hammerkit 1.9.2 → 1.11.0

package/dist/planner/utils/append-work-service.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getHealthcheckTimeout = exports.DEFAULT_HEALTHCHECK_TIMEOUT = exports.appendWorkService = void 0;
+exports.getHealthcheckTimeout = exports.DEFAULT_HEALTHCHECK_TIMEOUT = exports.getInitTimeout = exports.DEFAULT_INIT_TIMEOUT = exports.getPlannedService = exports.appendWorkService = void 0;
+const work_secret_1 = require("../work-secret");
 const work_service_id_1 = require("../work-service-id");
 const parse_work_ports_1 = require("./parse-work-ports");
 const template_value_1 = require("./template-value");
@@ -12,6 +13,8 @@ const parse_work_mounts_1 = require("./parse-work-mounts");
 const parse_work_source_1 = require("./parse-work-source");
 const append_work_dependencies_1 = require("./append-work-dependencies");
 const append_work_needs_1 = require("./append-work-needs");
+const work_item_1 = require("../work-item");
+const append_work_task_1 = require("./append-work-task");
 const replace_env_variables_1 = require("../../environment/replace-env-variables");
 const state_1 = require("../../executer/state");
 const lazy_resolver_1 = require("../../executer/lazy-resolver");
@@ -42,6 +45,7 @@ function appendWorkService(workTree, service, environment, context) {
         workTree.services[workItem.name] = workStateItem;
         (0, append_work_dependencies_1.appendWorkDependencies)(workTree, service, workStateItem, environment, context);
         (0, append_work_needs_1.appendWorkNeeds)(workTree, service, workStateItem, environment, context);
+        appendServiceInit(workTree, service, workStateItem, environment, context);
         return workStateItem;
     }
     else {
@@ -107,9 +111,71 @@ function parseService(workTree, service, environment, context) {
             mounts: (0, parse_work_mounts_1.parseWorkMounts)(service.cwd, service.schema, envs),
             src: (0, parse_work_source_1.parseWorkSource)(service.cwd, service.schema.src, envs),
             caching,
+            // set once the service is planned, see appendServiceInit
+            init: null,
+            secrets: (0, work_secret_1.parseWorkSecrets)(service.cwd, context.projectRoot, service.schema.secrets, envs, environment),
         };
     }
 }
+// The task named by `init` is planned like any other task. It needs the
+// service under the service's name, but through a view of it that turns running
+// once the healthcheck passed; the service itself only runs for everything else
+// once the init succeeded. The init never makes the service start (it is not
+// among the service's requirers), never comes from the cache, and gets the init
+// timeout unless it declares its own.
+function appendServiceInit(workTree, service, item, environment, context) {
+    if (!service.init || !(0, work_item_1.isContainerWorkServiceItem)(item)) {
+        return;
+    }
+    const task = (0, append_work_task_1.appendWorkTask)(workTree, service.init.cwd, service.init.task, environment, context);
+    const state = new state_1.State({ type: 'pending', stateKey: null });
+    const view = { ...item, state };
+    initViews.set(view, item);
+    const selfNeed = task.needs.findIndex((need) => need.service.name === item.name);
+    if (selfNeed >= 0) {
+        task.needs[selfNeed] = { name: task.needs[selfNeed].name, service: view };
+    }
+    else {
+        task.needs.push({ name: item.name, service: view });
+    }
+    removeRequirer(item, task.name);
+    task.data.caching = { ...task.data.caching, method: 'none' };
+    if (task.data.timeout === null) {
+        task.data.timeout = getInitTimeout(undefined, environment);
+    }
+    item.data.init = { task, state };
+}
+const initViews = new WeakMap();
+// The service itself for the view its init task needs, else the item.
+function getPlannedService(item) {
+    return initViews.get(item) ?? item;
+}
+exports.getPlannedService = getPlannedService;
+function removeRequirer(item, name) {
+    const index = item.requiredBy.findIndex((requirer) => requirer.name === name);
+    if (index >= 0) {
+        item.requiredBy.splice(index, 1);
+    }
+}
+exports.DEFAULT_INIT_TIMEOUT = '5m';
+// The init task's own `timeout`, else HAMMERKIT_INIT_TIMEOUT, else 5 minutes:
+// an init that never ends would otherwise keep the run waiting.
+function getInitTimeout(timeout, environment) {
+    if (timeout) {
+        return (0, units_1.parseDuration)(timeout);
+    }
+    const fromEnv = environment.processEnvs.HAMMERKIT_INIT_TIMEOUT;
+    if (fromEnv) {
+        try {
+            return (0, units_1.parseDuration)(fromEnv);
+        }
+        catch (e) {
+            throw new Error(`HAMMERKIT_INIT_TIMEOUT: ${(0, log_1.getErrorMessage)(e)}`);
+        }
+    }
+    return (0, units_1.parseDuration)(exports.DEFAULT_INIT_TIMEOUT);
+}
+exports.getInitTimeout = getInitTimeout;
 exports.DEFAULT_HEALTHCHECK_TIMEOUT = '20s';
 // A service's own `healthcheck.timeout`, else HAMMERKIT_HEALTHCHECK_TIMEOUT,
 // else 20s: a check that never passes fails the run instead of hanging it.

