hammerkit 1.10.0 → 1.11.1

package/dist/planner/work-item-status.js

@@ -5,6 +5,7 @@ const emitter_1 = require("../utils/emitter");
 const environment_config_1 = require("../utils/environment-config");
 const log_1 = require("../log");
 const buffer_context_1 = require("../utils/buffer-context");
+const redact_1 = require("../utils/redact");
 const StatusBufferMax = (0, environment_config_1.getEnvironmentConfig)('STATUS_BUFFER_LIMIT', 300);
 const ConsoleBufferMax = (0, environment_config_1.getEnvironmentConfig)('CONSOLE_BUFFER_LIMIT', 30);
 function logContext(type, item) {
@@ -18,7 +19,8 @@ function statusConsole(writable) {
     const statusBuffer = new buffer_context_1.BufferContext(StatusBufferMax);
     const consoleBuffer = new buffer_context_1.BufferContext(ConsoleBufferMax);
     const emit = (0, emitter_1.emitter)();
-    function addMessage(context, message) {
+    function addMessage(context, unredacted) {
+        const message = { ...unredacted, message: (0, redact_1.redact)(unredacted.message) };
         emit.emit(message);
         writable.write(JSON.stringify({ context, message }) + '\n');
         if (message.type === 'console') {

package/dist/planner/work-runtime-docker.js

@@ -6,6 +6,7 @@ const execute_docker_1 = require("../executer/execute-docker");
 const remove_container_1 = require("../docker/remove-container");
 const docker_task_1 = require("../executer/docker-task");
 const docker_service_1 = require("../executer/docker-service");
+const container_secrets_1 = require("../executer/container-secrets");
 const using_container_1 = require("../docker/using-container");
 const event_cache_1 = require("../executer/event-cache");
 const get_docker_executor_1 = require("../executer/get-docker-executor");
@@ -14,6 +15,7 @@ const tar_1 = require("tar");
 const plan_work_volume_1 = require("./utils/plan-work-volume");
 const work_instance_id_1 = require("./work-instance-id");
 const stream_1 = require("stream");
+const service_definition_1 = require("./service-definition");
 const container_task_state_1 = require("../executer/container-task-state");
 function dockerTaskRuntime(task, workEnvironment) {
     const docker = (0, execute_docker_1.getContainerCli)(workEnvironment);
@@ -160,6 +162,11 @@ function dockerServiceRuntime(service, workEnvironment) {
             if (!currentService) {
                 return;
             }
+            if (currentService.Labels['hammerkit-definition'] !== (0, service_definition_1.getServiceDefinitionHash)(service)) {
+                service.status.write('info', `${service.name} changed since it was started, recreating it`);
+                await (0, remove_container_1.removeContainer)(docker.getContainer(currentService.Id));
+                return;
+            }
             const servicePid = 'hammerkit-pid' in currentService.Labels ? parseInt(currentService.Labels['hammerkit-pid']) : undefined;
             const serviceState = 'hammerkit-state' in currentService.Labels ? currentService.Labels['hammerkit-state'] : '';
             state.set({
@@ -181,6 +188,7 @@ function dockerServiceRuntime(service, workEnvironment) {
             for (const container of containers) {
                 await (0, remove_container_1.removeContainer)(docker.getContainer(container.Id));
             }
+            await (0, container_secrets_1.removeContainerSecrets)((0, work_instance_id_1.getWorkInstanceId)(service));
         },
         async remove() {
             await this.stop();

