hammerkit 1.10.0 → 1.11.1

package/dist/executer/execute-work-tree.js

@@ -4,13 +4,24 @@ exports.executeWorkTree = void 0;
 const plan_work_tasks_1 = require("../planner/utils/plan-work-tasks");
 const execute_work_service_1 = require("./execute-work-service");
 const execute_work_task_1 = require("./execute-work-task");
+const execute_init_task_1 = require("./execute-init-task");
 async function executeWorkTree(work, environment, options) {
     const itemPromises = [];
     const dependents = skippableDependents(work, options);
+    mirrorServicesToInitViews(work);
     for (const task of (0, plan_work_tasks_1.iterateWorkTasks)(work)) {
-        if (task.state.current.type === 'pending') {
-            itemPromises.push((0, execute_work_task_1.executeWorkTask)(task, environment, options, dependents.get(task.name) ?? null));
+        if (task.state.current.type !== 'pending') {
+            continue;
         }
+        const initOf = (0, execute_init_task_1.findInitOf)(task);
+        if (initOf) {
+            const service = work.services[initOf.serviceName] ?? null;
+            // asked for alone (by name), it runs against a service already running too
+            const requested = work.requested?.length === 1 && work.requested[0] === task.name;
+            itemPromises.push((0, execute_init_task_1.executeInitTask)(task, initOf.init, service, requested, environment, options));
+            continue;
+        }
+        itemPromises.push((0, execute_work_task_1.executeWorkTask)(task, environment, options, dependents.get(task.name) ?? null));
     }
     for (const service of (0, plan_work_tasks_1.iterateWorkServices)(work)) {
         if (options.type === 'down') {
@@ -25,6 +36,21 @@ async function executeWorkTree(work, environment, options) {
     await Promise.all(itemPromises);
 }
 exports.executeWorkTree = executeWorkTree;
+// An init task sees its service through a view that follows the service, so a
+// service left running by an earlier `up` is running for its init task too. The
+// view runs early only while the init itself runs, see executeWorkService.
+function mirrorServicesToInitViews(work) {
+    for (const service of (0, plan_work_tasks_1.iterateWorkServices)(work)) {
+        if (service.data.type !== 'container-service' || !service.data.init) {
+            continue;
+        }
+        const view = service.data.init.state;
+        view.set(service.state.current);
+        service.state.on('init-view', (state) => {
+            view.set(state);
+        });
+    }
+}
 // For every task that may be skipped when nothing needs it, the tasks in this
 // run that depend on it. Requested tasks always run; so does anything a service
 // depends on, and everything in watch mode or with skipping turned off.

package/dist/executer/get-container-binds.js

@@ -9,16 +9,20 @@ function isInside(path, parent) {
 function getContainerBinds(item) {
     const sources = item.data.src.map((s) => s.absolutePath);
     const items = [
-        ...item.data.mounts,
+        ...item.data.mounts.map((m) => ({ localPath: m.localPath, containerPath: m.containerPath, readOnly: m.readOnly })),
         // A source inside another source (a dependency's `app/app.csproj` under the
         // task's own `app`) is already visible through the outer bind. Binding it
         // again would nest bind mounts, which Docker Desktop then refuses to let the
         // host delete while the container exists.
         ...sources
             .filter((path) => !sources.some((other) => isInside(path, other)))
-            .map((path) => ({ localPath: path, containerPath: path })),
-        ...item.data.generates.filter((g) => !g.isFile).map((v) => ({ localPath: v.volumeName, containerPath: v.path })),
-        ...item.data.generates.filter((g) => g.isFile).map((v) => ({ localPath: v.path, containerPath: v.path })),
+            .map((path) => ({ localPath: path, containerPath: path, readOnly: false })),
+        ...item.data.generates
+            .filter((g) => !g.isFile)
+            .map((v) => ({ localPath: v.volumeName, containerPath: v.path, readOnly: false })),
+        ...item.data.generates
+            .filter((g) => g.isFile)
+            .map((v) => ({ localPath: v.path, containerPath: v.path, readOnly: false })),
     ];
     return items.reduce((array, item) => {
         if (array.findIndex((i) => i.containerPath === item.containerPath) === -1) {

