hammerkit 1.9.2 → 1.11.0

package/dist/executer/execute-init-task.js

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.findInitOf = exports.executeInitTask = exports.isTerminalTask = void 0;
+const state_resolver_1 = require("./state-resolver");
+const execute_work_task_1 = require("./execute-work-task");
+const abort_1 = require("./abort");
+const abort_event_1 = require("../utils/abort-event");
+const isTerminalService = (state) => state.type === 'end' || state.type === 'error' || state.type === 'canceled';
+const isTerminalTask = (state) => state.type === 'completed' || state.type === 'error' || state.type === 'crash' || state.type === 'canceled';
+exports.isTerminalTask = isTerminalTask;
+// The init task of a service runs each time the service passed its healthcheck
+// in this run, never on its own: a service left running by an earlier `up` ran
+// its init when it started, so the init is skipped unless it was asked for by
+// name. A failing init fails the run like any failing task.
+async function executeInitTask(work, init, service, requested, environment, options) {
+    if (!service || service.state.current.type === 'running') {
+        if (service && requested) {
+            await (0, execute_work_task_1.executeWorkTask)(work, environment, options);
+            return;
+        }
+        skip(work, `${work.name} skipped, the service it initializes does not start in this run`);
+        return;
+    }
+    if (requested) {
+        // asked for by name, the init is what the service starts for
+        work.state.set({ type: 'ready', stateKey: '', started: new Date() });
+    }
+    try {
+        do {
+            const view = await (0, state_resolver_1.isState)('await-init-' + work.name, init.state, (state) => state.type === 'running' || isTerminalService(state), environment.abortCtrl.signal);
+            if (view.type !== 'running') {
+                if (!(0, exports.isTerminalTask)(work.state.current)) {
+                    skip(work, `${work.name} skipped, ${service.name} did not start`);
+                }
+                return;
+            }
+            await runOnce(work, environment, options);
+            settleService(service, work, view);
+            if (!options.watch) {
+                return;
+            }
+            await (0, state_resolver_1.awaitState)('await-init-restart-' + work.name, init.state, (state) => state.type !== 'running', environment.abortCtrl.signal);
+        } while (!environment.abortCtrl.signal.aborted);
+    }
+    catch (e) {
+        if (!(e instanceof abort_1.AbortError)) {
+            throw e;
+        }
+        if (!(0, exports.isTerminalTask)(work.state.current)) {
+            work.state.set({ type: 'canceled', stateKey: null });
+        }
+    }
+}
+exports.executeInitTask = executeInitTask;
+// Only now does the service run for everything else needing it.
+function settleService(service, work, view) {
+    const result = work.state.current;
+    if (result.type === 'completed') {
+        service.state.set(view);
+        return;
+    }
+    service.state.set({
+        type: 'error',
+        stateKey: null,
+        errorMessage: `init ${work.name} did not succeed (${result.type})`,
+    });
+}
+// One run of the init as a plain task. It aborts its own run when it fails;
+// the whole run stops only outside watch mode, as for a failing service.
+async function runOnce(work, environment, options) {
+    const abortCtrl = new AbortController();
+    const abortListener = (0, abort_event_1.listenOnAbort)(environment.abortCtrl.signal, () => abortCtrl.abort());
+    try {
+        await (0, execute_work_task_1.executeWorkTask)(work, { ...environment, abortCtrl }, { ...options, watch: false });
+    }
+    finally {
+        abortListener.close();
+    }
+    const result = work.state.current.type;
+    if ((result === 'error' || result === 'crash') && !options.watch) {
+        environment.abortCtrl.abort();
+    }
+}
+function skip(work, message) {
+    work.status.write('debug', message);
+    work.state.set({ type: 'completed', cached: false, skipped: true, duration: 0, stateKey: '' });
+}
+// The service a task is the init of: the task needs it through the view the
+// planner gave it, which shares the service's data.
+function findInitOf(task) {
+    for (const need of task.needs) {
+        const data = need.service.data;
+        if (data.type === 'container-service' && data.init && data.init.task === task) {
+            return { serviceName: need.service.name, init: data.init };
+        }
+    }
+    return null;
+}
+exports.findInitOf = findInitOf;
+//# sourceMappingURL=execute-init-task.js.map

