hammerkit 1.27.0-next.9 → 2.0.0-next.1

package/dist/schema/schema-parser.js

@@ -6,6 +6,7 @@ const read_build_file_1 = require("../parser/read-build-file");
 const path_1 = require("path");
 const default_build_file_1 = require("../parser/default-build-file");
 const parse_error_1 = require("./parse-error");
+const removed_properties_1 = require("./removed-properties");
 const build_file_include_schema_1 = require("./build-file-include-schema");
 const resolve_git_source_1 = require("../includes/resolve-git-source");
 async function createParseContext(fileName, environment, options) {
@@ -13,60 +14,80 @@ async function createParseContext(fileName, environment, options) {
         files: {},
         refreshed: options?.refresh ? new Map() : undefined,
         directory: options?.directory,
+        checkGitSource: options?.checkGitSource,
     };
     const scope = await appendBuildFile(workDirectory(ctx, (0, path_1.dirname)(fileName)), ctx, environment, fileName, []);
     return { ctx, scope };
 }
 exports.createParseContext = createParseContext;
-async function appendBuildFile(cwd, ctx, environment, fileName, namePrefix, remote, inputs) {
+async function appendBuildFile(cwd, ctx, environment, fileName, namePrefix, remote, inputs, 
+// on a server: the file is included with `publish: false`, or below such an include
+leftOut = false) {
     const relativeName = namePrefix.join(':');
-    // the same file included with other inputs is another set of tasks
-    const key = inputs ? `${cwd}:${fileName}:${JSON.stringify(inputs)}` : `${cwd}:${fileName}`;
+    // the same file included with other inputs is another set of tasks, and on a server a
+    // file left out is another one than the same file published (its git sources differ)
+    const key = `${cwd}:${fileName}${inputs ? `:${JSON.stringify(inputs)}` : ''}${leftOut ? ':left-out' : ''}`;
     if (ctx.files[key]) {
         return ctx.files[key];
     }
     const input = await (0, read_build_file_1.read)(fileName, environment);
+    (0, removed_properties_1.assertNoRemovedProperties)(input, fileName);
     const result = await build_file_schema_1.buildFileSchema.safeParseAsync(input);
-    if (result.success) {
-        const scope = {
-            fileName,
-            cwd,
-            schema: inputs ? applyInputs(result.data, inputs, namePrefix, fileName) : result.data,
-            namePrefix: relativeName,
-            remote,
-            inputs,
-            references: {},
-        };
-        ctx.files[key] = scope;
-        if (scope.schema.references) {
-            for (const referenceName of Object.keys(scope.schema.references)) {
-                const target = await locateInclude(ctx, scope, scope.schema.references[referenceName], 
-                // a remote file's paths resolve within its repository
-                remote ? (0, path_1.dirname)(scope.fileName) : readDirectory(ctx, scope.cwd), environment);
-                const referenceScope = await appendBuildFile(workDirectory(ctx, (0, path_1.dirname)(target.fileName)), ctx, environment, target.fileName, [...namePrefix, referenceName], target.remote, target.inputs);
-                if (scope.references[referenceName]) {
-                    throw new Error(referenceName + ' already exists');
-                }
-                scope.references[referenceName] = { type: 'reference', scope: referenceScope };
+    if (!result.success) {
+        throw new parse_error_1.ParseError(result.error, fileName);
+    }
+    const scope = {
+        fileName,
+        cwd,
+        schema: inputs ? applyInputs(result.data, inputs, namePrefix, fileName) : result.data,
+        namePrefix: relativeName,
+        remote,
+        inputs,
+        references: {},
+    };
+    ctx.files[key] = scope;
+    for (const block of ['references', 'includes']) {
+        for (const [name, include] of Object.entries(scope.schema[block] ?? {})) {
+            if (scope.references[name]) {
+                throw new Error(name + ' already exists');
             }
-        }
-        if (scope.schema.includes) {
-            for (const includeName of Object.keys(scope.schema.includes)) {
-                const target = await locateInclude(ctx, scope, scope.schema.includes[includeName], (0, path_1.dirname)(scope.fileName), environment);
-                const includeScope = await appendBuildFile(cwd, ctx, environment, target.fileName, [...namePrefix, includeName], target.remote, target.inputs);
-                if (scope.references[includeName]) {
-                    throw new Error(includeName + ' already exists');
-                }
-                scope.references[includeName] = { type: 'include', scope: includeScope };
+            const publish = (0, build_file_include_schema_1.isPublished)(include);
+            const type = block === 'references' ? 'reference' : 'include';
+            // a server does not fetch what it leaves out: it doesn't run, and isn't checked