package/dist/planner/utils/append-work-task.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.appendWorkTask = void 0;
+const work_secret_1 = require("../work-secret");
 const parse_work_generate_1 = require("./parse-work-generate");
 const template_value_1 = require("./template-value");
 const parse_work_mounts_1 = require("./parse-work-mounts");
@@ -67,6 +68,7 @@ function parseTask(cwd, task, environment, context) {
         shell: task.schema.shell ? (0, template_value_1.templateValue)(task.schema.shell, envs) : '/bin/sh',
         continuous: task.schema.continuous ?? false,
         timeout: task.schema.timeout ? (0, units_1.parseDuration)(task.schema.timeout) : null,
+        secrets: (0, work_secret_1.parseWorkSecrets)(cwd, context.projectRoot, task.schema.secrets, envs, environment),
     };
     if ((0, build_file_task_schema_1.isBuildFileContainerTaskSchema)(task.schema)) {
         return {
@@ -78,6 +80,10 @@ function parseTask(cwd, task, environment, context) {
         };
     }
     else {
+        const fileSecret = baseWorkNode.secrets.find((secret) => secret.target.type === 'file');
+        if (fileSecret) {
+            throw new Error(`task ${task.relativeName}: a local task takes secrets as env only (${(0, work_secret_1.getSecretName)(fileSecret)})`);
+        }
         return {
             ...baseWorkNode,
             type: 'local-task',

package/dist/planner/utils/parse-work-generate.js

@@ -16,6 +16,7 @@ function parseWorkGenerate(cwd, schema, envs) {
             volumeName: (0, plan_work_volume_1.getVolumeName)(filePath),
             resetOnChange: generate.resetOnChange,
             export: generate.export,
+            exportAlways: generate.exportAlways,
             isFile: (0, path_1.extname)(generate.path).length > 1,
             inherited: null,
         };
@@ -24,13 +25,14 @@ function parseWorkGenerate(cwd, schema, envs) {
 exports.parseWorkGenerate = parseWorkGenerate;
 function mapGenerate(generate) {
     if (typeof generate === 'string') {
-        return { path: generate, resetOnChange: true, export: false };
+        return { path: generate, resetOnChange: true, export: false, exportAlways: false };
     }
     else {
         return {
             path: generate.path,
             resetOnChange: generate.resetOnChange ?? true,
-            export: generate.export ?? false,
+            export: !!generate.export,
+            exportAlways: generate.export === 'always',
         };
     }
 }

package/dist/planner/utils/parse-work-mount.js

@@ -7,22 +7,26 @@ const path_1 = require("path");
 function parseWorkMount(cwd, dir) {
     const parts = dir.split(':');
     if (parts.length === 1) {
-        return parseLocalMount(cwd, dir, dir, dir);
+        return parseLocalMount(cwd, dir, dir, dir, false);
     }
     else if (parts.length === 2) {
-        return parseLocalMount(cwd, parts[0], parts[1], dir);
+        return parseLocalMount(cwd, parts[0], parts[1], dir, false);
+    }
+    else if (parts.length === 3 && (parts[2] === 'ro' || parts[2] === 'rw')) {
+        return parseLocalMount(cwd, parts[0], parts[1], dir, parts[2] === 'ro');
     }
     else {
         throw new Error(`invalid mount ${dir}`);
     }
 }
 exports.parseWorkMount = parseWorkMount;
-function parseLocalMount(cwd, localPath, containerPath, mount) {
+function parseLocalMount(cwd, localPath, containerPath, mount, readOnly) {
     return {
         localPath: (0, normalize_path_1.normalizePath)(cwd, (0, os_1.homedir)(), localPath),
         containerPath: (0, normalize_path_1.normalizePath)(cwd, cwd, containerPath),
         isFile: (0, path_1.extname)(localPath).length > 1,
         mount,
+        readOnly,
     };
 }
 //# sourceMappingURL=parse-work-mount.js.map