package/dist/executer/execute-work-service.js

@@ -1,10 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.executeWorkService = exports.stopService = void 0;
+const work_item_1 = require("../planner/work-item");
 const await_completed_dependencies_1 = require("./await-completed-dependencies");
 const abort_1 = require("./abort");
 const log_1 = require("../log");
 const watch_loop_1 = require("./watch-loop");
+const state_1 = require("./state");
 async function stopService(work) {
     if (work.state.current.type === 'running') {
         await work.runtime.stop();
@@ -47,12 +49,16 @@ async function executeWorkService(work, environment, options) {
                     // aborted: the service is stopping anyway
                 });
             }
+            const init = getServiceInit(work);
             await work.runtime.execute(environment, {
                 cache: cacheState,
                 abort,
-                state: work.state,
+                state: init ? gateOnInit(work, init) : work.state,
                 stateKey: cacheState.stateKey,
                 daemon: options.daemon,
+                publishPorts: options.type === 'up' || work.requiredBy.some(isLocalTaskItem) || (!!init && isLocalTaskItem(init.task)),
+                // an init needs a healthy service, so a service with one is always awaited
+                waitForReady: options.wait === 'ready' || work.requiredBy.length > 0 || !!init,
             });
         });
     }
@@ -78,4 +84,27 @@ async function executeWorkService(work, environment, options) {
     }
 }
 exports.executeWorkService = executeWorkService;
+function getServiceInit(work) {
+    return work.data.type === 'container-service' ? work.data.init : null;
+}
+// With an init, the runtime's `running` (healthcheck passed) first reaches only
+// the init task's view of the service; executeInitTask runs the init and then
+// sets the service running, or failed.
+function gateOnInit(work, init) {
+    const gate = new state_1.State(work.state.current);
+    gate.on('init-gate', (state) => {
+        if (state.type !== 'running') {
+            if (work.state.current.type !== 'error') {
+                work.state.set(state);
+            }
+            return;
+        }
+        work.status.write('info', `${work.name} is healthy, run its init ${init.task.name}`);
+        init.state.set(state);
+    });
+    return gate;
+}
+function isLocalTaskItem(item) {
+    return (0, work_item_1.isWorkTaskItem)(item) && (0, work_item_1.isLocalWorkTaskItem)(item);
+}
 //# sourceMappingURL=execute-work-service.js.map

