hammerkit 1.27.0-next.17 → 1.27.0-next.18

package/dist/executer/execution-steps.js

@@ -89,8 +89,11 @@ exports.prepareMounts = prepareMounts;
 async function setUserPermissions(item, container, environment) {
     if (item.data.user) {
         // On a server only the volumes: a chown as the container's root on a path of the host
-        // would follow a link a task put there after the binds were checked
-        const binds = (0, get_container_binds_1.getContainerBinds)(item).filter((bind) => !environment.hosted || !(0, path_1.isAbsolute)(bind.localPath));
+        // would follow a link a task put there after the binds were checked. Never a mount: it
+        // is a path of the host the build file names, such as /var/run/docker.sock, whose owner
+        // is not hammerkit's to change
+        const mounted = new Set(item.data.mounts.map((mount) => mount.containerPath));
+        const binds = (0, get_container_binds_1.getContainerBinds)(item).filter((bind) => !mounted.has(bind.containerPath) && (!environment.hosted || !(0, path_1.isAbsolute)(bind.localPath)));
         if (!environment.hosted) {
             await (0, set_user_permission_1.setUserPermission)(item.data.cwd, item.status, environment, container, item.data.user);
         }

package/dist/planner/utils/normalize-path.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.normalizePath = void 0;
+exports.normalizeHostPath = exports.getHomeReference = exports.normalizePath = void 0;
 const path_1 = require("path");
 function normalizePath(cwd, pwd, path) {
     if (path.startsWith('/')) {
@@ -14,4 +14,22 @@ function normalizePath(cwd, pwd, path) {
     }
 }
 exports.normalizePath = normalizePath;
+// What a path of the host starts with to name the home directory: `~` and `$HOME`, and
+// `$PWD`, which in a mount has always meant the home directory, not the project it reads like
+function getHomeReference(path) {
+    for (const reference of ['~', '$HOME']) {
+        if (path === reference || path.startsWith(`${reference}/`) || path.startsWith(`${reference}\\`)) {
+            return reference;
+        }
+    }
+    return path.startsWith('$PWD') ? '$PWD' : null;
+}
+exports.getHomeReference = getHomeReference;
+// A path of the host in a mount: in the home directory when it starts with one of the
+// references above, else in the directory of the build file unless it is absolute
+function normalizeHostPath(cwd, home, path) {
+    const reference = getHomeReference(path);
+    return reference ? (0, path_1.join)(home, path.substring(reference.length)) : normalizePath(cwd, home, path);
+}
+exports.normalizeHostPath = normalizeHostPath;
 //# sourceMappingURL=normalize-path.js.map

package/dist/planner/utils/parse-work-mount.js

@@ -7,6 +7,12 @@ const path_1 = require("path");
 function parseWorkMount(cwd, dir) {
     const parts = dir.split(':');
     if (parts.length === 1) {
+        const home = (0, normalize_path_1.getHomeReference)(dir);
+        if (home === '~' || home === '$HOME') {
+            // the container has no such directory: the same path on both sides would be one of the
+            // project there (`$PWD` has always been, so it stays)
+            throw new Error(`mount ${dir} is in the home directory, name where it goes in the container (${dir}:/path)`);
+        }
         return parseLocalMount(cwd, dir, dir, dir, false);
     }
     else if (parts.length === 2) {
@@ -22,7 +28,7 @@ function parseWorkMount(cwd, dir) {
 exports.parseWorkMount = parseWorkMount;
 function parseLocalMount(cwd, localPath, containerPath, mount, readOnly) {
     return {
-        localPath: (0, normalize_path_1.normalizePath)(cwd, (0, os_1.homedir)(), localPath),
+        localPath: (0, normalize_path_1.normalizeHostPath)(cwd, (0, os_1.homedir)(), localPath),
         containerPath: (0, normalize_path_1.normalizePath)(cwd, cwd, containerPath),
         isFile: (0, path_1.extname)(localPath).length > 1,
         mount,

