inherited outputs belong to their task.
+async function exportGenerates(environment, container, generates) {
+    for (const generate of generates) {
+        if (generate.inherited || generate.isFile) {
+            continue;
+        }
+        const readable = await container.getArchive({
+            path: generate.path,
+        });
+        await environment.file.createDirectory(generate.path);
+        await new Promise((resolve, reject) => {
+            readable
+                .pipe((0, tar_1.extract)({
+                cwd: generate.path,
+                newer: true,
+                stripComponents: 1,
+            }))
+                .on('close', () => resolve())
+                .on('error', (err) => reject(err));
+        });
+    }
+}
 //# sourceMappingURL=docker-task.js.map

package/dist/executer/execute-init-task.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findInitOf = exports.executeInitTask = exports.isTerminalTask = void 0;
+const state_resolver_1 = require("./state-resolver");
+const execute_work_task_1 = require("./execute-work-task");
+const abort_1 = require("./abort");
+const abort_event_1 = require("../utils/abort-event");
+const isTerminalService = (state) => state.type === 'end' || state.type === 'error' || state.type === 'canceled';
+const isTerminalTask = (state) => state.type === 'completed' || state.type === 'error' || state.type === 'crash' || state.type === 'canceled';
+exports.isTerminalTask = isTerminalTask;
+// The init task of a service runs each time the service passed its healthcheck
+// in this run, never on its own: a service left running by an earlier `up` ran
+// its init when it started, so the init is skipped unless it was asked for by
+// name. A failing init fails the run like any failing task.
+async function executeInitTask(work, init, service, requested, environment, options) {
+    if (!service || service.state.current.type === 'running') {
+        if (service && requested) {
+            await (0, execute_work_task_1.executeWorkTask)(work, environment, options);
+            return;
+        }
+        skip(work, `${work.name} skipped, the service it initializes does not start in this run`);
+        return;
+    }
+    if (requested) {
+        // asked for by name, the init is what the service starts for
+        work.state.set({ type: 'ready', stateKey: '', started: new Date() });
+    }
+    try {
+        do {
+            const view = await (0, state_resolver_1.isState)('await-init-' + work.name, init.state, (state) => state.type === 'running' || isTerminalService(state), environment.abortCtrl.signal);
+            if (view.type !== 'running') {
+                if (!(0, exports.isTerminalTask)(work.state.current)) {
+                    skip(work, `${work.name} skipped, ${service.name} did not start`);
+                }
+                return;
+            }
+            await runOnce(work, environment, options);
+            settleService(service, work, view);
+            if (!options.watch) {
+                return;
+            }
+            await (0, state_resolver_1.awaitState)('await-init-restart-' + work.name, init.state, (state) => state.type !== 'running', environment.abortCtrl.signal);
+        } while (!environment.abortCtrl.signal.aborted);
+    }
+    catch (e) {
+        if (!(e instanceof abort_1.AbortError)) {
+            throw e;
+        }
+        if (!(0, exports.isTerminalTask)(work.state.current)) {
+            work.state.set({ type: 'canceled', stateKey: null });
+        }
+    }
+}
+exports.executeInitTask = executeInitTask;
+// Only now does the service run for everything else needing it.
+function settleService(service, work, view) {
+    const result = work.state.current;
+    if (result.type === 'completed') {
+        service.state.set(view);
+        return;
+    }
+    service.state.set({
+        type: 'error',
+        stateKey: null,
+        errorMessage: `init ${work.name} did not succeed (${result.type})`,
+    });
+}
+// One run of the init as a plain task. It aborts its own run when it fails;
+// the whole run stops only outside watch mode, as for a failing service.
+async function runOnce(work, environment, options) {
+    const abortCtrl = new AbortController();
+    const abortListener = (0, abort_event_1.listenOnAbort)(environment.abortCtrl.signal, () => abortCtrl.abort());
+    try {
+        await (0, execute_work_task_1.executeWorkTask)(work, { ...environment, abortCtrl }, { ...options, watch: false });
+    }
+    finally {
+        abortListener.close();
+    }
+    const result = work.state.current.type;
+    if ((result === 'error' || result === 'crash') && !options.watch) {
+        environment.abortCtrl.abort();
+    }
+}
+function skip(work, message) {
+    work.status.write('debug', message);
+    work.state.set({ type: 'completed', cached: false, skipped: true, duration: 0, stateKey: '' });
+}
+// The service a task is the init of: the task needs it through the view the
+// planner gave it, which shares the service's data.
+function findInitOf(task) {
+    for (const need of task.needs) {
+        const data = need.service.data;
+        if (data.type === 'container-service' && data.init && data.init.task === task) {
+            return { serviceName: need.service.name, init: data.init };
+        }
+    }
+    return null;
+}
+exports.findInitOf = findInitOf;
+//# sourceMappingURL=execute-init-task.js.map