package/dist/planner/utils/parse-work-volume.js

@@ -8,7 +8,10 @@ function parseWorkVolume(cwd, volume, envs) {
     if (typeof volume === 'string') {
         const parts = volume.split(':');
         if (parts.length === 2) {
-            return parseVolume(cwd, parts[0], parts[1]);
+            return parseVolume(cwd, parts[0], parts[1], false);
+        }
+        else if (parts.length === 3 && (parts[2] === 'ro' || parts[2] === 'rw')) {
+            return parseVolume(cwd, parts[0], parts[1], parts[2] === 'ro');
         }
         else {
             throw new Error(`invalid volume ${volume}`);
@@ -18,10 +21,11 @@ function parseWorkVolume(cwd, volume, envs) {
         const path = (0, template_value_1.templateValue)(volume.path, envs);
         return {
             containerPath: path,
-            export: volume.export ?? false,
+            export: !!volume.export,
             name: volume.name ? (0, template_value_1.templateValue)(volume.name, envs) : (0, plan_work_volume_1.getVolumeName)(path),
             inherited: null,
             resetOnChange: volume.resetOnChange ?? false,
+            readOnly: volume.readOnly ?? false,
         };
     }
 }
@@ -33,13 +37,14 @@ function parseWorkVolumes(cwd, volumes, envs) {
     return volumes.map((v) => parseWorkVolume(cwd, v, envs));
 }
 exports.parseWorkVolumes = parseWorkVolumes;
-function parseVolume(cwd, name, containerPath) {
+function parseVolume(cwd, name, containerPath, readOnly) {
     return {
         name,
         resetOnChange: false,
         containerPath: (0, normalize_path_1.normalizePath)(cwd, cwd, containerPath),
         inherited: null,
         export: false,
+        readOnly,
     };
 }
 //# sourceMappingURL=parse-work-volume.js.map

package/dist/planner/utils/plan-work-volume.js

@@ -24,6 +24,7 @@ function getContainerVolumes(task, mounts) {
             containerPath: generate.path,
             inherited: generate.inherited,
             export: generate.export,
+            readOnly: false,
         });
     }
     return volumes;

package/dist/planner/utils/service-hostname.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getServiceHostname = void 0;
+// A DNS label from the service name: Docker writes the container's hostname
+// into its own /etc/hosts, so the service reaches itself by name (a database
+// that advertises its own address, such as a MongoDB replica set member).
+function getServiceHostname(name) {
+    return (name
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .substring(0, 63) || 'service');
+}
+exports.getServiceHostname = getServiceHostname;
+//# sourceMappingURL=service-hostname.js.map

package/dist/planner/utils/template-value.js

@@ -7,7 +7,7 @@ function templateValue(value, envs) {
     }
     let result = value;
     for (const [key, envValue] of Object.entries(envs.variables)) {
-        result = result.replace(new RegExp(`\\$${key}`, 'gi'), envValue);
+        result = result.replace(new RegExp(`\\$\\{${key}\\}|\\$${key}`, 'gi'), envValue);
     }
     return result;
 }

package/dist/planner/work-item-status.js

@@ -5,6 +5,7 @@ const emitter_1 = require("../utils/emitter");
 const environment_config_1 = require("../utils/environment-config");
 const log_1 = require("../log");
 const buffer_context_1 = require("../utils/buffer-context");
+const redact_1 = require("../utils/redact");
 const StatusBufferMax = (0, environment_config_1.getEnvironmentConfig)('STATUS_BUFFER_LIMIT', 300);
 const ConsoleBufferMax = (0, environment_config_1.getEnvironmentConfig)('CONSOLE_BUFFER_LIMIT', 30);
 function logContext(type, item) {
@@ -18,7 +19,8 @@ function statusConsole(writable) {
     const statusBuffer = new buffer_context_1.BufferContext(StatusBufferMax);
     const consoleBuffer = new buffer_context_1.BufferContext(ConsoleBufferMax);
     const emit = (0, emitter_1.emitter)();
-    function addMessage(context, message) {
+    function addMessage(context, unredacted) {
+        const message = { ...unredacted, message: (0, redact_1.redact)(unredacted.message) };
         emit.emit(message);
         writable.write(JSON.stringify({ context, message }) + '\n');
         if (message.type === 'console') {