package/dist/planner/validate.js

@@ -4,6 +4,7 @@ exports.checkIfContextExists = exports.hasDependencyCycle = exports.hasNeedCycle
 const read_build_file_1 = require("../parser/read-build-file");
 const plan_work_tasks_1 = require("./utils/plan-work-tasks");
 const unreferenced_build_file_envs_1 = require("./unreferenced-build-file-envs");
+const normalize_path_1 = require("./utils/normalize-path");
 async function* validate(workTree, context) {
     const cycleItems = [];
     for (const item of (0, plan_work_tasks_1.iterateWorkServices)(workTree)) {
@@ -16,6 +17,10 @@ async function* validate(workTree, context) {
                 yield { type: 'warn', message: 'missing healthcheck', item: service };
             }
             for (const mount of service.mounts) {
+                const pwd = getPwdMountWarning(mount);
+                if (pwd) {
+                    yield { type: 'warn', message: pwd, item: service };
+                }
                 if (!(await context.file.exists(mount.localPath))) {
                     yield {
                         type: 'warn',
@@ -62,6 +67,12 @@ async function* validate(workTree, context) {
                 item: task,
             };
         }
+        for (const mount of task.type === 'container-task' ? task.mounts : []) {
+            const pwd = getPwdMountWarning(mount);
+            if (pwd) {
+                yield { type: 'warn', message: pwd, item: task };
+            }
+        }
         for (const src of task.src) {
             if (!(await context.file.exists(src.absolutePath))) {
                 yield {
@@ -146,4 +157,15 @@ async function checkIfContextExists(service, context) {
     return false;
 }
 exports.checkIfContextExists = checkIfContextExists;
+// `$PWD` in a mount is the home directory, which reads like a path of the project
+function getPwdMountWarning(mount) {
+    const source = mount.mount.split(':')[0];
+    if ((0, normalize_path_1.getHomeReference)(source) !== '$PWD') {
+        return null;
+    }
+    const rest = source.substring('$PWD'.length);
+    const home = rest === '' || rest.startsWith('/') || rest.startsWith('\\') ? `~${rest}` : '~/…';
+    return (`mount ${source} is ${mount.localPath}: $PWD in a mount is the home directory, not the project. ` +
+        `Write ${home} for the home directory, or a relative path for the project`);
+}
 //# sourceMappingURL=validate.js.map

package/dist/remote/remote-work-commands.js

@@ -334,7 +334,7 @@ function registerWorkCommands(remote, context) {
                 throw new Error(`the build file has no task ${(0, server_client_1.printable)(task)}`);
             }
             if (found.key === null) {
-                unkeyed.push(`${(0, server_client_1.printable)(task)}: can not be verified, ${(0, server_client_1.printable)(found.reason)}`);
+                unkeyed.push({ task, reason: found.reason });
             }
             else {
                 keys.push({ task, key: found.key });
@@ -357,12 +357,14 @@ function registerWorkCommands(remote, context) {
                 environment.stdout.write(`${(0, server_client_1.printable)(task)}: no run on ${serverName} passed it for these files${check?.reason ? `, ${(0, server_client_1.printable)(check.reason)}` : ''}\n`);
             }
         }
-        for (const line of unkeyed) {
-            environment.stdout.write(`${line}\n`);
+        for (const { task, reason } of unkeyed) {
+            environment.stdout.write(`${(0, server_client_1.printable)(task)}: can not be verified, ${(0, server_client_1.printable)(reason)}\n`);
         }
         if (missing.length > 0 || unkeyed.length > 0) {
             const run = missing.length > 0 ? `; run on the server: hammerkit remote run ${missing.map(server_client_1.printable).join(' ')}` : '';
-            fail(`not verified: ${[...missing, ...unkeyed.map((line) => line.split(':')[0])].join(', ')}${run}`, 1);
+            // whole names: a task of an include is named like build:all
+            const names = [...missing, ...unkeyed.map(({ task }) => task)].map(server_client_1.printable);
+            fail(`not verified: ${names.join(', ')}${run}`, 1);
         }
     }));
     remote