package/dist/planner/work-runtime-kubernetes.js

@@ -5,6 +5,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.kubernetesForwardRuntime = exports.kubernetesServiceRuntime = exports.kubernetesTaskRuntime = void 0;
 const abort_1 = require("../executer/abort");
+const get_service_ip_1 = require("../kubernetes/get-service-ip");
+const work_item_1 = require("./work-item");
 const kubernetes_service_1 = require("../executer/kubernetes-service");
 const kubernetes_instance_1 = require("../kubernetes/kubernetes-instance");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
@@ -23,6 +25,7 @@ const version_1 = require("../version");
 const restore_kubernetes_data_1 = require("../kubernetes/restore-kubernetes-data");
 const store_kubernetes_data_1 = require("../kubernetes/store-kubernetes-data");
 const remove_persistent_data_1 = require("../kubernetes/remove-persistent-data");
+const secrets_1 = require("../kubernetes/secrets");
 async function listJobNames(instance, kubernetes, task) {
     const jobs = await instance.batchApi.listNamespacedJob({
         namespace: kubernetes.namespace,
@@ -47,11 +50,31 @@ function kubernetesTaskRuntime(task, kubernetes) {
             const persistence = await (0, volumes_1.getKubernetesPersistence)(task);
             await (0, ensure_namespace_1.ensureNamespace)(instance, kubernetes.namespace);
             await (0, ensure_persistent_data_1.ensurePersistentData)(instance, kubernetes, environment, task, persistence);
+            const secrets = (0, secrets_1.getKubernetesSecretRefs)(task, task.data.secrets);
+            try {
+                await (0, secrets_1.ensureKubernetesSecret)(instance, kubernetes, task, task.data.secrets, environment);
+            }
+            catch (e) {
+                options.state.set({ stateKey: options.stateKey, type: 'error', errorMessage: (0, log_1.getErrorMessage)(e) });
+                return;
+            }
             // The last job of a run stays: its state label is what currentStateKey
             // reads. Jobs from an earlier run of this task go before this one starts.
             for (const name of await listJobNames(instance, kubernetes, task)) {
                 await (0, await_running_state_1.deleteJobAndWait)(instance, kubernetes, name, options.abort);
             }
+            // the services the task needs, by the names it lists them under
+            const hostAliases = [];
+            for (const need of task.needs) {
+                if (!(0, work_item_1.isContainerWorkServiceItem)(need.service)) {
+                    continue;
+                }
+                const ip = await (0, get_service_ip_1.getServiceIp)(instance, kubernetes, need.service);
+                if (!ip) {
+                    throw new Error(`unable to get service ip for ${need.name}`);
+                }
+                hostAliases.push({ ip, hostnames: [need.name] });
+            }
             const podName = `${task.name}-${options.stateKey}`;
             let i = 0;
             for (const cmd of task.data.cmds) {
@@ -84,15 +107,20 @@ function kubernetesTaskRuntime(task, kubernetes) {
                                 containers: [
                                     {
                                         image: task.data.image,
-                                        command: [cmd.parsed.command],
-                                        args: cmd.parsed.args,
+                                        // through the task's shell, as on Docker
+                                        command: [task.data.shell, '-c'],
+                                        args: [cmd.cmd],
                                         workingDir: cmd.cwd,
-                                        env: Object.entries(envs).map(([key, value]) => ({ name: key, value })),
+                                        env: [
+                                            ...Object.entries(envs).map(([key, value]) => ({ name: key, value })),
+                                            ...secrets.env,
+                                        ],
                                         name: `cmd-${++i}`,
-                                        volumeMounts: persistence.mounts.map((m) => m.mount),
+                                        volumeMounts: [...persistence.mounts.map((m) => m.mount), ...secrets.mounts],
                                     },
                                 ],
-                                volumes: persistence.volumes,
+                                volumes: [...persistence.volumes, ...secrets.volumes],
+                                hostAliases,
                                 restartPolicy: 'Never',
                             },
                         },
@@ -121,9 +149,12 @@ function kubernetesTaskRuntime(task, kubernetes) {
                         type: 'error',
                         errorMessage: (0, log_1.getErrorMessage)(e),
                     });
+                    await (0, secrets_1.removeKubernetesSecret)(instance, kubernetes, task).catch(() => undefined);
                     return;
                 }
             }
+            // the finished job stays for its state, the values it read need not
+            await (0, secrets_1.removeKubernetesSecret)(instance, kubernetes, task);
         },
         async stop() {
             const jobs = await instance.batchApi.listNamespacedJob({
@@ -160,6 +191,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
         async remove() {
             await this.stop();
             await (0, remove_persistent_data_1.removePersistentData)(instance, kubernetes, task);
+            await (0, secrets_1.removeKubernetesSecret)(instance, kubernetes, task);
         },
         async currentStateKey() {
             const jobs = await instance.batchApi.listNamespacedJob({
@@ -217,13 +249,15 @@ function kubernetesServiceRuntime(service, kubernetes) {
                     });
                 }
             }
+            await (0, secrets_1.removeKubernetesSecret)(instance, kubernetes, service);
         },
         async execute(environment, options) {
             const persistence = await (0, volumes_1.getKubernetesPersistence)(service);
             await (0, ensure_namespace_1.ensureNamespace)(instance, kubernetes.namespace);
             await (0, ensure_kubernetes_service_exists_1.ensureKubernetesServiceExists)(instance, kubernetes, service);
             await (0, ensure_persistent_data_1.ensurePersistentData)(instance, kubernetes, environment, service, persistence);
-            await (0, ensure_kubernetes_deployment_exists_1.ensureKubernetesDeploymentExists)(instance, kubernetes, service, persistence, options.stateKey);
+            await (0, secrets_1.ensureKubernetesSecret)(instance, kubernetes, service, service.data.secrets, environment);
+            await (0, ensure_kubernetes_deployment_exists_1.ensureKubernetesDeploymentExists)(instance, kubernetes, service, persistence, (0, secrets_1.getKubernetesSecretRefs)(service, service.data.secrets), options.stateKey);
             const name = (0, resources_1.getResourceName)(service);
             options.state.set({
                 type: 'running',