package/dist/planner/work-runtime-docker.js

@@ -6,6 +6,7 @@ const execute_docker_1 = require("../executer/execute-docker");
 const remove_container_1 = require("../docker/remove-container");
 const docker_task_1 = require("../executer/docker-task");
 const docker_service_1 = require("../executer/docker-service");
+const container_secrets_1 = require("../executer/container-secrets");
 const using_container_1 = require("../docker/using-container");
 const event_cache_1 = require("../executer/event-cache");
 const get_docker_executor_1 = require("../executer/get-docker-executor");
@@ -14,6 +15,7 @@ const tar_1 = require("tar");
 const plan_work_volume_1 = require("./utils/plan-work-volume");
 const work_instance_id_1 = require("./work-instance-id");
 const stream_1 = require("stream");
+const service_definition_1 = require("./service-definition");
 const container_task_state_1 = require("../executer/container-task-state");
 function dockerTaskRuntime(task, workEnvironment) {
     const docker = (0, execute_docker_1.getContainerCli)(workEnvironment);
@@ -160,6 +162,11 @@ function dockerServiceRuntime(service, workEnvironment) {
             if (!currentService) {
                 return;
             }
+            if (currentService.Labels['hammerkit-definition'] !== (0, service_definition_1.getServiceDefinitionHash)(service)) {
+                service.status.write('info', `${service.name} changed since it was started, recreating it`);
+                await (0, remove_container_1.removeContainer)(docker.getContainer(currentService.Id));
+                return;
+            }
             const servicePid = 'hammerkit-pid' in currentService.Labels ? parseInt(currentService.Labels['hammerkit-pid']) : undefined;
             const serviceState = 'hammerkit-state' in currentService.Labels ? currentService.Labels['hammerkit-state'] : '';
             state.set({
@@ -181,6 +188,7 @@ function dockerServiceRuntime(service, workEnvironment) {
             for (const container of containers) {
                 await (0, remove_container_1.removeContainer)(docker.getContainer(container.Id));
             }
+            await (0, container_secrets_1.removeContainerSecrets)((0, work_instance_id_1.getWorkInstanceId)(service));
         },
         async remove() {
             await this.stop();