package/dist/executer/execute-work-task.js

@@ -6,10 +6,10 @@ const abort_1 = require("./abort");
 const log_1 = require("../log");
 const await_completed_dependencies_1 = require("./await-completed-dependencies");
 const watch_loop_1 = require("./watch-loop");
+const deadline_1 = require("./deadline");
 const explain_1 = require("../cache/explain");
 const archive_task_entry_1 = require("./archive-task-entry");
 const units_1 = require("../utils/units");
-const abort_event_1 = require("../utils/abort-event");
 async function pushToBackend(work, environment, cacheState, options) {
     const { resolved, stateKey, provable } = cacheState;
     if (resolved.method === 'none' || !provable) {
@@ -28,29 +28,6 @@ async function pushToBackend(work, environment, cacheState, options) {
         work.status.write('warn', `${work.name} failed to push to cache "${resolved.name}": ${(0, log_1.getErrorMessage)(e)}`);
     }
 }
-// An abort signal that follows `parent` and additionally fires after `timeout`
-// ms, so a task deadline reuses the runtimes' existing abort/cleanup path.
-function withDeadline(parent, timeout) {
-    const controller = new AbortController();
-    let expired = false;
-    const parentListener = (0, abort_event_1.listenOnAbort)(parent, () => controller.abort());
-    const timer = timeout === null
-        ? null
-        : setTimeout(() => {
-            expired = true;
-            controller.abort();
-        }, timeout);
-    return {
-        signal: controller.signal,
-        expired: () => expired,
-        clear() {
-            if (timer) {
-                clearTimeout(timer);
-            }
-            parentListener.close();
-        },
-    };
-}
 // A task without cmds only groups its dependencies (`ci: { deps: [test, build] }`).
 // Having no src of its own it is never a cache hit, so its dependencies are
 // always checked and their outputs restored. When every one of them was a hit,
@@ -118,7 +95,7 @@ dependents = null) {
                     started,
                 });
                 const timeout = work.data.timeout ?? options.timeout;
-                const deadline = withDeadline(abort, timeout);
+                const deadline = (0, deadline_1.withDeadline)(abort, timeout);
                 try {
                     await work.runtime.execute(environment, {
                         cache: cacheState,
@@ -126,6 +103,8 @@ dependents = null) {
                         stateKey: cacheState.stateKey,
                         state: work.state,
                         daemon: options.daemon,
+                        publishPorts: false,
+                        waitForReady: true,
                     });
                 }
                 finally {

package/dist/executer/execute-work-tree.js

@@ -4,13 +4,24 @@ exports.executeWorkTree = void 0;
 const plan_work_tasks_1 = require("../planner/utils/plan-work-tasks");
 const execute_work_service_1 = require("./execute-work-service");
 const execute_work_task_1 = require("./execute-work-task");
+const execute_init_task_1 = require("./execute-init-task");
 async function executeWorkTree(work, environment, options) {
     const itemPromises = [];
     const dependents = skippableDependents(work, options);
+    mirrorServicesToInitViews(work);
     for (const task of (0, plan_work_tasks_1.iterateWorkTasks)(work)) {
-        if (task.state.current.type === 'pending') {
-            itemPromises.push((0, execute_work_task_1.executeWorkTask)(task, environment, options, dependents.get(task.name) ?? null));
+        if (task.state.current.type !== 'pending') {
+            continue;
         }
+        const initOf = (0, execute_init_task_1.findInitOf)(task);
+        if (initOf) {
+            const service = work.services[initOf.serviceName] ?? null;
+            // asked for alone (by name), it runs against a service already running too
+            const requested = work.requested?.length === 1 && work.requested[0] === task.name;
+            itemPromises.push((0, execute_init_task_1.executeInitTask)(task, initOf.init, service, requested, environment, options));
+            continue;
+        }
+        itemPromises.push((0, execute_work_task_1.executeWorkTask)(task, environment, options, dependents.get(task.name) ?? null));
     }
     for (const service of (0, plan_work_tasks_1.iterateWorkServices)(work)) {
         if (options.type === 'down') {
@@ -25,6 +36,21 @@ async function executeWorkTree(work, environment, options) {
     await Promise.all(itemPromises);
 }
 exports.executeWorkTree = executeWorkTree;
+// An init task sees its service through a view that follows the service, so a
+// service left running by an earlier `up` is running for its init task too. The
+// view runs early only while the init itself runs, see executeWorkService.
+function mirrorServicesToInitViews(work) {
+    for (const service of (0, plan_work_tasks_1.iterateWorkServices)(work)) {
+        if (service.data.type !== 'container-service' || !service.data.init) {
+            continue;
+        }
+        const view = service.data.init.state;
+        view.set(service.state.current);
+        service.state.on('init-view', (state) => {
+            view.set(state);
+        });
+    }
+}
 // For every task that may be skipped when nothing needs it, the tasks in this
 // run that depend on it. Requested tasks always run; so does anything a service
 // depends on, and everything in watch mode or with skipping turned off.