package/dist/planner/work-secret.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSecretDigest = exports.resolveSecretValue = exports.parseWorkSecrets = exports.getPortableSecretName = exports.getSecretName = void 0;
+const crypto_1 = require("crypto");
+const os_1 = require("os");
+const fs_1 = require("fs");
+const normalize_path_1 = require("./utils/normalize-path");
+const template_value_1 = require("./utils/template-value");
+const portable_path_1 = require("./utils/portable-path");
+const redact_1 = require("../utils/redact");
+function getSecretName(secret) {
+    return secret.target.type === 'env' ? secret.target.name : secret.target.path;
+}
+exports.getSecretName = getSecretName;
+// The name as it reads on every checkout, for cache identity: a file target
+// lives under the task's cwd, which is a different absolute path per machine.
+function getPortableSecretName(projectRoot, secret) {
+    return secret.target.type === 'env' ? secret.target.name : (0, portable_path_1.portablePath)(projectRoot, secret.target.path);
+}
+exports.getPortableSecretName = getPortableSecretName;
+function parseWorkSecrets(cwd, projectRoot, secrets, envs, environment) {
+    return (secrets ?? []).map((secret) => {
+        const ref = secret.from.substring(secret.from.indexOf(':') + 1);
+        const source = secret.from.startsWith('env:')
+            ? { type: 'env', name: ref }
+            : { type: 'file', path: (0, normalize_path_1.normalizePath)(cwd, (0, os_1.homedir)(), (0, template_value_1.templateValue)(ref, envs)) };
+        const target = secret.env
+            ? { type: 'env', name: secret.env }
+            : { type: 'file', path: (0, normalize_path_1.normalizePath)(cwd, cwd, (0, template_value_1.templateValue)(secret.path ?? '', envs)) };
+        const workSecret = {
+            source,
+            target,
+            cache: secret.cache ?? false,
+            digest: () => getSecretDigest(projectRoot, cwd, workSecret, readSecretValueSync(workSecret, environment)),
+        };
+        return workSecret;
+    });
+}
+exports.parseWorkSecrets = parseWorkSecrets;
+function readSecretValueSync(secret, environment) {
+    if (secret.source.type === 'env') {
+        const value = environment.processEnvs[secret.source.name];
+        if (value === undefined || value === null) {
+            throw new Error(`secret ${getSecretName(secret)}: environment variable ${secret.source.name} is not set`);
+        }
+        (0, redact_1.registerSecretValue)(value);
+        return value;
+    }
+    if (!(0, fs_1.existsSync)(secret.source.path)) {
+        throw new Error(`secret ${getSecretName(secret)}: file ${secret.source.path} does not exist`);
+    }
+    const value = (0, fs_1.readFileSync)(secret.source.path, 'utf8');
+    (0, redact_1.registerSecretValue)(value);
+    return value;
+}
+// The value, read when the task or service starts (or when a cache-affecting
+// secret is hashed); a missing source fails naming the secret.
+async function resolveSecretValue(secret, environment) {
+    if (secret.source.type === 'env') {
+        const value = environment.processEnvs[secret.source.name];
+        if (value === undefined || value === null) {
+            throw new Error(`secret ${getSecretName(secret)}: environment variable ${secret.source.name} is not set`);
+        }
+        (0, redact_1.registerSecretValue)(value);
+        return value;
+    }
+    if (!(await environment.file.exists(secret.source.path))) {
+        throw new Error(`secret ${getSecretName(secret)}: file ${secret.source.path} does not exist`);
+    }
+    const value = await environment.file.read(secret.source.path);
+    (0, redact_1.registerSecretValue)(value);
+    return value;
+}
+exports.resolveSecretValue = resolveSecretValue;
+// Salted with the project-relative location and the secret's name, so the
+// digest is identical on every checkout (remote cache ids match) but can't be
+// matched against digests of the same value elsewhere.
+function getSecretDigest(projectRoot, cwd, secret, value) {
+    const salt = `hammerkit-secret\0${(0, portable_path_1.portablePath)(projectRoot, cwd)}\0${getPortableSecretName(projectRoot, secret)}`;
+    return `sha256:${(0, crypto_1.createHash)('sha256').update(`${salt}\0${value}`).digest('hex')}`;
+}
+exports.getSecretDigest = getSecretDigest;
+//# sourceMappingURL=work-secret.js.map