package/dist/remote/server-client.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.callServer = exports.getMe = exports.getDiscovery = exports.printableWhole = exports.printable = exports.ServerError = void 0;
+exports.callServer = exports.getMe = exports.getDiscovery = exports.printableWhole = exports.printableLines = exports.printable = exports.ServerError = void 0;
 const discovery_1 = require("../server/discovery");
 const TIMEOUT_MS = 10000;
 const WRITE_TIMEOUT_MS = 30000;
@@ -21,6 +21,17 @@ function printable(value) {
     return text.length > 300 ? `${text.slice(0, 300)}… (+${text.length - 300} chars)` : text;
 }
 exports.printable = printable;
+// Text of several lines, such as every problem of a refused publish: each line made
+// printable and cut like `printable`, one per line, and at most `MAX_LINES` of them.
+const MAX_LINES = 100;
+function printableLines(value) {
+    const lines = String(value)
+        .split(/\r?\n/)
+        .filter((line) => line.trim().length > 0);
+    const shown = lines.slice(0, MAX_LINES).map(printable);
+    return lines.length > MAX_LINES ? [...shown, `… (+${lines.length - MAX_LINES} lines)`] : shown;
+}
+exports.printableLines = printableLines;
 // The same, never cut: for what somebody decides on, such as a command.
 function printableWhole(value) {
     return String(value)
@@ -92,7 +103,9 @@ async function callServer(server, token, method, path, body) {
         throw new ServerError(`${server.url} did not accept the token`);
     }
     if (!response.ok) {
-        const said = answer && typeof answer.error === 'string' ? `: ${printable(answer.error)}` : '';
+        const lines = answer && typeof answer.error === 'string' ? printableLines(answer.error) : [];
+        // a refused publish says every problem, each on a line of its own
+        const said = lines.length > 1 ? `:\n${lines.map((line) => `  ${line}`).join('\n')}` : lines.length === 1 ? `: ${lines[0]}` : '';
         throw new ServerError(`${server.url} answered ${response.status}${said}`, response.status);
     }
     return { status: response.status, body: answer };

package/dist/run-program.js

@@ -7,6 +7,8 @@ exports.runProgram = void 0;
 const program_1 = require("./program");
 const parse_error_1 = require("./schema/parse-error");
 const colors_1 = __importDefault(require("colors"));
+const commander_1 = require("commander");
+const log_1 = require("./log");
 function runProgram(env, argv, exitOverride) {
     return (0, program_1.getProgram)(env, argv)
         .then(({ program, args }) => {
@@ -18,8 +20,15 @@ function runProgram(env, argv, exitOverride) {
             for (const error of err.zod.errors) {
                 env.stderr.write(` ${colors_1.default.underline(colors_1.default.blue(`error`))} at ${colors_1.default.gray(error.path.join('.'))} ${error.message}  ${colors_1.default.gray(error.code)}\n`);
             }
+            // printed, but still a failure: CI must not pass on a build file that doesn't parse
+            throw err;
         }
         else {
+            // what commander reports (program.error, a wrong option) is printed already; anything
+            // else, such as a build file that is no YAML, would otherwise end the process silently
+            if (!(err instanceof commander_1.CommanderError)) {
+                env.stderr.write(`${colors_1.default.red('error')}: ${(0, log_1.getErrorMessage)(err)}\n`);
+            }
             throw err;
         }
     });

package/dist/schema/reference-parser.js

@@ -210,7 +210,9 @@ function resolveNeeds(reference, taskOrService, scope, schema) {
     for (const needName of schema.needs || []) {
         if (typeof needName === 'string') {
             taskOrService.needs.push({
-                relativeName: needName,
+                // the host name it is reached by: a service of an include, `services:postgres`, as
+                // `services-postgres`, since Docker and DNS take no colon
+                relativeName: needName.replace(/:/g, '-'),
                 service: findService(reference, scope, needName),
             });
         }
@@ -221,6 +223,11 @@ function resolveNeeds(reference, taskOrService, scope, schema) {
             });
         }
     }
+    const names = taskOrService.needs.map((need) => need.relativeName);
+    const twice = names.find((name, index) => names.indexOf(name) !== index);
+    if (twice) {
+        throw new Error(`${taskOrService.relativeName} needs two services as ${twice}, give one another name with name:`);
+    }
 }
 function findTask(ctx, scope, name, type) {
     const ref = (0, split_name_1.splitName)(name);

package/dist/secrets/github-app-token-command.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerGithubAppTokenCommand = void 0;
+const commander_1 = require("commander");
 const log_1 = require("../log");
 const github_app_token_1 = require("./github-app-token");
 // `hammerkit github-app-token <owner/repo>`: a secret provider command for the token a
@@ -18,7 +19,8 @@ function registerGithubAppTokenCommand(program, environment) {
         }
         catch (e) {
             environment.stderr.write(`github-app-token: ${(0, log_1.getErrorMessage)(e)}\n`);
-            throw e;
+            // said already: the CLI does not print it again
+            throw new commander_1.CommanderError(1, 'hammerkit.githubAppToken', (0, log_1.getErrorMessage)(e));
         }
     });
 }