package/dist/executer/get-container-binds.js

@@ -9,16 +9,20 @@ function isInside(path, parent) {
 function getContainerBinds(item) {
     const sources = item.data.src.map((s) => s.absolutePath);
     const items = [
-        ...item.data.mounts,
+        ...item.data.mounts.map((m) => ({ localPath: m.localPath, containerPath: m.containerPath, readOnly: m.readOnly })),
         // A source inside another source (a dependency's `app/app.csproj` under the
         // task's own `app`) is already visible through the outer bind. Binding it
         // again would nest bind mounts, which Docker Desktop then refuses to let the
         // host delete while the container exists.
         ...sources
             .filter((path) => !sources.some((other) => isInside(path, other)))
-            .map((path) => ({ localPath: path, containerPath: path })),
-        ...item.data.generates.filter((g) => !g.isFile).map((v) => ({ localPath: v.volumeName, containerPath: v.path })),
-        ...item.data.generates.filter((g) => g.isFile).map((v) => ({ localPath: v.path, containerPath: v.path })),
+            .map((path) => ({ localPath: path, containerPath: path, readOnly: false })),
+        ...item.data.generates
+            .filter((g) => !g.isFile)
+            .map((v) => ({ localPath: v.volumeName, containerPath: v.path, readOnly: false })),
+        ...item.data.generates
+            .filter((g) => g.isFile)
+            .map((v) => ({ localPath: v.path, containerPath: v.path, readOnly: false })),
     ];
     return items.reduce((array, item) => {
         if (array.findIndex((i) => i.containerPath === item.containerPath) === -1) {

package/dist/executer/local-task.js

@@ -6,10 +6,15 @@ const execute_command_1 = require("./execute-command");
 const log_1 = require("../log");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
 const get_service_env_hints_1 = require("./get-service-env-hints");
+const container_secrets_1 = require("./container-secrets");
 async function localTask(item, environment, options) {
     item.status.write('info', `execute ${item.name} locally`);
-    const envs = { ...(0, replace_env_variables_1.getEnvironmentVariables)(item.data.envs), ...(0, get_service_env_hints_1.getServiceEnvHints)(item.needs) };
     try {
+        const envs = {
+            ...(0, replace_env_variables_1.getEnvironmentVariables)(item.data.envs),
+            ...(0, get_service_env_hints_1.getServiceEnvHints)(item.needs),
+            ...(await (0, container_secrets_1.resolveSecretEnvs)(item.data.secrets, environment)),
+        };
         for (const cmd of item.data.cmds) {
             (0, abort_1.checkForAbort)(options.abort);
             item.status.write('info', `execute cmd "${cmd.cmd}" locally`);