package/dist/executer/local-task.js

@@ -6,10 +6,15 @@ const execute_command_1 = require("./execute-command");
 const log_1 = require("../log");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
 const get_service_env_hints_1 = require("./get-service-env-hints");
+const container_secrets_1 = require("./container-secrets");
 async function localTask(item, environment, options) {
     item.status.write('info', `execute ${item.name} locally`);
-    const envs = { ...(0, replace_env_variables_1.getEnvironmentVariables)(item.data.envs), ...(0, get_service_env_hints_1.getServiceEnvHints)(item.needs) };
     try {
+        const envs = {
+            ...(0, replace_env_variables_1.getEnvironmentVariables)(item.data.envs),
+            ...(0, get_service_env_hints_1.getServiceEnvHints)(item.needs),
+            ...(await (0, container_secrets_1.resolveSecretEnvs)(item.data.secrets, environment)),
+        };
         for (const cmd of item.data.cmds) {
             (0, abort_1.checkForAbort)(options.abort);
             item.status.write('info', `execute cmd "${cmd.cmd}" locally`);

package/dist/kubernetes/ensure-kubernetes-deployment-exists.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensureKubernetesDeploymentExists = void 0;
 const work_item_1 = require("../planner/work-item");
 const work_service_1 = require("../planner/work-service");
+const service_hostname_1 = require("../planner/utils/service-hostname");
 const apply_1 = require("./apply");
 const get_service_ip_1 = require("./get-service-ip");
 const version_1 = require("../version");
@@ -10,7 +11,7 @@ const replace_env_variables_1 = require("../environment/replace-env-variables");
 const await_running_state_1 = require("./await-running-state");
 const resources_1 = require("./resources");
 const work_healthcheck_1 = require("../planner/work-healthcheck");
-async function ensureKubernetesDeploymentExists(instance, env, service, persistence, stateKey) {
+async function ensureKubernetesDeploymentExists(instance, env, service, persistence, secrets, stateKey) {
     const hostAliases = [];
     for (const need of service.needs) {
         if (!(0, work_item_1.isContainerWorkServiceItem)(need.service)) {
@@ -67,23 +68,28 @@ async function ensureKubernetesDeploymentExists(instance, env, service, persiste
                     },
                 },
                 spec: {
+                    // the pod resolves its own service name, as with Docker's Hostname
+                    hostname: (0, service_hostname_1.getServiceHostname)(service.name),
                     hostAliases: hostAliases,
                     containers: [
                         {
                             name: service.name.replace(/:/, '-'),
                             image: service.data.image,
                             workingDir: (0, work_service_1.getServiceWorkingDir)(service.data),
-                            env: Object.entries(envs).map(([key, value]) => ({
-                                name: key,
-                                value: value,
-                            })),
+                            env: [
+                                ...Object.entries(envs).map(([key, value]) => ({
+                                    name: key,
+                                    value: value,
+                                })),
+                                ...secrets.env,
+                            ],
                             ...getKubernetesCommand(serviceCommand),
                             ports: service.data.ports.map((p) => ({
                                 containerPort: p.containerPort,
                             })),
                             readinessProbe: probe,
                             livenessProbe: probe,
-                            volumeMounts: persistence.mounts.map((m) => m.mount),
+                            volumeMounts: [...persistence.mounts.map((m) => m.mount), ...secrets.mounts],
                         },
                         {
                             name: 'debug',
@@ -93,7 +99,7 @@ async function ensureKubernetesDeploymentExists(instance, env, service, persiste
                             volumeMounts: persistence.mounts.map((m) => m.mount),
                         },
                     ],
-                    volumes: persistence.volumes,
+                    volumes: [...persistence.volumes, ...secrets.volumes],
                 },
             },
         },