+            const leaveOut = !!environment.hosted && (leftOut || !publish);
+            if ((0, build_file_include_schema_1.isGitSource)(include) && leaveOut) {
+                scope.references[name] = { type, publish, scope: notFetched(cwd, [...namePrefix, name], include) };
+                continue;
             }
+            if ((0, build_file_include_schema_1.isGitSource)(include)) {
+                ctx.checkGitSource?.(include, scope, block, name);
+            }
+            const target = await locateInclude(ctx, scope, include, block === 'references'
+                ? // a remote file's paths resolve within its repository
+                    remote
+                        ? (0, path_1.dirname)(scope.fileName)
+                        : readDirectory(ctx, scope.cwd)
+                : (0, path_1.dirname)(scope.fileName), environment);
+            const targetScope = await appendBuildFile(
+            // a reference works in its own directory, an include in the one of the including file
+            block === 'references' ? workDirectory(ctx, (0, path_1.dirname)(target.fileName)) : cwd, ctx, environment, target.fileName, [...namePrefix, name], target.remote, target.inputs, leaveOut);
+            scope.references[name] = { type, scope: targetScope, publish };
         }
-        return scope;
-    }
-    else {
-        throw new parse_error_1.ParseError(result.error, fileName);
     }
+    return scope;
 }
 exports.appendBuildFile = appendBuildFile;
+// The scope of a git source a server does not fetch, see ParseScope.notFetched
+function notFetched(cwd, namePrefix, include) {
+    return {
+        fileName: `${include.git}${include.path ? ` ${include.path}` : ''}`,
+        cwd,
+        schema: {},
+        namePrefix: namePrefix.join(':'),
+        references: {},
+        notFetched: true,
+    };
+}
 // The directory a build file works in, for the directory it was read from: the same
 // one, unless the files were read from elsewhere (see BuildFileDirectory).
 function workDirectory(ctx, directory) {
@@ -89,13 +110,45 @@ async function locateInclude(ctx, scope, include, base, environment) {
         if (!(0, resolve_git_source_1.isWithin)(remote.root, path)) {
             throw new Error(`${include.path} in ${include.git} points outside the repository`);
         }
-        return { fileName: await (0, default_build_file_1.getBuildFilename)(path, environment), remote, inputs: include.with };
+        return { fileName: await (0, default_build_file_1.getBuildFilename)(path, environment), remote, inputs: passEnvs(include.with, scope) };
     }
-    const path = (0, path_1.join)(base, include);
+    const localPath = typeof include === 'string' ? include : include.path;
+    const path = (0, path_1.join)(base, localPath);
     if (scope.remote && !(0, resolve_git_source_1.isWithin)(scope.remote.root, path)) {
-        throw new Error(`${include} in ${scope.fileName} points outside ${scope.remote.git}`);
+        throw new Error(`${localPath} in ${scope.fileName} points outside ${scope.remote.git}`);
+    }
+    const inputs = typeof include === 'string' ? undefined : passEnvs(include.with, scope);
+    return { fileName: await (0, default_build_file_1.getBuildFilename)(path, environment), remote: scope.remote, inputs };
+}
+// `${NAME}` (or `${NAME:-default}`) in a `with` value reads as it does in the including
+// file: the environment or a `.env` file first, then that file's own `envs` value. So one
+// file holds a value such as NODE_VERSION for all it includes, and CI can still set it. A
+// name the file does not declare is left to the included file, which reads it the same way.
+function passEnvs(inputs, scope) {
+    if (!inputs) {
+        return undefined;
+    }
+    const envs = scope.schema.envs ?? {};
+    const result = {};
+    for (const [key, value] of Object.entries(inputs)) {
+        result[key] =
+            typeof value === 'string'
+                ? value.replace(/\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g, (match, name, fallback) => name in envs ? passEnv(name, `${envs[name]}`, fallback) : match)
+                : value;
+    }
+    return result;
+}
+// The including file's value as an interpolation the included file resolves in the same
+// order. A value built from other variables is passed on as it is written.
+function passEnv(name, value, fallback) {
+    const reference = /^\$([A-Za-z_][A-Za-z0-9_]*)$/.exec(value);
+    if (reference) {
+        return fallback === undefined ? `\${${reference[1]}}` : `\${${reference[1]}:-${fallback}}`;
+    }
+    if (value.includes('$') || value.includes('}')) {
+        return value;
     }
-    return { fileName: await (0, default_build_file_1.getBuildFilename)(path, environment), remote: scope.remote };
+    return `\${${name}:-${value}}`;
 }
 // `includes pull` fetches each source once, however often the build files name it.
 async function resolveRemote(ctx, source, environment) {