package/dist/kubernetes/ensure-kubernetes-deployment-exists.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ensureKubernetesDeploymentExists = void 0;
 const work_item_1 = require("../planner/work-item");
 const work_service_1 = require("../planner/work-service");
+const service_hostname_1 = require("../planner/utils/service-hostname");
 const apply_1 = require("./apply");
 const get_service_ip_1 = require("./get-service-ip");
 const version_1 = require("../version");
@@ -10,7 +11,7 @@ const replace_env_variables_1 = require("../environment/replace-env-variables");
 const await_running_state_1 = require("./await-running-state");
 const resources_1 = require("./resources");
 const work_healthcheck_1 = require("../planner/work-healthcheck");
-async function ensureKubernetesDeploymentExists(instance, env, service, persistence, stateKey) {
+async function ensureKubernetesDeploymentExists(instance, env, service, persistence, secrets, stateKey) {
     const hostAliases = [];
     for (const need of service.needs) {
         if (!(0, work_item_1.isContainerWorkServiceItem)(need.service)) {
@@ -67,23 +68,28 @@ async function ensureKubernetesDeploymentExists(instance, env, service, persiste
                     },
                 },
                 spec: {
+                    // the pod resolves its own service name, as with Docker's Hostname
+                    hostname: (0, service_hostname_1.getServiceHostname)(service.name),
                     hostAliases: hostAliases,
                     containers: [
                         {
                             name: service.name.replace(/:/, '-'),
                             image: service.data.image,
                             workingDir: (0, work_service_1.getServiceWorkingDir)(service.data),
-                            env: Object.entries(envs).map(([key, value]) => ({
-                                name: key,
-                                value: value,
-                            })),
+                            env: [
+                                ...Object.entries(envs).map(([key, value]) => ({
+                                    name: key,
+                                    value: value,
+                                })),
+                                ...secrets.env,
+                            ],
                             ...getKubernetesCommand(serviceCommand),
                             ports: service.data.ports.map((p) => ({
                                 containerPort: p.containerPort,
                             })),
                             readinessProbe: probe,
                             livenessProbe: probe,
-                            volumeMounts: persistence.mounts.map((m) => m.mount),
+                            volumeMounts: [...persistence.mounts.map((m) => m.mount), ...secrets.mounts],
                         },
                         {
                             name: 'debug',
@@ -93,7 +99,7 @@ async function ensureKubernetesDeploymentExists(instance, env, service, persiste
                             volumeMounts: persistence.mounts.map((m) => m.mount),
                         },
                     ],
-                    volumes: persistence.volumes,
+                    volumes: [...persistence.volumes, ...secrets.volumes],
                 },
             },
         },

package/dist/kubernetes/secrets.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.removeKubernetesSecret = exports.ensureKubernetesSecret = exports.getKubernetesSecretRefs = exports.getSecretResourceName = void 0;
+const work_secret_1 = require("../planner/work-secret");
+const apply_1 = require("./apply");
+const resources_1 = require("./resources");
+const version_1 = require("../version");
+const SECRET_VOLUME_NAME = 'hammerkit-secrets';
+function getSecretResourceName(item) {
+    return (0, resources_1.getResourceName)(item, '-secrets');
+}
+exports.getSecretResourceName = getSecretResourceName;
+// The values go into a Secret of the item; the pod only references it, so no
+// value is part of a Job or Deployment spec.
+function getKubernetesSecretRefs(item, secrets) {
+    if (secrets.length === 0) {
+        return { env: [], mounts: [], volumes: [] };
+    }
+    const secretName = getSecretResourceName(item);
+    const refs = {
+        env: [],
+        mounts: [],
+        volumes: [{ name: SECRET_VOLUME_NAME, secret: { secretName } }],
+    };
+    secrets.forEach((secret, index) => {
+        const key = getSecretKey(index);
+        if (secret.target.type === 'env') {
+            refs.env.push({ name: secret.target.name, valueFrom: { secretKeyRef: { name: secretName, key } } });
+            return;
+        }
+        refs.mounts.push({ name: SECRET_VOLUME_NAME, mountPath: secret.target.path, subPath: key, readOnly: true });
+    });
+    if (refs.mounts.length === 0) {
+        refs.volumes = [];
+    }
+    return refs;
+}
+exports.getKubernetesSecretRefs = getKubernetesSecretRefs;
+async function ensureKubernetesSecret(instance, kubernetes, item, secrets, environment) {
+    if (secrets.length === 0) {
+        return;
+    }
+    const stringData = {};
+    for (const [index, secret] of secrets.entries()) {
+        stringData[getSecretKey(index)] = await (0, work_secret_1.resolveSecretValue)(secret, environment);
+    }
+    const spec = {
+        kind: 'Secret',
+        apiVersion: 'v1',
+        metadata: {
+            namespace: kubernetes.namespace,
+            name: getSecretResourceName(item),
+            annotations: {
+                'hammerkit.dev/version': (0, version_1.getVersion)(),
+            },
+            labels: {
+                'hammerkit.dev/id': item.id(),
+            },
+        },
+        type: 'Opaque',
+        stringData,
+    };
+    await (0, apply_1.apply)(instance, spec);
+}
+exports.ensureKubernetesSecret = ensureKubernetesSecret;
+async function removeKubernetesSecret(instance, kubernetes, item) {
+    try {
+        await instance.coreApi.deleteNamespacedSecret({
+            name: getSecretResourceName(item),
+            namespace: kubernetes.namespace,
+        });
+    }
+    catch (e) {
+        if ((0, apply_1.statusCodeOf)(e) !== 404) {
+            throw e;
+        }
+    }
+}
+exports.removeKubernetesSecret = removeKubernetesSecret;
+function getSecretKey(index) {
+    return `secret-${index}`;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/kubernetes/volumes.js