package/dist/kubernetes/secrets.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.removeKubernetesSecret = exports.ensureKubernetesSecret = exports.getKubernetesSecretRefs = exports.getSecretResourceName = void 0;
+const work_secret_1 = require("../planner/work-secret");
+const apply_1 = require("./apply");
+const resources_1 = require("./resources");
+const version_1 = require("../version");
+const SECRET_VOLUME_NAME = 'hammerkit-secrets';
+function getSecretResourceName(item) {
+    return (0, resources_1.getResourceName)(item, '-secrets');
+}
+exports.getSecretResourceName = getSecretResourceName;
+// The values go into a Secret of the item; the pod only references it, so no
+// value is part of a Job or Deployment spec.
+function getKubernetesSecretRefs(item, secrets) {
+    if (secrets.length === 0) {
+        return { env: [], mounts: [], volumes: [] };
+    }
+    const secretName = getSecretResourceName(item);
+    const refs = {
+        env: [],
+        mounts: [],
+        volumes: [{ name: SECRET_VOLUME_NAME, secret: { secretName } }],
+    };
+    secrets.forEach((secret, index) => {
+        const key = getSecretKey(index);
+        if (secret.target.type === 'env') {
+            refs.env.push({ name: secret.target.name, valueFrom: { secretKeyRef: { name: secretName, key } } });
+            return;
+        }
+        refs.mounts.push({ name: SECRET_VOLUME_NAME, mountPath: secret.target.path, subPath: key, readOnly: true });
+    });
+    if (refs.mounts.length === 0) {
+        refs.volumes = [];
+    }
+    return refs;
+}
+exports.getKubernetesSecretRefs = getKubernetesSecretRefs;
+async function ensureKubernetesSecret(instance, kubernetes, item, secrets, environment) {
+    if (secrets.length === 0) {
+        return;
+    }
+    const stringData = {};
+    for (const [index, secret] of secrets.entries()) {
+        stringData[getSecretKey(index)] = await (0, work_secret_1.resolveSecretValue)(secret, environment);
+    }
+    const spec = {
+        kind: 'Secret',
+        apiVersion: 'v1',
+        metadata: {
+            namespace: kubernetes.namespace,
+            name: getSecretResourceName(item),
+            annotations: {
+                'hammerkit.dev/version': (0, version_1.getVersion)(),
+            },
+            labels: {
+                'hammerkit.dev/id': item.id(),
+            },
+        },
+        type: 'Opaque',
+        stringData,
+    };
+    await (0, apply_1.apply)(instance, spec);
+}
+exports.ensureKubernetesSecret = ensureKubernetesSecret;
+async function removeKubernetesSecret(instance, kubernetes, item) {
+    try {
+        await instance.coreApi.deleteNamespacedSecret({
+            name: getSecretResourceName(item),
+            namespace: kubernetes.namespace,
+        });
+    }
+    catch (e) {
+        if ((0, apply_1.statusCodeOf)(e) !== 404) {
+            throw e;
+        }
+    }
+}
+exports.removeKubernetesSecret = removeKubernetesSecret;
+function getSecretKey(index) {
+    return `secret-${index}`;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/kubernetes/volumes.js

@@ -24,7 +24,7 @@ async function getKubernetesPersistence(work) {
     }
     else {
         for (const volume of work.data.volumes) {
-            appendVolume(volume.inherited ?? work, persistence, volume.containerPath, null, false, !!volume.inherited);
+            appendVolume(volume.inherited ?? work, persistence, volume.containerPath, null, false, !!volume.inherited || volume.readOnly);
         }
     }
     return persistence;

package/dist/optimizer/work-task-cache-description.js

@@ -5,6 +5,7 @@ const os_1 = require("os");
 const crypto_1 = require("crypto");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
 const portable_path_1 = require("../planner/utils/portable-path");
+const work_secret_1 = require("../planner/work-secret");
 // Every path is made project-relative (portablePath) so the description, and the
 // task id hashed from it, is identical wherever the project is checked out.
 //
@@ -15,6 +16,10 @@ function getWorkTaskCacheDescription(item) {
     const task = item.data;
     const portable = (path) => (0, portable_path_1.portablePath)(task.projectRoot, path);
     const envs = (0, replace_env_variables_1.getEnvironmentVariables)(task.envs);
+    const cachedSecrets = task.secrets
+        .filter((secret) => secret.cache)
+        .map((secret) => `${(0, work_secret_1.getPortableSecretName)(task.projectRoot, secret)}=${secret.digest()}`)
+        .sort();
     return {
         shell: task.shell ?? undefined,
         platform: task.type === 'container-task' ? task.image : (0, os_1.platform)(),
@@ -33,6 +38,7 @@ function getWorkTaskCacheDescription(item) {
         mounts: task.type === 'container-task' ? task.mounts.map((m) => m.mount).sort() : undefined,
         cwd: portable(task.cwd),
         deps: item.deps.length > 0 ? item.deps.map((dep) => dep.id()).sort() : undefined,
+        secrets: cachedSecrets.length > 0 ? cachedSecrets : undefined,
     };
 }
 exports.getWorkTaskCacheDescription = getWorkTaskCacheDescription;