package/dist/schema/work-scope-parser.js

@@ -47,19 +47,27 @@ function getWorkContext(context, scope, environment) {
     // its init task's need on it, which narrowing follows
     const tasks = Object.values(context.tasks).map((task) => (0, append_work_task_1.appendWorkTask)(workTree, task.cwd, task, environment, context));
     const services = Object.values(context.services).map((service) => (0, append_work_service_1.appendWorkService)(workTree, service, environment, context));
+    const apply = { servicesAlone: !(0, work_scope_1.isContextTaskFilter)(scope) && !!scope.names && !!scope.stop };
     const selectedTasks = [];
     const selectedServices = [];
     for (const item of tasks) {
         if (matchesTaskWorkScope(item, scope)) {
             requested.push(item.name);
             selectedTasks.push(item.data);
-            applyTask(filteredWorkTree, item);
+            applyTask(filteredWorkTree, item, apply);
         }
     }
     for (const item of services) {
         if (matchesServiceWorkScope(item.data, scope)) {
             selectedServices.push(item.data);
-            applyService(filteredWorkTree, item);
+            applyService(filteredWorkTree, item, apply);
+        }
+    }
+    if (!(0, work_scope_1.isContextTaskFilter)(scope) && scope.names) {
+        const known = new Set([...tasks.map((task) => task.name), ...services.map((service) => service.data.name)]);
+        const unknown = scope.names.filter((name) => !known.has(name));
+        if (unknown.length > 0) {
+            throw new Error(`no task or service named ${unknown.join(', ')}, see hammerkit ls`);
         }
     }
     if (scope.args) {
@@ -86,43 +94,58 @@ function keepRequirersInScope(workTree) {
         }
     }
 }
-function applyTask(workTree, item) {
+function applyTask(workTree, item, options) {
     if (workTree.tasks[item.name]) {
         return;
     }
     workTree.tasks[item.name] = item;
-    applyNeedsAndDeps(workTree, item);
+    applyNeedsAndDeps(workTree, item, options);
 }
-function applyService(workTree, need) {
+function applyService(workTree, need, options) {
     const item = (0, append_work_service_1.getPlannedService)(need);
     if (workTree.services[item.name]) {
         return;
     }
     workTree.services[item.name] = item;
-    applyNeedsAndDeps(workTree, item);
+    if (options.servicesAlone) {
+        return;
+    }
+    applyNeedsAndDeps(workTree, item, options);
     // a service in the run brings its init task, which runs once it is healthy
     if (item.data.type === 'container-service' && item.data.init) {
-        applyTask(workTree, item.data.init.task);
+        applyTask(workTree, item.data.init.task, options);
     }
 }
-function applyNeedsAndDeps(workTree, item) {
+function applyNeedsAndDeps(workTree, item, options) {
     for (const dep of item.deps) {
-        applyTask(workTree, dep);
+        applyTask(workTree, dep, options);
     }
     for (const need of item.needs) {
-        applyService(workTree, need.service);
+        applyService(workTree, need.service, options);
     }
 }
 function matchesTaskWorkScope(task, scope) {
     if ((0, work_scope_1.isContextTaskFilter)(scope)) {
         return task.name === scope.taskName;
     }
+    if (scope.serviceNames) {
+        return false;
+    }
+    if (scope.names) {
+        return scope.names.includes(task.name);
+    }
     return (0, label_values_1.appliesToLabels)(task.data.labels, scope);
 }
 function matchesServiceWorkScope(service, scope) {
     if ((0, work_scope_1.isContextTaskFilter)(scope)) {
         return false;
     }
+    if (scope.serviceNames) {
+        return scope.serviceNames.includes(service.name);
+    }
+    if (scope.names) {
+        return scope.names.includes(service.name);
+    }
     return (0, label_values_1.appliesToLabels)(service.labels, scope);
 }
 //# sourceMappingURL=work-scope-parser.js.map