package/dist/server/plan.js

@@ -13,6 +13,7 @@ const work_scope_parser_1 = require("../schema/work-scope-parser");
 const work_task_1 = require("../planner/work-task");
 const work_service_1 = require("../planner/work-service");
 const hosted_volumes_1 = require("../planner/utils/hosted-volumes");
+const normalize_path_1 = require("../planner/utils/normalize-path");
 const log_1 = require("../log");
 const parse_error_1 = require("../schema/parse-error");
 const task_arguments_1 = require("../planner/utils/task-arguments");
@@ -165,101 +166,125 @@ function describeSecret(secret) {
 // server has no account, so nothing would stand between the build file and the
 // operator's own credentials.
 function findPolicyProblems(items, policy, root) {
-    const problems = [];
+    // the problems of each item, said once for the items of a directory that share one, such
+    // as the tasks of an included file that all mount the docker socket
+    const grouped = new Map();
     for (const item of items) {
-        const runtime = item.data.type === 'local-task' ? 'local' : 'docker';
-        if (policy.runtimes && !policy.runtimes.includes(runtime)) {
-            problems.push(`${item.name}: runs on the ${runtime} runtime, which this server does not allow (runtimes: ${policy.runtimes.join(', ')})`);
-        }
-        const data = item.data;
-        // what a task reads and writes is the bundle's: `src: ../..` would have the server
-        // copy its own files (its credentials, other callers' caches) into the task
-        for (const source of 'src' in data ? data.src : []) {
-            if (!source.inherited && insideBundle(root, data.cwd, source.absolutePath).length === 0) {
-                problems.push(`${item.name}: src ${source.source} is outside of the bundle`);
+        const prefix = `${item.name}: `;
+        for (const problem of findItemPolicyProblems(item, policy, root)) {
+            const said = problem.startsWith(prefix) ? problem.slice(prefix.length) : problem;
+            const key = `${item.data.cwd}\0${said}`;
+            const group = grouped.get(key);
+            if (group) {
+                group.names.push(item.name);
             }
-        }
-        for (const generate of (0, work_task_1.isWorkTask)(data) ? data.generates : []) {
-            if (!generate.inherited && insideBundle(root, data.cwd, generate.path).length === 0) {
-                problems.push(`${item.name}: generates ${generate.path}, which is outside of the bundle`);
+            else {
+                grouped.set(key, { names: [item.name], problem: said });
             }
         }
-        // what holds a credential gets at most `runs.secretNetwork`, so a tool it runs can't
-        // send the credential anywhere else
-        const reads = getCredentialReads({
-            secrets: secretsOf(item).map(describeSecret),
-            serverEnvs: 'envs' in data ? data.envs.processNames ?? [] : [],
-        });
-        const ceilings = [];
-        if (policy.network && (0, work_network_1.isLimitedNetwork)(policy.network)) {
-            ceilings.push({ ceiling: policy.network, setting: 'runs.network', reason: '' });
+    }
+    return [...grouped.values()].map(({ names: [name, ...others], problem }) => others.length > 0 ? `${name} (also ${others.join(', ')}): ${problem}` : `${name}: ${problem}`);
+}
+function findItemPolicyProblems(item, policy, root) {
+    const problems = [];
+    const runtime = item.data.type === 'local-task' ? 'local' : 'docker';
+    if (policy.runtimes && !policy.runtimes.includes(runtime)) {
+        problems.push(`${item.name}: runs on the ${runtime} runtime, which this server does not allow (runtimes: ${policy.runtimes.join(', ')})`);
+    }
+    const data = item.data;
+    // what a task reads and writes is the bundle's: `src: ../..` would have the server
+    // copy its own files (its credentials, other callers' caches) into the task
+    for (const source of 'src' in data ? data.src : []) {
+        if (!source.inherited && insideBundle(root, data.cwd, source.absolutePath).length === 0) {
+            problems.push(`${item.name}: src ${source.source} is outside of the bundle`);
         }
-        if (reads.length > 0 && policy.secretNetwork && (0, work_network_1.isLimitedNetwork)(policy.secretNetwork)) {
-            ceilings.push({
-                ceiling: policy.secretNetwork,
-                setting: 'runs.secretNetwork',
-                reason: ` to what reads ${reads.join(', ')}`,
-            });
+    }
+    for (const generate of (0, work_task_1.isWorkTask)(data) ? data.generates : []) {
+        if (!generate.inherited && insideBundle(root, data.cwd, generate.path).length === 0) {
+            problems.push(`${item.name}: generates ${generate.path}, which is outside of the bundle`);