package/dist/parse-set-arguments.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseSetArguments = void 0;
+// `--set NAME=value` / `--set=NAME=value` on any command, as often as needed:
+// the value is what `$NAME` and `${NAME}` resolve to, ahead of the shell and
+// `.env` files. Taken out of argv before commander parses it, like `--file`.
+function parseSetArguments(argv) {
+    const args = [];
+    const values = {};
+    for (let index = 0; index < argv.length; index++) {
+        const arg = argv[index];
+        if (arg === '--set') {
+            const assignment = argv[index + 1];
+            if (assignment === undefined) {
+                throw new Error('--set expects NAME=value');
+            }
+            addAssignment(values, assignment);
+            index++;
+        }
+        else if (arg.startsWith('--set=')) {
+            addAssignment(values, arg.substring('--set='.length));
+        }
+        else {
+            args.push(arg);
+        }
+    }
+    return { args, values };
+}
+exports.parseSetArguments = parseSetArguments;
+function addAssignment(values, assignment) {
+    const separator = assignment.indexOf('=');
+    const name = separator > 0 ? assignment.substring(0, separator) : '';
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+        throw new Error(`--set expects NAME=value, got "${assignment}"`);
+    }
+    values[name] = assignment.substring(separator + 1);
+}
+//# sourceMappingURL=parse-set-arguments.js.map

package/dist/planner/service-definition.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getServiceDefinitionHash = void 0;
+const crypto_1 = require("crypto");
+const work_secret_1 = require("./work-secret");
+const work_service_1 = require("./work-service");
+// Everything a running container of the service was created from, plus the
+// definitions of the services it needs: a dependent links to the container it
+// started with, so a recreated need means a recreated dependent too. Stored as
+// a container label (a hash, never values) so `up` and `run` recreate a running
+// service whose definition changed instead of silently reusing it.
+function getServiceDefinitionHash(item) {
+    const service = item.data;
+    const definition = {
+        image: service.image,
+        cmd: service.cmd?.cmd ?? null,
+        shell: service.shell,
+        workdir: service.workdir,
+        envs: {
+            variables: service.envs.variables,
+            replacements: service.envs.replacements.map((r) => [r.key, r.name, r.value]),
+        },
+        ports: service.ports.map((p) => `${p.hostPort ?? ''}:${p.containerPort}`),
+        mounts: service.mounts.map((m) => `${m.localPath}:${m.containerPath}:${m.readOnly ? 'ro' : 'rw'}`),
+        volumes: service.volumes.map((v) => `${v.name}:${v.containerPath}:${v.readOnly ? 'ro' : 'rw'}`),
+        src: service.src.map((s) => s.absolutePath),
+        healthcheck: service.healthcheck?.cmd.cmd ?? null,
+        // where secrets go, never their values: a rotated value needs a `down`
+        secrets: service.secrets.map((s) => `${s.source.type}:${(0, work_secret_1.getSecretName)(s)}`),
+        // the init task's id covers its image, commands, envs and mounts: a changed
+        // init recreates the service, so it runs again
+        init: service.init ? service.init.task.id() : null,
+        needs: item.needs
+            .filter((need) => (0, work_service_1.isContainerWorkService)(need.service.data))
+            .map((need) => `${need.name}=${getServiceDefinitionHash(need.service)}`),
+    };
+    return (0, crypto_1.createHash)('sha1').update(JSON.stringify(definition)).digest('hex');
+}
+exports.getServiceDefinitionHash = getServiceDefinitionHash;
+//# sourceMappingURL=service-definition.js.map

package/dist/planner/utils/append-work-dependencies.js

@@ -32,6 +32,7 @@ function appendWorkDependencies(workTree, referenced, item, environment, context
                             resetOnChange: false,
                             containerPath: generate.path,
                             inherited: depNode,
+                            readOnly: false,
                         });
                     }
                 }
@@ -40,6 +41,7 @@ function appendWorkDependencies(workTree, referenced, item, environment, context
                         item.data.generates.push({
                             volumeName: generate.volumeName,
                             export: false,
+                            exportAlways: false,
                             resetOnChange: false,
                             path: generate.path,
                             inherited: depNode,