package/dist/secrets/command-secret-provider.js

@@ -150,9 +150,11 @@ function candidates(command, path) {
             .map((dir) => (0, path_1.resolve)(dir, command));
     return bases.flatMap((base) => extensions.map((extension) => base + extension));
 }
+// bigint: a Windows file id has more digits than a number keeps, and two files whose ids
+// round to the same number would be the same file
 function statOf(path) {
     try {
-        const stat = (0, fs_1.statSync)(path);
+        const stat = (0, fs_1.statSync)(path, { bigint: true });
         return stat.isFile() ? stat : null;
     }
     catch {

package/dist/secrets/github-app-token-command.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerGithubAppTokenCommand = void 0;
+const commander_1 = require("commander");
 const log_1 = require("../log");
 const github_app_token_1 = require("./github-app-token");
 // `hammerkit github-app-token <owner/repo>`: a secret provider command for the token a
@@ -18,7 +19,8 @@ function registerGithubAppTokenCommand(program, environment) {
         }
         catch (e) {
             environment.stderr.write(`github-app-token: ${(0, log_1.getErrorMessage)(e)}\n`);
-            throw e;
+            // said already: the CLI does not print it again
+            throw new commander_1.CommanderError(1, 'hammerkit.githubAppToken', (0, log_1.getErrorMessage)(e));
         }
     });
 }

package/dist/secrets/secret-catalog.js

@@ -11,10 +11,12 @@ function emptySecretCatalog() {
 exports.emptySecretCatalog = emptySecretCatalog;
 const FULL_COMMIT = /^[0-9a-f]{40}$/i;
 // Providers and accounts are global names, like caches, collected from every
-// loaded build file. A name declared twice is an error rather than a silent
-// override: which definition runs with a service account's credential must not
-// depend on include order.
-function collectSecretCatalog(files, environment, context) {
+// loaded build file. A name declared twice is an error rather than a silent override:
+// which definition runs with a service account's credential must not depend on include
+// order. The host config then replaces what the build files declare, name by name (and
+// its default account replaces theirs): the machine that runs a task says how it reads
+// secrets, and a build file that still declares them loads as it is.
+function collectSecretCatalog(files, environment, context, host) {
     const catalog = emptySecretCatalog();
     for (const file of files) {
         const providers = Object.entries(file.schema.secretProviders ?? {});
@@ -28,25 +30,13 @@ function collectSecretCatalog(files, environment, context) {
             if (catalog.providers[name]) {
                 throw new Error(`secret provider ${name} is declared in ${catalog.providers[name].declaredIn} and in ${file.fileName}`);
             }
-            catalog.providers[name] = {
-                name,
-                type: 'command',
-                command: provider.command.map((part) => applyEnvs(part, envs)),
-                env: provider.env ?? {},
-                timeoutMs: (0, units_1.parseDuration)(provider.timeout ?? DEFAULT_TIMEOUT),
-                declaredIn: file.fileName,
-            };
+            catalog.providers[name] = toProvider(name, provider, envs, file.fileName);
         }
         for (const [name, account] of accounts) {
             if (catalog.accounts[name]) {
                 throw new Error(`secret account ${name} is declared in ${catalog.accounts[name].declaredIn} and in ${file.fileName}`);
             }
-            catalog.accounts[name] = {
-                name,
-                default: account.default ?? false,
-                providers: account.providers,
-                declaredIn: file.fileName,
-            };
+            catalog.accounts[name] = toAccount(name, account, file.fileName);
         }
     }
     const defaults = Object.values(catalog.accounts).filter((account) => account.default);
@@ -55,14 +45,48 @@ function collectSecretCatalog(files, environment, context) {
     }
     for (const account of Object.values(catalog.accounts)) {
         for (const provider of Object.keys(account.providers)) {
-            if (!catalog.providers[provider]) {
+            if (!catalog.providers[provider] && !host?.secretProviders?.[provider]) {
                 throw new Error(`secret account ${account.name} (${account.declaredIn}) names provider ${provider}, which is not declared`);
             }
         }
     }
+    if (host) {
+        // the host config has no envs of its own: `${NAME}` is read from the process
+        for (const [name, provider] of Object.entries(host.secretProviders ?? {})) {
+            catalog.providers[name] = toProvider(name, provider, {}, host.fileName);
+        }
+        const accounts = Object.entries(host.secretAccounts ?? {});
+        const hostDefaults = accounts.filter(([, account]) => account.default);
+        if (hostDefaults.length > 1) {
+            throw new Error(`more than one default secret account: ${hostDefaults.map(([name]) => name).join(', ')} (${host.fileName})`);
+        }
+        if (hostDefaults.length > 0) {
+            for (const account of Object.values(catalog.accounts)) {
+                account.default = false;
+            }
+        }
+        // a provider an account of the host names is only checked when a secret uses it:
+        // a project that doesn't declare it, and reads no secret, loads anyway
+        for (const [name, account] of accounts) {
+            catalog.accounts[name] = toAccount(name, account, host.fileName);
+        }
+    }
     return catalog;
 }
 exports.collectSecretCatalog = collectSecretCatalog;
+function toProvider(name, provider, envs, declaredIn) {
+    return {
+        name,
+        type: 'command',
+        command: provider.command.map((part) => applyEnvs(part, envs)),
+        env: provider.env ?? {},
+        timeoutMs: (0, units_1.parseDuration)(provider.timeout ?? DEFAULT_TIMEOUT),
+        declaredIn,
+    };
+}
+function toAccount(name, account, declaredIn) {
+    return { name, default: account.default ?? false, providers: account.providers, declaredIn };
+}
 // A tag or branch can be moved, and a moved file runs with the credentials of a
 // service account: providers and accounts from a git include are pinned.
 function requirePinnedSource(file) {