package/dist/program.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getProgram = exports.createCli = void 0;
 const commander_1 = require("commander");
+const parse_set_arguments_1 = require("./parse-set-arguments");
 const path_1 = require("path");
 const ci_1 = require("./utils/ci");
 const parse_label_arguments_1 = require("./parser/parse-label-arguments");
@@ -56,7 +57,9 @@ function parseWorkLabelScope(options) {
 }
 async function getProgram(environment, argv) {
     const program = new commander_1.Command();
-    const args = [...argv];
+    const parsed = (0, parse_set_arguments_1.parseSetArguments)(argv);
+    const args = parsed.args;
+    environment.processEnvs = { ...environment.processEnvs, ...parsed.values };
     const fileIndex = args.indexOf('--file');
     const fileName = fileIndex >= 0 ? (0, path_1.join)(environment.cwd, args[fileIndex + 1]) : await (0, default_build_file_1.getBuildFilename)(environment.cwd, environment);
     if (fileIndex >= 0) {
@@ -421,6 +424,9 @@ async function getProgram(environment, argv) {
             .addOption(new commander_1.Option('-c, --concurrency <number>', 'parallel worker count').argParser(parseInt).default(4))
             .addOption(new commander_1.Option('-w, --watch', 'watch tasks').default(false))
             .addOption(new commander_1.Option('-d, --daemon', 'run services in background').default(false))
+            .addOption(new commander_1.Option('--wait <mode>', 'with --daemon, return once services are ready or once they started')
+            .default('ready')
+            .choices(['ready', 'start']))
             .addOption(new commander_1.Option('--env <name>', 'environment'))
             .addOption(new commander_1.Option('-l, --log <mode>', 'log mode')
             .default(ci_1.isCI ? 'live' : 'interactive')
@@ -440,6 +446,7 @@ async function getProgram(environment, argv) {
                     workers: options.concurrency,
                     logMode: options.log,
                     daemon: options.daemon,
+                    wait: options.wait,
                     cacheReadOnly: (0, read_only_1.isCacheReadOnly)(options.cacheReadOnly, environment.processEnvs),
                     timeout: options.timeout ?? null,
                 });
@@ -593,6 +600,7 @@ tasks:
     program.version((0, version_1.getVersion)());
     program.option('--verbose', 'log debugging information', false);
     program.option('--file', 'set build file', '.hammerkit.yaml');
+    program.option('--set <NAME=value>', 'value for $NAME / ${NAME} references, ahead of the shell and .env (repeatable)');
     program.configureOutput({
         writeOut: (str) => environment.console.info(str),
         writeErr: (str) => {

package/dist/schema/build-file-base-task-schema.js

@@ -9,6 +9,7 @@ const cache_schema_1 = require("./cache-schema");
 const build_file_task_command_schema_1 = require("./build-file-task-command-schema");
 const build_file_volume_schema_1 = require("./build-file-volume-schema");
 const duration_schema_1 = require("./duration-schema");
+const build_file_secret_schema_1 = require("./build-file-secret-schema");
 exports.buildFileBaseTaskSchema = (0, zod_1.object)({
     deps: (0, zod_1.array)((0, zod_1.string)()).optional(),
     needs: (0, zod_1.array)(build_file_need_schema_1.buildFileNeedSchema).optional(),
@@ -27,5 +28,6 @@ exports.buildFileBaseTaskSchema = (0, zod_1.object)({
     // Maximum execution time, e.g. `30s`, `10m`, `1h30m`. The task fails when it
     // runs longer. Does not affect the cache key (ADR-0002).
     timeout: duration_schema_1.durationSchema.optional(),
+    secrets: (0, zod_1.array)(build_file_secret_schema_1.buildFileSecretSchema).optional(),
 });
 //# sourceMappingURL=build-file-base-task-schema.js.map