package/dist/planner/utils/append-work-needs.js

@@ -5,6 +5,10 @@ const append_work_service_1 = require("./append-work-service");
 function appendWorkNeeds(workTree, referenced, item, environment, context) {
     for (const need of referenced.needs) {
         const serviceNeed = (0, append_work_service_1.appendWorkService)(workTree, need.service, environment, context);
+        if (isInitOf(serviceNeed, item)) {
+            // planning the service planned this task as its init, with the view
+            continue;
+        }
         item.needs.push({
             service: serviceNeed,
             name: need.relativeName,
@@ -15,4 +19,7 @@ function appendWorkNeeds(workTree, referenced, item, environment, context) {
     }
 }
 exports.appendWorkNeeds = appendWorkNeeds;
+function isInitOf(service, item) {
+    return service.data.type === 'container-service' && service.data.init?.task === item;
+}
 //# sourceMappingURL=append-work-needs.js.map

package/dist/planner/utils/append-work-service.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getHealthcheckTimeout = exports.DEFAULT_HEALTHCHECK_TIMEOUT = exports.appendWorkService = void 0;
+exports.getHealthcheckTimeout = exports.DEFAULT_HEALTHCHECK_TIMEOUT = exports.getInitTimeout = exports.DEFAULT_INIT_TIMEOUT = exports.getPlannedService = exports.appendWorkService = void 0;
+const work_secret_1 = require("../work-secret");
 const work_service_id_1 = require("../work-service-id");
 const parse_work_ports_1 = require("./parse-work-ports");
 const template_value_1 = require("./template-value");
@@ -12,6 +13,8 @@ const parse_work_mounts_1 = require("./parse-work-mounts");
 const parse_work_source_1 = require("./parse-work-source");
 const append_work_dependencies_1 = require("./append-work-dependencies");
 const append_work_needs_1 = require("./append-work-needs");
+const work_item_1 = require("../work-item");
+const append_work_task_1 = require("./append-work-task");
 const replace_env_variables_1 = require("../../environment/replace-env-variables");
 const state_1 = require("../../executer/state");
 const lazy_resolver_1 = require("../../executer/lazy-resolver");
@@ -42,6 +45,7 @@ function appendWorkService(workTree, service, environment, context) {
         workTree.services[workItem.name] = workStateItem;
         (0, append_work_dependencies_1.appendWorkDependencies)(workTree, service, workStateItem, environment, context);
         (0, append_work_needs_1.appendWorkNeeds)(workTree, service, workStateItem, environment, context);
+        appendServiceInit(workTree, service, workStateItem, environment, context);
         return workStateItem;
     }
     else {
@@ -107,9 +111,71 @@ function parseService(workTree, service, environment, context) {
             mounts: (0, parse_work_mounts_1.parseWorkMounts)(service.cwd, service.schema, envs),
             src: (0, parse_work_source_1.parseWorkSource)(service.cwd, service.schema.src, envs),
             caching,
+            // set once the service is planned, see appendServiceInit
+            init: null,
+            secrets: (0, work_secret_1.parseWorkSecrets)(service.cwd, context.projectRoot, service.schema.secrets, envs, environment),
         };
     }
 }
+// The task named by `init` is planned like any other task. It needs the
+// service under the service's name, but through a view of it that turns running
+// once the healthcheck passed; the service itself only runs for everything else
+// once the init succeeded. The init never makes the service start (it is not
+// among the service's requirers), never comes from the cache, and gets the init
+// timeout unless it declares its own.
+function appendServiceInit(workTree, service, item, environment, context) {
+    if (!service.init || !(0, work_item_1.isContainerWorkServiceItem)(item)) {
+        return;
+    }
+    const task = (0, append_work_task_1.appendWorkTask)(workTree, service.init.cwd, service.init.task, environment, context);
+    const state = new state_1.State({ type: 'pending', stateKey: null });
+    const view = { ...item, state };
+    initViews.set(view, item);
+    const selfNeed = task.needs.findIndex((need) => need.service.name === item.name);
+    if (selfNeed >= 0) {
+        task.needs[selfNeed] = { name: task.needs[selfNeed].name, service: view };
+    }
+    else {
+        task.needs.push({ name: item.name, service: view });
+    }
+    removeRequirer(item, task.name);
+    task.data.caching = { ...task.data.caching, method: 'none' };
+    if (task.data.timeout === null) {
+        task.data.timeout = getInitTimeout(undefined, environment);
+    }
+    item.data.init = { task, state };
+}
+const initViews = new WeakMap();
+// The service itself for the view its init task needs, else the item.
+function getPlannedService(item) {
+    return initViews.get(item) ?? item;
+}
+exports.getPlannedService = getPlannedService;
+function removeRequirer(item, name) {
+    const index = item.requiredBy.findIndex((requirer) => requirer.name === name);
+    if (index >= 0) {
+        item.requiredBy.splice(index, 1);
+    }
+}
+exports.DEFAULT_INIT_TIMEOUT = '5m';
+// The init task's own `timeout`, else HAMMERKIT_INIT_TIMEOUT, else 5 minutes:
+// an init that never ends would otherwise keep the run waiting.
+function getInitTimeout(timeout, environment) {
+    if (timeout) {
+        return (0, units_1.parseDuration)(timeout);
+    }
+    const fromEnv = environment.processEnvs.HAMMERKIT_INIT_TIMEOUT;
+    if (fromEnv) {
+        try {
+            return (0, units_1.parseDuration)(fromEnv);
+        }
+        catch (e) {
+            throw new Error(`HAMMERKIT_INIT_TIMEOUT: ${(0, log_1.getErrorMessage)(e)}`);
+        }
+    }
+    return (0, units_1.parseDuration)(exports.DEFAULT_INIT_TIMEOUT);
+}
+exports.getInitTimeout = getInitTimeout;
 exports.DEFAULT_HEALTHCHECK_TIMEOUT = '20s';
 // A service's own `healthcheck.timeout`, else HAMMERKIT_HEALTHCHECK_TIMEOUT,
 // else 20s: a check that never passes fails the run instead of hanging it.

