hammerkit 1.27.0-next.7 → 1.27.0-next.8

package/dist/kubernetes/ensure-kubernetes-persistent-volume-claim-exists.js

@@ -65,7 +65,7 @@ async function ensureKubernetesPersistentVolumeClaimExists(instance, env, volume
             },
         },
     };
-    service.status.console('stdout', `ensure volume ${volume.name}`);
+    service.status.write('debug', `ensure volume ${volume.name}`);
     // Don't block on the PVC reaching "Bound". Storage classes with
     // volumeBindingMode WaitForFirstConsumer (docker-desktop's "standard",
     // k3d/k3s local-path, most cloud defaults) keep the claim Pending until a pod

package/dist/kubernetes/ensure-persistent-data.js

@@ -104,18 +104,18 @@ async function getPodForPersistence(instance, env, service, persistence, type, f
             volumes: persistence.volumes,
         },
     };
-    service.status.console('stdout', `create pod ${name}`);
+    service.status.write('debug', `create pod ${name}`);
     await removeStalePod(instance, env.namespace, name);
     const pod = await (0, apply_1.apply)(instance, podSpec);
     if (pod.status?.phase !== 'Running') {
-        service.status.console('stdout', `await running state ${name}`);
+        service.status.write('debug', `await running state ${name}`);
         await (0, await_running_state_1.awaitRunningState)(instance, env, name, 'Running');
     }
     try {
         await fn(name);
     }
     finally {
-        service.status.console('stdout', `delete pod ${name}`);
+        service.status.write('debug', `delete pod ${name}`);
         await instance.coreApi.deleteNamespacedPod({ name, namespace: env.namespace });
     }
 }
@@ -124,7 +124,7 @@ exports.getPodForPersistence = getPodForPersistence;
 // the task runs on it or outputs are restored into it, so it holds what a new one would
 async function clearClaim(instance, env, work, pod) {
     const targetPath = `/dev/hammerkit/${work.id()}`;
-    work.status.console('stdout', `clear what an earlier run left in ${targetPath}`);
+    work.status.write('info', `clear what an earlier run left in ${targetPath}`);
     let failure = null;
     const res = await instance.exec.exec(env.namespace, pod, 'volume', ['find', targetPath, '-mindepth', '1', '-maxdepth', '1', '-exec', 'rm', '-rf', '{}', '+'], process.stdout, process.stderr, null, false, (status) => {
         if (status.status !== 'Success') {
@@ -172,7 +172,7 @@ options = {}) {
     if (persistence.sources.length === 0 && !options.reset) {
         return;
     }
-    service.status.console('stdout', 'start upload container');
+    service.status.write('debug', 'start upload container');
     await getPodForPersistence(instance, env, service, persistence, 'write', async (name) => {
         if (options.reset) {
             await clearClaim(instance, env, service, name);
@@ -183,7 +183,7 @@ options = {}) {
                 continue;
             }
             const data = packSource(source);
-            service.status.console('stdout', `upload ${source.localPath}`);
+            service.status.write('info', `upload ${source.localPath}`);
             const targetPath = `/dev/hammerkit/${service.id()}`;
             const res = await instance.exec.exec(env.namespace, name, 'volume', ['tar', 'xf', '-', '-C', targetPath], process.stdout, process.stderr, data, false, (status) => {
                 service.status.write('debug', `upload ${source.localPath} to ${name}: ${status}`);

package/dist/server/oauth.js

@@ -106,7 +106,7 @@ class TokenVerifier {
                     ? [groups]
                     : [],
             claims,
-            ...(typeof payload.email_verified === 'boolean' ? { emailVerified: payload.email_verified } : {}),
+            ...emailVerified(payload.email_verified),
         };
     }
     async findKey(issuer, algorithm, kid) {
@@ -224,4 +224,15 @@ function isSecureUrl(value) {
         return false;
     }
 }
+// Some issuers send `email_verified` as the string "true" or "false": either says it as
+// much as the boolean does, anything else says nothing
+function emailVerified(value) {
+    if (value === true || value === 'true') {
+        return { emailVerified: true };
+    }
+    if (value === false || value === 'false') {
+        return { emailVerified: false };
+    }
+    return {};
+}
 //# sourceMappingURL=oauth.js.map

package/dist/server/sandboxes-api.js

@@ -175,7 +175,8 @@ function parse(schema, body) {
 /**
  * Who the commit of a push is by: the caller, as their token names them (`name` and
  * `email`, unless the issuer says the address is not verified), else by their subject at the
- * host of their issuer. Never what the request says, so a commit can not claim to be
+ * host of their issuer. Without a name, the local part of the address names them, then the
+ * subject. Never what the request says, so a commit can not claim to be
  * somebody else's.
  */
 function author(principal) {
@@ -183,11 +184,16 @@ function author(principal) {
         .replace(/[<>\0\r\n]/g, '')
         .trim()
         .slice(0, 200);
-    const name = clean(principal.claims.name) || clean(principal.claims.preferred_username) || clean(principal.sub);
     // an address the issuer says it did not verify is whatever the caller typed in
     const claimed = principal.emailVerified === false ? '' : clean(principal.claims.email);
-    if (/^[^\s@]+@[^\s@]+$/.test(claimed)) {
-        return { name, email: claimed };
+    const email = /^[^\s@]+@[^\s@]+$/.test(claimed) ? claimed : '';
+    // a Google service account's token has an address but no name: its local part reads better than the number in sub
+    const name = clean(principal.claims.name) ||
+        clean(principal.claims.preferred_username) ||
+        email.slice(0, email.indexOf('@')) ||
+        clean(principal.sub);
+    if (email) {
+        return { name, email };
     }
     let host = 'hammerkit';
     try {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.27.0-next.7",
+  "version": "1.27.0-next.8",
   "keywords": [
     "build",
     "build-tool",