package/dist/server/accounts-api.js

@@ -6,7 +6,7 @@ const policy_1 = require("./policy");
 /**
  * Who the caller is and what they may do:
  *
- *   GET /v1/me         identity, accounts with their level, repositories, the builds level and the sandbox grants
+ *   GET /v1/me         identity, accounts with their level, repositories, the builds level the sandbox and endpoint grants
  *   GET /v1/accounts   the accounts the caller has a level on, with what the operator says about them
  */
 async function handleAccounts(config, log, principal, req, res, url) {
@@ -31,7 +31,10 @@ async function handleAccounts(config, log, principal, req, res, url) {
             accounts,
             repos: grant.repos,
             builds: grant.builds,
+            checks: grant.checks || grant.builds !== null ? 'read' : null,
             sandboxes: grant.sandboxes,
+            endpoints: grant.endpoints,
+            observe: grant.observe,
         });
         return true;
     }

package/dist/server/approvals-api.js

@@ -13,7 +13,7 @@ function toApprovalView(run) {
     return {
         id: run.id,
         state: run.state,
-        requestedBy: run.owner,
+        requestedBy: { iss: run.owner.iss, sub: run.owner.sub },
         createdAt: run.createdAt,
         definition: run.definition,
         tasks: run.tasks,

package/dist/server/capacity-format.js

@@ -0,0 +1,36 @@
+"use strict";
+// How CPU and memory read, for the dashboard and the CLI (without the clients of capacity.ts).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatMemory = exports.plural = exports.formatCpu = void 0;
+// cores as a person reads them: 0.25, 1.5, 12
+function formatCpu(cores) {
+    if (cores === undefined) {
+        return '?';
+    }
+    if (cores === 0) {
+        return '0';
+    }
+    return cores < 10 ? String(Math.round(cores * 100) / 100) : String(Math.round(cores * 10) / 10);
+}
+exports.formatCpu = formatCpu;
+// a count and what it counts: 1 pod, 2 pods
+function plural(count, one, more = `${one}s`) {
+    return `${count} ${count === 1 ? one : more}`;
+}
+exports.plural = plural;
+// bytes as a person reads them: 512 MiB, 3.4 GiB
+function formatMemory(bytes) {
+    if (bytes === undefined) {
+        return '?';
+    }
+    const units = ['B', 'KiB', 'MiB', 'GiB', 'TiB'];
+    let value = bytes;
+    let unit = 0;
+    while (value >= 1024 && unit < units.length - 1) {
+        value /= 1024;
+        unit++;
+    }
+    return `${value < 10 && unit > 0 ? Math.round(value * 10) / 10 : Math.round(value)} ${units[unit]}`;
+}
+exports.formatMemory = formatMemory;
+//# sourceMappingURL=capacity-format.js.map