@@ -24,7 +24,7 @@ async function getKubernetesPersistence(work) {
     }
     else {
         for (const volume of work.data.volumes) {
-            appendVolume(volume.inherited ?? work, persistence, volume.containerPath, null, false, !!volume.inherited);
+            appendVolume(volume.inherited ?? work, persistence, volume.containerPath, null, false, !!volume.inherited || volume.readOnly);
         }
     }
     return persistence;

package/dist/optimizer/work-task-cache-description.js

@@ -5,6 +5,7 @@ const os_1 = require("os");
 const crypto_1 = require("crypto");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
 const portable_path_1 = require("../planner/utils/portable-path");
+const work_secret_1 = require("../planner/work-secret");
 // Every path is made project-relative (portablePath) so the description, and the
 // task id hashed from it, is identical wherever the project is checked out.
 //
@@ -15,6 +16,10 @@ function getWorkTaskCacheDescription(item) {
     const task = item.data;
     const portable = (path) => (0, portable_path_1.portablePath)(task.projectRoot, path);
     const envs = (0, replace_env_variables_1.getEnvironmentVariables)(task.envs);
+    const cachedSecrets = task.secrets
+        .filter((secret) => secret.cache)
+        .map((secret) => `${(0, work_secret_1.getPortableSecretName)(task.projectRoot, secret)}=${secret.digest()}`)
+        .sort();
     return {
         shell: task.shell ?? undefined,
         platform: task.type === 'container-task' ? task.image : (0, os_1.platform)(),
@@ -33,6 +38,7 @@ function getWorkTaskCacheDescription(item) {
         mounts: task.type === 'container-task' ? task.mounts.map((m) => m.mount).sort() : undefined,
         cwd: portable(task.cwd),
         deps: item.deps.length > 0 ? item.deps.map((dep) => dep.id()).sort() : undefined,
+        secrets: cachedSecrets.length > 0 ? cachedSecrets : undefined,
     };
 }
 exports.getWorkTaskCacheDescription = getWorkTaskCacheDescription;

package/dist/parse-set-arguments.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseSetArguments = void 0;
+// `--set NAME=value` / `--set=NAME=value` on any command, as often as needed:
+// the value is what `$NAME` and `${NAME}` resolve to, ahead of the shell and
+// `.env` files. Taken out of argv before commander parses it, like `--file`.
+function parseSetArguments(argv) {
+    const args = [];
+    const values = {};
+    for (let index = 0; index < argv.length; index++) {
+        const arg = argv[index];
+        if (arg === '--set') {
+            const assignment = argv[index + 1];
+            if (assignment === undefined) {
+                throw new Error('--set expects NAME=value');
+            }
+            addAssignment(values, assignment);
+            index++;
+        }
+        else if (arg.startsWith('--set=')) {
+            addAssignment(values, arg.substring('--set='.length));
+        }
+        else {
+            args.push(arg);
+        }
+    }
+    return { args, values };
+}
+exports.parseSetArguments = parseSetArguments;
+function addAssignment(values, assignment) {
+    const separator = assignment.indexOf('=');
+    const name = separator > 0 ? assignment.substring(0, separator) : '';
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+        throw new Error(`--set expects NAME=value, got "${assignment}"`);
+    }
+    values[name] = assignment.substring(separator + 1);
+}
+//# sourceMappingURL=parse-set-arguments.js.map