package/dist/planner/utils/append-work-task.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.appendWorkTask = void 0;
+const work_secret_1 = require("../work-secret");
 const parse_work_generate_1 = require("./parse-work-generate");
 const template_value_1 = require("./template-value");
 const parse_work_mounts_1 = require("./parse-work-mounts");
@@ -67,6 +68,7 @@ function parseTask(cwd, task, environment, context) {
         shell: task.schema.shell ? (0, template_value_1.templateValue)(task.schema.shell, envs) : '/bin/sh',
         continuous: task.schema.continuous ?? false,
         timeout: task.schema.timeout ? (0, units_1.parseDuration)(task.schema.timeout) : null,
+        secrets: (0, work_secret_1.parseWorkSecrets)(cwd, context.projectRoot, task.schema.secrets, envs, environment),
     };
     if ((0, build_file_task_schema_1.isBuildFileContainerTaskSchema)(task.schema)) {
         return {
@@ -78,6 +80,10 @@ function parseTask(cwd, task, environment, context) {
         };
     }
     else {
+        const fileSecret = baseWorkNode.secrets.find((secret) => secret.target.type === 'file');
+        if (fileSecret) {
+            throw new Error(`task ${task.relativeName}: a local task takes secrets as env only (${(0, work_secret_1.getSecretName)(fileSecret)})`);
+        }
         return {
             ...baseWorkNode,
             type: 'local-task',

package/dist/planner/utils/parse-work-generate.js

@@ -16,6 +16,7 @@ function parseWorkGenerate(cwd, schema, envs) {
             volumeName: (0, plan_work_volume_1.getVolumeName)(filePath),
             resetOnChange: generate.resetOnChange,
             export: generate.export,
+            exportAlways: generate.exportAlways,
             isFile: (0, path_1.extname)(generate.path).length > 1,
             inherited: null,
         };
@@ -24,13 +25,14 @@ function parseWorkGenerate(cwd, schema, envs) {
 exports.parseWorkGenerate = parseWorkGenerate;
 function mapGenerate(generate) {
     if (typeof generate === 'string') {
-        return { path: generate, resetOnChange: true, export: false };
+        return { path: generate, resetOnChange: true, export: false, exportAlways: false };
     }
     else {
         return {
             path: generate.path,
             resetOnChange: generate.resetOnChange ?? true,
-            export: generate.export ?? false,
+            export: !!generate.export,
+            exportAlways: generate.export === 'always',
         };
     }
 }

