hammerkit 1.9.1 → 1.10.0

package/dist/cache/backends/registry/registry-client.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.digestBuffer = exports.digestFile = exports.RegistryClient = exports.parseChallenge = exports.RegistryError = exports.OCI_LAYER_TAR = exports.OCI_CONFIG = exports.OCI_MANIFEST = void 0;
+exports.digestBuffer = exports.digestFile = exports.RegistryClient = exports.getTokenScope = exports.parseChallenge = exports.RegistryError = exports.OCI_LAYER_TAR = exports.OCI_CONFIG = exports.OCI_MANIFEST = void 0;
 const crypto_1 = require("crypto");
 const fs_1 = require("fs");
 const promises_1 = require("fs/promises");
@@ -32,6 +32,23 @@ function parseChallenge(header) {
     return { scheme, params };
 }
 exports.parseChallenge = parseChallenge;
+// Always ask for pull and push, so one token serves the whole backend, plus
+// what the challenge names for this repository: a DELETE is challenged for
+// `delete`, which a pull/push token lacks. A registry grants the subset the
+// credentials allow.
+function getTokenScope(repository, challengeScope) {
+    const actions = ['pull', 'push'];
+    const prefix = `repository:${repository}:`;
+    if (challengeScope?.startsWith(prefix)) {
+        for (const action of challengeScope.substring(prefix.length).split(',')) {
+            if (action && !actions.includes(action)) {
+                actions.push(action);
+            }
+        }
+    }
+    return `${prefix}${actions.join(',')}`;
+}
+exports.getTokenScope = getTokenScope;
 function basicHeader(credentials) {
     return `Basic ${Buffer.from(`${credentials.username}:${credentials.password}`).toString('base64')}`;
 }
@@ -76,9 +93,7 @@ class RegistryClient {
         if (challenge.params.service) {
             tokenUrl.searchParams.set('service', challenge.params.service);
         }
-        // always ask for push too: one token then serves the whole backend; a
-        // registry grants the subset the credentials allow
-        tokenUrl.searchParams.set('scope', `repository:${this.reference.repository}:pull,push`);
+        tokenUrl.searchParams.set('scope', getTokenScope(this.reference.repository, challenge.params.scope ?? null));
         const response = await fetch(tokenUrl, {
             headers: credentials ? { authorization: basicHeader(credentials) } : {},
         });