package/dist/planner/service-definition.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getServiceDefinitionHash = void 0;
+const crypto_1 = require("crypto");
+const work_secret_1 = require("./work-secret");
+const work_service_1 = require("./work-service");
+// Everything a running container of the service was created from, plus the
+// definitions of the services it needs: a dependent links to the container it
+// started with, so a recreated need means a recreated dependent too. Stored as
+// a container label (a hash, never values) so `up` and `run` recreate a running
+// service whose definition changed instead of silently reusing it.
+function getServiceDefinitionHash(item) {
+    const service = item.data;
+    const definition = {
+        image: service.image,
+        cmd: service.cmd?.cmd ?? null,
+        shell: service.shell,
+        workdir: service.workdir,
+        envs: {
+            variables: service.envs.variables,
+            replacements: service.envs.replacements.map((r) => [r.key, r.name, r.value]),
+        },
+        ports: service.ports.map((p) => `${p.hostPort ?? ''}:${p.containerPort}`),
+        mounts: service.mounts.map((m) => `${m.localPath}:${m.containerPath}:${m.readOnly ? 'ro' : 'rw'}`),
+        volumes: service.volumes.map((v) => `${v.name}:${v.containerPath}:${v.readOnly ? 'ro' : 'rw'}`),
+        src: service.src.map((s) => s.absolutePath),
+        healthcheck: service.healthcheck?.cmd.cmd ?? null,
+        // where secrets go, never their values: a rotated value needs a `down`
+        secrets: service.secrets.map((s) => `${s.source.type}:${(0, work_secret_1.getSecretName)(s)}`),
+        // the init task's id covers its image, commands, envs and mounts: a changed
+        // init recreates the service, so it runs again
+        init: service.init ? service.init.task.id() : null,
+        needs: item.needs
+            .filter((need) => (0, work_service_1.isContainerWorkService)(need.service.data))
+            .map((need) => `${need.name}=${getServiceDefinitionHash(need.service)}`),
+    };
+    return (0, crypto_1.createHash)('sha1').update(JSON.stringify(definition)).digest('hex');
+}
+exports.getServiceDefinitionHash = getServiceDefinitionHash;
+//# sourceMappingURL=service-definition.js.map

package/dist/planner/utils/append-work-dependencies.js

@@ -32,6 +32,7 @@ function appendWorkDependencies(workTree, referenced, item, environment, context
                             resetOnChange: false,
                             containerPath: generate.path,
                             inherited: depNode,
+                            readOnly: false,
                         });
                     }
                 }
@@ -40,6 +41,7 @@ function appendWorkDependencies(workTree, referenced, item, environment, context
                         item.data.generates.push({
                             volumeName: generate.volumeName,
                             export: false,
+                            exportAlways: false,
                             resetOnChange: false,
                             path: generate.path,
                             inherited: depNode,

package/dist/planner/utils/append-work-needs.js

@@ -5,6 +5,10 @@ const append_work_service_1 = require("./append-work-service");
 function appendWorkNeeds(workTree, referenced, item, environment, context) {
     for (const need of referenced.needs) {
         const serviceNeed = (0, append_work_service_1.appendWorkService)(workTree, need.service, environment, context);
+        if (isInitOf(serviceNeed, item)) {
+            // planning the service planned this task as its init, with the view
+            continue;
+        }
         item.needs.push({
             service: serviceNeed,
             name: need.relativeName,
@@ -15,4 +19,7 @@ function appendWorkNeeds(workTree, referenced, item, environment, context) {
     }
 }
 exports.appendWorkNeeds = appendWorkNeeds;
+function isInitOf(service, item) {
+    return service.data.type === 'container-service' && service.data.init?.task === item;
+}
 //# sourceMappingURL=append-work-needs.js.map