package/dist/schema/build-file-container-service-schema.js

@@ -6,6 +6,7 @@ const envs_schema_1 = require("./envs-schema");
 const build_file_need_schema_1 = require("./build-file-need-schema");
 const labels_schema_1 = require("./labels-schema");
 const build_file_service_container_healthcheck_1 = require("./build-file-service-container-healthcheck");
+const build_file_secret_schema_1 = require("./build-file-secret-schema");
 exports.buildFileContainerServiceSchema = (0, zod_1.object)({
     image: (0, zod_1.string)(),
     description: (0, zod_1.string)().optional(),
@@ -30,6 +31,10 @@ exports.buildFileContainerServiceSchema = (0, zod_1.object)({
     labels: labels_schema_1.labelsSchema.optional(),
     continuous: (0, zod_1.boolean)().optional(),
     healthcheck: build_file_service_container_healthcheck_1.buildFileServiceContainerHealthcheck.optional(),
+    // a task (name or prefix:name, as in deps) that runs once the healthcheck
+    // passed; the service counts as ready for dependents only after it succeeded
+    init: (0, zod_1.string)().describe('task run once the service is healthy, before dependents start').optional(),
+    secrets: (0, zod_1.array)(build_file_secret_schema_1.buildFileSecretSchema).optional(),
 })
     .strict()
     .describe('container service');

package/dist/schema/build-file-secret-schema.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildFileSecretSchema = void 0;
+const zod_1 = require("zod");
+// A credential handed to a task or service without putting it in the build
+// file, the cache or the logs: `from: env:NAME` or `from: file:path`, injected
+// as an env variable (`env`) or a read-only file (`path`). `cache: true` makes
+// a salted digest of the value part of the task's cache key (ADR 0002).
+exports.buildFileSecretSchema = (0, zod_1.object)({
+    from: (0, zod_1.string)().regex(/^(env|file):.+$/, 'from must be env:NAME or file:path'),
+    env: (0, zod_1.string)()
+        .regex(/^[A-Za-z_][A-Za-z0-9_]*$/)
+        .optional(),
+    path: (0, zod_1.string)().optional(),
+    cache: (0, zod_1.boolean)().optional(),
+})
+    .strict()
+    .refine((secret) => (secret.env === undefined) !== (secret.path === undefined), {
+    message: 'a secret needs exactly one of env or path',
+})
+    .describe('secret from env:NAME or file:path, injected as env or a read-only file');
+//# sourceMappingURL=build-file-secret-schema.js.map

package/dist/schema/build-file-volume-schema.js

@@ -5,10 +5,12 @@ const zod_1 = require("zod");
 exports.buildFileVolumeSchema = (0, zod_1.union)([
     (0, zod_1.string)(),
     (0, zod_1.object)({
-        export: (0, zod_1.boolean)().optional(),
+        // `always`: copied to the host even when the task fails (test reports)
+        export: (0, zod_1.union)([(0, zod_1.boolean)(), (0, zod_1.literal)('always')]).optional(),
         resetOnChange: (0, zod_1.boolean)().optional(),
         path: (0, zod_1.string)(),
         name: (0, zod_1.string)().optional(),
+        readOnly: (0, zod_1.boolean)().optional(),
     }),
 ]);
 //# sourceMappingURL=build-file-volume-schema.js.map

package/dist/schema/reference-parser.js

@@ -73,6 +73,7 @@ async function parseReferences(ctx, mainScope, environment) {
                     scope: file,
                     needs: [],
                     deps: [],
+                    init: null,
                     envs: serviceEnvs,
                 };
             }
@@ -86,6 +87,7 @@ async function parseReferences(ctx, mainScope, environment) {
     for (const service of Object.values(reference.services)) {
         resolveDeps(reference, service, service.scope, service.schema);
         resolveNeeds(reference, service, service.scope, service.schema);
+        resolveInit(reference, service);
     }
     reference.caches = (0, resolve_cache_1.withBuiltinCaches)(declaredCaches);
     return reference;
@@ -142,6 +144,18 @@ function resolveDeps(reference, taskOrService, scope, schema) {
         });
     }
 }
+function resolveInit(reference, service) {
+    if ((0, build_file_service_schema_1.isBuildFileKubernetesServiceSchema)(service.schema) || !service.schema.init) {
+        return;
+    }
+    const initTask = findTask(reference, service.scope, service.schema.init, null);
+    service.init = {
+        task: initTask.task,
+        type: initTask.type,
+        cwd: initTask.type === 'include' ? service.cwd : initTask.task.cwd,
+        relativeName: service.schema.init,
+    };
+}
 function resolveNeeds(reference, taskOrService, scope, schema) {
     if ((0, build_file_service_schema_1.isBuildFileKubernetesServiceSchema)(schema)) {
         return;