         }
-        for (const { ceiling, setting, reason } of ceilings) {
-            // on a cluster a local task is a pod of a pool's tool image, limited like any other
-            if (data.type === 'local-task' && policy.backend !== 'kubernetes') {
-                problems.push(`${item.name}: is a local task, which can't be limited to the network this server allows${reason} ` +
-                    `(${setting}: ${(0, work_network_1.formatNetwork)(ceiling)})`);
-            }
-            else if ('network' in data && (0, work_network_1.exceedsNetwork)(data.network, ceiling)) {
-                problems.push(`${item.name}: asks for network ${(0, work_network_1.formatNetwork)(data.network)}, more than this server allows${reason} ` +
-                    `(${setting}: ${(0, work_network_1.formatNetwork)(ceiling)})`);
-            }
+    }
+    // what holds a credential gets at most `runs.secretNetwork`, so a tool it runs can't
+    // send the credential anywhere else
+    const reads = getCredentialReads({
+        secrets: secretsOf(item).map(describeSecret),
+        serverEnvs: 'envs' in data ? data.envs.processNames ?? [] : [],
+    });
+    const ceilings = [];
+    if (policy.network && (0, work_network_1.isLimitedNetwork)(policy.network)) {
+        ceilings.push({ ceiling: policy.network, setting: 'runs.network', reason: '' });
+    }
+    if (reads.length > 0 && policy.secretNetwork && (0, work_network_1.isLimitedNetwork)(policy.secretNetwork)) {
+        ceilings.push({
+            ceiling: policy.secretNetwork,
+            setting: 'runs.secretNetwork',
+            reason: ` to what reads ${reads.join(', ')}`,
+        });
+    }
+    for (const { ceiling, setting, reason } of ceilings) {
+        // on a cluster a local task is a pod of a pool's tool image, limited like any other
+        if (data.type === 'local-task' && policy.backend !== 'kubernetes') {
+            problems.push(`${item.name}: is a local task, which can't be limited to the network this server allows${reason} ` +
+                `(${setting}: ${(0, work_network_1.formatNetwork)(ceiling)})`);
         }
-        if ((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data)) {
-            for (const mount of data.mounts) {
-                // a path of the server is not the build file's to mount: the docker socket, /etc, a home directory
-                if (insideBundle(root, data.cwd, mount.localPath).length === 0) {
-                    problems.push(`${item.name}: mounts ${mount.localPath}, which is outside of the bundle`);
-                }
-            }
+        else if ('network' in data && (0, work_network_1.exceedsNetwork)(data.network, ceiling)) {
+            problems.push(`${item.name}: asks for network ${(0, work_network_1.formatNetwork)(data.network)}, more than this server allows${reason} ` +
+                `(${setting}: ${(0, work_network_1.formatNetwork)(ceiling)})`);
         }
-        for (const volume of (0, work_service_1.isContainerWorkService)(data) ? data.volumes : []) {
-            // docker takes anything else for a path of the host, such as the docker socket
-            if (!(0, hosted_volumes_1.isVolumeName)(volume.name)) {
-                problems.push(`${item.name}: volume ${volume.name} is not a volume name, a path of the server can't be mounted`);
+    }
+    if ((0, work_task_1.isContainerWorkTask)(data) || (0, work_service_1.isContainerWorkService)(data)) {
+        for (const mount of data.mounts) {
+            // a path of the server is not the build file's to mount: the docker socket, /etc, a home directory
+            if (insideBundle(root, data.cwd, mount.localPath).length === 0) {
+                problems.push(`${item.name}: mounts ${describeMountSource(mount)}, which is outside of the bundle`);
             }
         }
-        for (const secret of secretsOf(item)) {
-            const source = secret.source;
-            if (policy.backend === 'kubernetes' && source.type === 'provider') {
-                // the server reads no secret of a provider on a cluster: the Job of a task does
-                if (!(0, work_task_1.isWorkTask)(item.data)) {
-                    problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider}, which ` +
-                        'this server does for tasks only, a service on its cluster gets no provider secret yet');
-                }
-                else if (secret.cache) {
-                    problems.push(`${item.name}: the secret ${describeSecret(secret).target} has cache: true, its digest would need ` +
-                        'the value before the Job of the task reads it, which this server does not support yet');
-                }