package/dist/docker/pull.js

@@ -1,20 +1,89 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.pull = void 0;
-async function pull(status, docker, imageName) {
-    let searchImageName = imageName;
-    if (imageName.indexOf(':') === -1) {
-        searchImageName += ':latest';
-    }
+exports.normalizeArchitecture = exports.splitImageName = exports.isImagePresent = exports.pull = void 0;
+const registry_credentials_1 = require("../cache/backends/registry/registry-credentials");
+const registry_reference_1 = require("../cache/backends/registry/registry-reference");
+async function pull(status, docker, imageName, environment) {
     const images = await docker.listImages({});
-    if (images.some((i) => i.RepoTags?.some((repoTag) => repoTag === searchImageName))) {
+    if (isImagePresent(images, imageName)) {
+        await warnOnForeignPlatform(status, docker, imageName);
         return;
     }
     status.write('debug', `pull image ${imageName}`);
-    const image = await docker.pull(imageName);
+    const authconfig = await getPullAuth(imageName, environment);
+    const image = await docker.pull(imageName, authconfig ? { authconfig } : {});
     await new Promise((resolve, reject) => {
         docker.modem.followProgress(image, (err, res) => (err ? reject(err) : resolve(res)));
     });
 }
 exports.pull = pull;
+// A tag is present when an image carries it; an image pinned by digest
+// (`repo:tag@sha256:…`) when an image was pulled with that digest, whatever
+// tag it has now.
+function isImagePresent(images, imageName) {
+    const { repository, tag, digest } = splitImageName(imageName);
+    if (digest) {
+        return images.some((i) => i.RepoDigests?.some((repoDigest) => repoDigest === `${repository}@${digest}`));
+    }
+    return images.some((i) => i.RepoTags?.some((repoTag) => repoTag === `${repository}:${tag ?? 'latest'}`));
+}
+exports.isImagePresent = isImagePresent;
+function splitImageName(imageName) {
+    const [name, digest] = imageName.split('@');
+    const lastSlash = name.lastIndexOf('/');
+    const tagSeparator = name.indexOf(':', lastSlash + 1);
+    if (tagSeparator === -1) {
+        return { repository: name, tag: null, digest: digest ?? null };
+    }
+    return { repository: name.substring(0, tagSeparator), tag: name.substring(tagSeparator + 1), digest: digest ?? null };
+}
+exports.splitImageName = splitImageName;
+// The credentials `docker login` stored for the image's registry, like the
+// docker CLI uses them; dockerode sends none on its own, so a private image
+// could only be used when it was already present.
+async function getPullAuth(imageName, environment) {
+    const { repository } = splitImageName(imageName);
+    const { credentialHost } = (0, registry_reference_1.parseRegistryReference)(repository);
+    const credentials = await (0, registry_credentials_1.resolveRegistryCredentials)(credentialHost, environment);
+    if (!credentials) {
+        return null;
+    }
+    return { ...credentials, serveraddress: credentialHost };
+}
+const daemonArchitectures = new WeakMap();
+const warnedImages = new Set();
+// A digest pins a multi-arch index; a copy pulled earlier for another
+// architecture (an amd64 one from a Compose file with `platform:`) carries the
+// same digest, so docker uses it and the image runs emulated instead of native.
+async function warnOnForeignPlatform(status, docker, imageName) {
+    const { repository, digest } = splitImageName(imageName);
+    if (!digest || warnedImages.has(imageName)) {
+        return;
+    }
+    try {
+        if (!daemonArchitectures.has(docker)) {
+            daemonArchitectures.set(docker, docker.info().then((info) => normalizeArchitecture(info.Architecture ?? '')));
+        }
+        const [image, daemonArchitecture] = await Promise.all([
+            docker.getImage(imageName).inspect(),
+            daemonArchitectures.get(docker),
+        ]);
+        const imageArchitecture = normalizeArchitecture(image.Architecture ?? '');
+        if (!imageArchitecture || !daemonArchitecture || imageArchitecture === daemonArchitecture) {
+            return;
+        }
+        warnedImages.add(imageName);
+        status.write('warn', `image ${imageName} is present for ${imageArchitecture} on this ${daemonArchitecture} docker host and runs ` +
+            `emulated; if the digest is a multi-arch index, remove the copy to pull the native one: ` +
+            `docker image rm ${repository}@${digest}`);
+    }
+    catch {
+        // only a hint: never fail a pull over it
+    }
+}
+function normalizeArchitecture(architecture) {
+    const aliases = { x86_64: 'amd64', aarch64: 'arm64' };
+    return aliases[architecture] ?? architecture;
+}
+exports.normalizeArchitecture = normalizeArchitecture;
 //# sourceMappingURL=pull.js.map

package/dist/environment/replace-env-variables.js

@@ -1,36 +1,45 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getEnvironmentVariables = exports.buildEnvironmentVariables = void 0;
+// `${NAME}` or `${NAME:-default}` anywhere in a value
+const INTERPOLATION = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g;
+// The shell / process environment first, then the .env files. A variable set to
+// an empty string is set, as in a shell: CI providers leave many empty (a merge
+// request id on a branch pipeline).
+function resolveReference(name, environment, context) {
+    const processValue = environment.processEnvs[name];
+    if (processValue !== undefined && processValue !== null) {
+        return processValue;
+    }
+    for (const envFile of Object.values(context.envFiles)) {
+        const fileValue = envFile[name];
+        if (fileValue !== undefined && fileValue !== null) {
+            return fileValue;
+        }
+    }
+    return null;
+}
 function buildEnvironmentVariables(envs, environment, context) {
     const replacements = [];
     const variables = {};
     for (const [key, value] of Object.entries(envs)) {
-        if (value.startsWith('$')) {
+        if (value.startsWith('$') && !value.startsWith('${')) {
             const name = value.substring(1);
-            let nameValue = environment.processEnvs[name] ?? null;
-            if (!nameValue) {
-                for (const envFile of Object.values(context.envFiles)) {
-                    nameValue = envFile[name] ?? null;
-                    if (nameValue) {
-                        break;
-                    }
-                }
+            const nameValue = resolveReference(name, environment, context);
+            if (nameValue !== null) {
+                replacements.push({ key, name, available: true, value: nameValue });
             }
-            if (nameValue) {
-                replacements.push({
-                    key,
-                    name,
-                    available: true,
-                    value: nameValue,
-                });
+            else {
+                replacements.push({ key, name, available: false, value: null });
+            }
+        }
+        else if (value.includes('${')) {
+            const interpolated = interpolate(value, envs, environment, context);
+            if (interpolated.missing) {
+                replacements.push({ key, name: interpolated.missing, available: false, value: null });
             }
             else {
-                replacements.push({
-                    key,
-                    name,
-                    available: false,
-                    value: null,
-                });
+                variables[key] = interpolated.value;
             }
         }
         else {
@@ -40,6 +49,28 @@ function buildEnvironmentVariables(envs, environment, context) {
     return { variables, replacements };
 }
 exports.buildEnvironmentVariables = buildEnvironmentVariables;
+// Each `${NAME}` comes from the process environment or a .env file, else from a
+// literal value of the same build file / task `envs`, else from its
+// `:-default`. A reference without any of them is missing.
+function interpolate(value, envs, environment, context) {
+    let missing = null;
+    const result = value.replace(INTERPOLATION, (match, name, fallback) => {
+        const resolved = resolveReference(name, environment, context) ?? getLiteral(envs, name) ?? fallback ?? null;
+        if (resolved === null) {
+            missing = missing ?? name;
+            return match;
+        }
+        return resolved;
+    });
+    return { value: result, missing };
+}
+function getLiteral(envs, name) {
+    const literal = envs[name];
+    if (literal === undefined || literal.includes('$')) {
+        return null;
+    }
+    return literal;
+}
 function getEnvironmentVariables(envs) {
     const result = { ...envs.variables };
     for (const replacement of envs.replacements) {