package/dist/executer/execute-work-service.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.executeWorkService = exports.stopService = void 0;
+const work_item_1 = require("../planner/work-item");
 const await_completed_dependencies_1 = require("./await-completed-dependencies");
 const abort_1 = require("./abort");
 const log_1 = require("../log");
 const watch_loop_1 = require("./watch-loop");
+const state_1 = require("./state");
 async function stopService(work) {
     if (work.state.current.type === 'running') {
         await work.runtime.stop();
@@ -47,12 +49,16 @@ async function executeWorkService(work, environment, options) {
                     // aborted: the service is stopping anyway
                 });
             }
+            const init = getServiceInit(work);
             await work.runtime.execute(environment, {
                 cache: cacheState,
                 abort,
-                state: work.state,
+                state: init ? gateOnInit(work, init) : work.state,
                 stateKey: cacheState.stateKey,
                 daemon: options.daemon,
+                publishPorts: options.type === 'up' || work.requiredBy.some(isLocalTaskItem) || (!!init && isLocalTaskItem(init.task)),
+                // an init needs a healthy service, so a service with one is always awaited
+                waitForReady: options.wait === 'ready' || work.requiredBy.length > 0 || !!init,
             });
         });
     }
@@ -78,4 +84,27 @@ async function executeWorkService(work, environment, options) {
     }
 }
 exports.executeWorkService = executeWorkService;
+function getServiceInit(work) {
+    return work.data.type === 'container-service' ? work.data.init : null;
+}
+// With an init, the runtime's `running` (healthcheck passed) first reaches only
+// the init task's view of the service; executeInitTask runs the init and then
+// sets the service running, or failed.
+function gateOnInit(work, init) {
+    const gate = new state_1.State(work.state.current);
+    gate.on('init-gate', (state) => {
+        if (state.type !== 'running') {
+            if (work.state.current.type !== 'error') {
+                work.state.set(state);
+            }
+            return;
+        }
+        work.status.write('info', `${work.name} is healthy, run its init ${init.task.name}`);
+        init.state.set(state);
+    });
+    return gate;
+}
+function isLocalTaskItem(item) {
+    return (0, work_item_1.isWorkTaskItem)(item) && (0, work_item_1.isLocalWorkTaskItem)(item);
+}
 //# sourceMappingURL=execute-work-service.js.map

package/dist/executer/execute-work-task.js

@@ -6,10 +6,10 @@ const abort_1 = require("./abort");
 const log_1 = require("../log");
 const await_completed_dependencies_1 = require("./await-completed-dependencies");
 const watch_loop_1 = require("./watch-loop");
+const deadline_1 = require("./deadline");
 const explain_1 = require("../cache/explain");
 const archive_task_entry_1 = require("./archive-task-entry");
 const units_1 = require("../utils/units");
-const abort_event_1 = require("../utils/abort-event");
 async function pushToBackend(work, environment, cacheState, options) {
     const { resolved, stateKey, provable } = cacheState;
     if (resolved.method === 'none' || !provable) {
@@ -28,29 +28,6 @@ async function pushToBackend(work, environment, cacheState, options) {
         work.status.write('warn', `${work.name} failed to push to cache "${resolved.name}": ${(0, log_1.getErrorMessage)(e)}`);
     }
 }
-// An abort signal that follows `parent` and additionally fires after `timeout`
-// ms, so a task deadline reuses the runtimes' existing abort/cleanup path.
-function withDeadline(parent, timeout) {
-    const controller = new AbortController();
-    let expired = false;
-    const parentListener = (0, abort_event_1.listenOnAbort)(parent, () => controller.abort());
-    const timer = timeout === null
-        ? null
-        : setTimeout(() => {
-            expired = true;
-            controller.abort();
-        }, timeout);
-    return {
-        signal: controller.signal,
-        expired: () => expired,
-        clear() {
-            if (timer) {
-                clearTimeout(timer);
-            }
-            parentListener.close();
-        },
-    };
-}
 // A task without cmds only groups its dependencies (`ci: { deps: [test, build] }`).
 // Having no src of its own it is never a cache hit, so its dependencies are
 // always checked and their outputs restored. When every one of them was a hit,
@@ -118,7 +95,7 @@ dependents = null) {
                     started,
                 });
                 const timeout = work.data.timeout ?? options.timeout;
-                const deadline = withDeadline(abort, timeout);
+                const deadline = (0, deadline_1.withDeadline)(abort, timeout);
                 try {
                     await work.runtime.execute(environment, {
                         cache: cacheState,
@@ -126,6 +103,8 @@ dependents = null) {
                         stateKey: cacheState.stateKey,
                         state: work.state,
                         daemon: options.daemon,
+                        publishPorts: false,
+                        waitForReady: true,
                     });
                 }
                 finally {