-                else if ((0, work_network_1.isLimitedNetwork)(item.data.network) && !policy.proxiedProviders?.includes(source.provider)) {
-                    // the init containers that read it share the pod's NetworkPolicy, and reach the
-                    // provider only through the egress proxy
-                    problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider} in the ` +
-                        `Job of the task, which network ${(0, work_network_1.formatNetwork)(item.data.network)} would cut off from it: ` +
-                        `this server names no endpoints of ${source.provider} in backend.providers.${source.provider}.allow ` +
-                        'for the egress proxy to let through, so the task keeps an open network');
-                }
-            }
-            if (source.type === 'provider' && policy.reserved?.includes(source.account)) {
-                problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read as ${source.account}, which the server uses to read repositories`);
+    }
+    for (const volume of (0, work_service_1.isContainerWorkService)(data) ? data.volumes : []) {
+        // docker takes anything else for a path of the host, such as the docker socket
+        if (!(0, hosted_volumes_1.isVolumeName)(volume.name)) {
+            problems.push(`${item.name}: volume ${volume.name} is not a volume name, a path of the server can't be mounted`);
+        }
+    }
+    for (const secret of secretsOf(item)) {
+        const source = secret.source;
+        if (policy.backend === 'kubernetes' && source.type === 'provider') {
+            // the server reads no secret of a provider on a cluster: the Job of a task does
+            if (!(0, work_task_1.isWorkTask)(item.data)) {
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider}, which ` +
+                    'this server does for tasks only, a service on its cluster gets no provider secret yet');
             }
-            else if (source.type === 'file') {
-                problems.push(`${item.name}: a secret can not read a file of the server (file:), use a secret provider`);
+            else if (secret.cache) {
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} has cache: true, its digest would need ` +
+                    'the value before the Job of the task reads it, which this server does not support yet');
             }
-            else if (source.type === 'env' && !policy.envs.includes(source.name)) {
-                problems.push(`${item.name}: the secret ${describeSecret(secret).target} reads env:${source.name}, which the server does not list in ${policy.envsFrom ?? 'runs.env.allow'}`);
+            else if ((0, work_network_1.isLimitedNetwork)(item.data.network) && !policy.proxiedProviders?.includes(source.provider)) {
+                // the init containers that read it share the pod's NetworkPolicy, and reach the
+                // provider only through the egress proxy
+                problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read from ${source.provider} in the ` +
+                    `Job of the task, which network ${(0, work_network_1.formatNetwork)(item.data.network)} would cut off from it: ` +
+                    `this server names no endpoints of ${source.provider} in backend.providers.${source.provider}.allow ` +
+                    'for the egress proxy to let through, so the task keeps an open network');
             }
         }
+        if (source.type === 'provider' && policy.reserved?.includes(source.account)) {
+            problems.push(`${item.name}: the secret ${describeSecret(secret).target} is read as ${source.account}, which the server uses to read repositories`);
+        }
+        else if (source.type === 'file') {
+            problems.push(`${item.name}: a secret can not read a file of the server (file:), use a secret provider`);
+        }
+        else if (source.type === 'env' && !policy.envs.includes(source.name)) {
+            problems.push(`${item.name}: the secret ${describeSecret(secret).target} reads env:${source.name}, which the server does not list in ${policy.envsFrom ?? 'runs.env.allow'}`);
+        }
     }
     return problems;
 }
+// A mount of the home directory says so: `$PWD` in a mount is the home directory, not the
+// project, which reads like a path of the checkout
+function describeMountSource(mount) {
+    const home = (0, normalize_path_1.getHomeReference)(mount.mount.split(':')[0]);
+    return home ? `${mount.localPath} (${home} is the home directory)` : mount.localPath;
+}
 function toPlan(root, item) {
     const data = item.data;
     const secrets = secretsOf(item).map(describeSecret);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.27.0-next.17",
+  "version": "1.27.0-next.18",
   "keywords": [
     "build",
     "build-tool",