package/dist/executer/docker-service.js

@@ -23,7 +23,7 @@ async function dockerService(docker, item, options, environment) {
     try {
         await (0, execution_steps_1.prepareMounts)(item, environment);
         (0, abort_1.checkForAbort)(options.abort);
-        await (0, execution_steps_1.pullImage)(item, docker);
+        await (0, execution_steps_1.pullImage)(item, docker, environment);
         (0, abort_1.checkForAbort)(options.abort);
         await (0, execution_steps_1.prepareVolume)(item, docker);
         (0, abort_1.checkForAbort)(options.abort);

package/dist/executer/docker-task.js

@@ -79,7 +79,7 @@ async function dockerTask(docker, item, environment, options) {
         }
         await (0, execution_steps_1.prepareMounts)(item, environment);
         (0, abort_1.checkForAbort)(options.abort);
-        await (0, execution_steps_1.pullImage)(item, docker);
+        await (0, execution_steps_1.pullImage)(item, docker, environment);
         (0, abort_1.checkForAbort)(options.abort);
         await (0, execution_steps_1.prepareVolume)(item, docker);
         (0, abort_1.checkForAbort)(options.abort);

package/dist/executer/execution-steps.js

@@ -8,8 +8,8 @@ const set_user_permission_1 = require("./set-user-permission");
 const work_task_1 = require("../planner/work-task");
 const work_service_1 = require("../planner/work-service");
 const get_container_binds_1 = require("./get-container-binds");
-async function pullImage(item, docker) {
-    await (0, pull_1.pull)(item.status, docker, item.data.image);
+async function pullImage(item, docker, environment) {
+    await (0, pull_1.pull)(item.status, docker, item.data.image, environment);
 }
 exports.pullImage = pullImage;
 async function prepareVolume(item, docker) {

package/dist/planner/utils/template-value.js

@@ -7,7 +7,7 @@ function templateValue(value, envs) {
     }
     let result = value;
     for (const [key, envValue] of Object.entries(envs.variables)) {
-        result = result.replace(new RegExp(`\\$${key}`, 'gi'), envValue);
+        result = result.replace(new RegExp(`\\$\\{${key}\\}|\\$${key}`, 'gi'), envValue);
     }
     return result;
 }

package/dist/schema/work-scope-parser.js

@@ -50,9 +50,22 @@ function getWorkContext(context, scope, environment) {
             applyService(filteredWorkTree, item);
         }
     }
+    keepRequirersInScope(filteredWorkTree);
     return filteredWorkTree;
 }
 exports.getWorkContext = getWorkContext;
+// The whole build file is planned first, so a shared service lists every task
+// and service that needs it. Those outside this run never start or end, and a
+// service waiting for them to finish would keep the run open forever.
+function keepRequirersInScope(workTree) {
+    const inScope = new Set([
+        ...Object.values(workTree.tasks),
+        ...Object.values(workTree.services),
+    ]);
+    for (const service of Object.values(workTree.services)) {
+        service.requiredBy = service.requiredBy.filter((required) => inScope.has(required));
+    }
+}
 function applyTask(workTree, item) {
     if (workTree.tasks[item.name]) {
         return;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hammerkit",
   "description": "Containerized build tool with incremental caching that runs the same build file locally, in Docker and on Kubernetes.",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "keywords": [
     "build",
     "build-tool",