package/dist/planner/utils/parse-work-mount.js

@@ -7,22 +7,26 @@ const path_1 = require("path");
 function parseWorkMount(cwd, dir) {
     const parts = dir.split(':');
     if (parts.length === 1) {
-        return parseLocalMount(cwd, dir, dir, dir);
+        return parseLocalMount(cwd, dir, dir, dir, false);
     }
     else if (parts.length === 2) {
-        return parseLocalMount(cwd, parts[0], parts[1], dir);
+        return parseLocalMount(cwd, parts[0], parts[1], dir, false);
+    }
+    else if (parts.length === 3 && (parts[2] === 'ro' || parts[2] === 'rw')) {
+        return parseLocalMount(cwd, parts[0], parts[1], dir, parts[2] === 'ro');
     }
     else {
         throw new Error(`invalid mount ${dir}`);
     }
 }
 exports.parseWorkMount = parseWorkMount;
-function parseLocalMount(cwd, localPath, containerPath, mount) {
+function parseLocalMount(cwd, localPath, containerPath, mount, readOnly) {
     return {
         localPath: (0, normalize_path_1.normalizePath)(cwd, (0, os_1.homedir)(), localPath),
         containerPath: (0, normalize_path_1.normalizePath)(cwd, cwd, containerPath),
         isFile: (0, path_1.extname)(localPath).length > 1,
         mount,
+        readOnly,
     };
 }
 //# sourceMappingURL=parse-work-mount.js.map

package/dist/planner/utils/parse-work-volume.js

@@ -6,22 +6,29 @@ const plan_work_volume_1 = require("./plan-work-volume");
 const template_value_1 = require("./template-value");
 function parseWorkVolume(cwd, volume, envs) {
     if (typeof volume === 'string') {
-        const parts = volume.split(':');
+        // `$NAME` references resolve first, as in mounts, so a value holding a
+        // colon can't break the name:path split
+        const value = (0, template_value_1.templateValue)(volume, envs);
+        const parts = value.split(':');
         if (parts.length === 2) {
-            return parseVolume(cwd, parts[0], parts[1]);
+            return parseVolume(cwd, parts[0], parts[1], false);
+        }
+        else if (parts.length === 3 && (parts[2] === 'ro' || parts[2] === 'rw')) {
+            return parseVolume(cwd, parts[0], parts[1], parts[2] === 'ro');
         }
         else {
-            throw new Error(`invalid volume ${volume}`);
+            throw new Error(`invalid volume ${value}`);
         }
     }
     else {
         const path = (0, template_value_1.templateValue)(volume.path, envs);
         return {
             containerPath: path,
-            export: volume.export ?? false,
+            export: !!volume.export,
             name: volume.name ? (0, template_value_1.templateValue)(volume.name, envs) : (0, plan_work_volume_1.getVolumeName)(path),
             inherited: null,
             resetOnChange: volume.resetOnChange ?? false,
+            readOnly: volume.readOnly ?? false,
         };
     }
 }
@@ -33,13 +40,14 @@ function parseWorkVolumes(cwd, volumes, envs) {
     return volumes.map((v) => parseWorkVolume(cwd, v, envs));
 }
 exports.parseWorkVolumes = parseWorkVolumes;
-function parseVolume(cwd, name, containerPath) {
+function parseVolume(cwd, name, containerPath, readOnly) {
     return {
         name,
         resetOnChange: false,
         containerPath: (0, normalize_path_1.normalizePath)(cwd, cwd, containerPath),
         inherited: null,
         export: false,
+        readOnly,
     };
 }
 //# sourceMappingURL=parse-work-volume.js.map

package/dist/planner/utils/plan-work-volume.js

@@ -24,6 +24,7 @@ function getContainerVolumes(task, mounts) {
             containerPath: generate.path,
             inherited: generate.inherited,
             export: generate.export,
+            readOnly: false,
         });
     }
     return volumes;

package/dist/planner/utils/service-hostname.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getServiceHostname = void 0;
+// A DNS label from the service name: Docker writes the container's hostname
+// into its own /etc/hosts, so the service reaches itself by name (a database
+// that advertises its own address, such as a MongoDB replica set member).
+function getServiceHostname(name) {
+    return (name
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .substring(0, 63) || 'service');
+}
+exports.getServiceHostname = getServiceHostname;
+//# sourceMappingURL=service-hostname.js.map