package/dist/schema/work-scope-parser.js

@@ -37,15 +37,17 @@ function getWorkContext(context, scope, environment) {
             workTree.environment = filteredWorkTree.environment;
         }
     }
-    for (const task of Object.values(context.tasks)) {
-        const item = (0, append_work_task_1.appendWorkTask)(workTree, task.cwd, task, environment, context);
+    // everything is planned before the run is narrowed: planning a service adds
+    // its init task's need on it, which narrowing follows
+    const tasks = Object.values(context.tasks).map((task) => (0, append_work_task_1.appendWorkTask)(workTree, task.cwd, task, environment, context));
+    const services = Object.values(context.services).map((service) => (0, append_work_service_1.appendWorkService)(workTree, service, environment, context));
+    for (const item of tasks) {
         if (matchesTaskWorkScope(item, scope)) {
             requested.push(item.name);
             applyTask(filteredWorkTree, item);
         }
     }
-    for (const service of Object.values(context.services)) {
-        const item = (0, append_work_service_1.appendWorkService)(workTree, service, environment, context);
+    for (const item of services) {
         if (matchesServiceWorkScope(item.data, scope)) {
             applyService(filteredWorkTree, item);
         }
@@ -64,6 +66,11 @@ function keepRequirersInScope(workTree) {
     ]);
     for (const service of Object.values(workTree.services)) {
         service.requiredBy = service.requiredBy.filter((required) => inScope.has(required));
+        // an init task asked for alone is what its service starts for
+        const init = service.data.type === 'container-service' ? service.data.init : null;
+        if (init && workTree.requested?.length === 1 && workTree.requested[0] === init.task.name) {
+            service.requiredBy.push(init.task);
+        }
     }
 }
 function applyTask(workTree, item) {
@@ -73,12 +80,17 @@ function applyTask(workTree, item) {
     workTree.tasks[item.name] = item;
     applyNeedsAndDeps(workTree, item);
 }
-function applyService(workTree, item) {
+function applyService(workTree, need) {
+    const item = (0, append_work_service_1.getPlannedService)(need);
     if (workTree.services[item.name]) {
         return;
     }
     workTree.services[item.name] = item;
     applyNeedsAndDeps(workTree, item);
+    // a service in the run brings its init task, which runs once it is healthy
+    if (item.data.type === 'container-service' && item.data.init) {
+        applyTask(workTree, item.data.init.task);
+    }
 }
 function applyNeedsAndDeps(workTree, item) {
     for (const dep of item.deps) {

package/dist/utils/redact.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redact = exports.registerSecretValue = void 0;
+// Secret values hammerkit has read, masked in everything it logs, including the
+// output it streams from a task or service. Logs are per line, so each line of
+// a multi-line value (a key file) is masked on its own. Values shorter than
+// MIN_LENGTH are left alone: masking them would mangle unrelated output.
+const MIN_LENGTH = 4;
+const MASK = '***';
+const values = new Set();
+function registerSecretValue(value) {
+    for (const candidate of [value, ...value.split(/\r?\n/)]) {
+        const trimmed = candidate.trim();
+        if (trimmed.length >= MIN_LENGTH) {
+            values.add(trimmed);
+        }
+    }
+}
+exports.registerSecretValue = registerSecretValue;
+function redact(message) {
+    if (values.size === 0) {
+        return message;
+    }
+    // longest first, so a value containing another is masked as a whole
+    const sorted = [...values].sort((a, b) => b.length - a.length);
+    return sorted.reduce((result, value) => result.split(value).join(MASK), message);
+}
+exports.redact = redact;
+//# sourceMappingURL=redact.js.map

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.10.0",
+  "version": "1.11.1",
   "keywords": [
     "build",
     "build-tool",