package/dist/planner/work-runtime-kubernetes.js

@@ -5,6 +5,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.kubernetesForwardRuntime = exports.kubernetesServiceRuntime = exports.kubernetesTaskRuntime = void 0;
 const abort_1 = require("../executer/abort");
+const get_service_ip_1 = require("../kubernetes/get-service-ip");
+const work_item_1 = require("./work-item");
 const kubernetes_service_1 = require("../executer/kubernetes-service");
 const kubernetes_instance_1 = require("../kubernetes/kubernetes-instance");
 const replace_env_variables_1 = require("../environment/replace-env-variables");
@@ -23,6 +25,7 @@ const version_1 = require("../version");
 const restore_kubernetes_data_1 = require("../kubernetes/restore-kubernetes-data");
 const store_kubernetes_data_1 = require("../kubernetes/store-kubernetes-data");
 const remove_persistent_data_1 = require("../kubernetes/remove-persistent-data");
+const secrets_1 = require("../kubernetes/secrets");
 async function listJobNames(instance, kubernetes, task) {
     const jobs = await instance.batchApi.listNamespacedJob({
         namespace: kubernetes.namespace,
@@ -47,11 +50,31 @@ function kubernetesTaskRuntime(task, kubernetes) {
             const persistence = await (0, volumes_1.getKubernetesPersistence)(task);
             await (0, ensure_namespace_1.ensureNamespace)(instance, kubernetes.namespace);
             await (0, ensure_persistent_data_1.ensurePersistentData)(instance, kubernetes, environment, task, persistence);
+            const secrets = (0, secrets_1.getKubernetesSecretRefs)(task, task.data.secrets);
+            try {
+                await (0, secrets_1.ensureKubernetesSecret)(instance, kubernetes, task, task.data.secrets, environment);
+            }
+            catch (e) {
+                options.state.set({ stateKey: options.stateKey, type: 'error', errorMessage: (0, log_1.getErrorMessage)(e) });
+                return;
+            }
             // The last job of a run stays: its state label is what currentStateKey
             // reads. Jobs from an earlier run of this task go before this one starts.
             for (const name of await listJobNames(instance, kubernetes, task)) {
                 await (0, await_running_state_1.deleteJobAndWait)(instance, kubernetes, name, options.abort);
             }
+            // the services the task needs, by the names it lists them under
+            const hostAliases = [];
+            for (const need of task.needs) {
+                if (!(0, work_item_1.isContainerWorkServiceItem)(need.service)) {
+                    continue;
+                }
+                const ip = await (0, get_service_ip_1.getServiceIp)(instance, kubernetes, need.service);
+                if (!ip) {
+                    throw new Error(`unable to get service ip for ${need.name}`);
+                }
+                hostAliases.push({ ip, hostnames: [need.name] });
+            }
             const podName = `${task.name}-${options.stateKey}`;
             let i = 0;
             for (const cmd of task.data.cmds) {
@@ -84,15 +107,20 @@ function kubernetesTaskRuntime(task, kubernetes) {
                                 containers: [
                                     {
                                         image: task.data.image,
-                                        command: [cmd.parsed.command],
-                                        args: cmd.parsed.args,
+                                        // through the task's shell, as on Docker
+                                        command: [task.data.shell, '-c'],
+                                        args: [cmd.cmd],
                                         workingDir: cmd.cwd,
-                                        env: Object.entries(envs).map(([key, value]) => ({ name: key, value })),
+                                        env: [
+                                            ...Object.entries(envs).map(([key, value]) => ({ name: key, value })),
+                                            ...secrets.env,
+                                        ],
                                         name: `cmd-${++i}`,
-                                        volumeMounts: persistence.mounts.map((m) => m.mount),
+                                        volumeMounts: [...persistence.mounts.map((m) => m.mount), ...secrets.mounts],
                                     },
                                 ],
-                                volumes: persistence.volumes,
+                                volumes: [...persistence.volumes, ...secrets.volumes],
+                                hostAliases,
                                 restartPolicy: 'Never',
                             },
                         },
@@ -121,9 +149,12 @@ function kubernetesTaskRuntime(task, kubernetes) {
                         type: 'error',
                         errorMessage: (0, log_1.getErrorMessage)(e),
                     });
+                    await (0, secrets_1.removeKubernetesSecret)(instance, kubernetes, task).catch(() => undefined);
                     return;
                 }
             }
+            // the finished job stays for its state, the values it read need not
+            await (0, secrets_1.removeKubernetesSecret)(instance, kubernetes, task);
         },
         async stop() {
             const jobs = await instance.batchApi.listNamespacedJob({
@@ -160,6 +191,7 @@ function kubernetesTaskRuntime(task, kubernetes) {
         async remove() {
             await this.stop();
             await (0, remove_persistent_data_1.removePersistentData)(instance, kubernetes, task);
+            await (0, secrets_1.removeKubernetesSecret)(instance, kubernetes, task);
         },
         async currentStateKey() {
             const jobs = await instance.batchApi.listNamespacedJob({
@@ -217,13 +249,15 @@ function kubernetesServiceRuntime(service, kubernetes) {
                     });
                 }
             }
+            await (0, secrets_1.removeKubernetesSecret)(instance, kubernetes, service);
         },
         async execute(environment, options) {
             const persistence = await (0, volumes_1.getKubernetesPersistence)(service);
             await (0, ensure_namespace_1.ensureNamespace)(instance, kubernetes.namespace);
             await (0, ensure_kubernetes_service_exists_1.ensureKubernetesServiceExists)(instance, kubernetes, service);
             await (0, ensure_persistent_data_1.ensurePersistentData)(instance, kubernetes, environment, service, persistence);
-            await (0, ensure_kubernetes_deployment_exists_1.ensureKubernetesDeploymentExists)(instance, kubernetes, service, persistence, options.stateKey);
+            await (0, secrets_1.ensureKubernetesSecret)(instance, kubernetes, service, service.data.secrets, environment);
+            await (0, ensure_kubernetes_deployment_exists_1.ensureKubernetesDeploymentExists)(instance, kubernetes, service, persistence, (0, secrets_1.getKubernetesSecretRefs)(service, service.data.secrets), options.stateKey);
             const name = (0, resources_1.getResourceName)(service);
             options.state.set({
                 type: 'running',

package/dist/planner/work-secret.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSecretDigest = exports.resolveSecretValue = exports.parseWorkSecrets = exports.getPortableSecretName = exports.getSecretName = void 0;
+const crypto_1 = require("crypto");
+const os_1 = require("os");
+const fs_1 = require("fs");
+const normalize_path_1 = require("./utils/normalize-path");
+const template_value_1 = require("./utils/template-value");
+const portable_path_1 = require("./utils/portable-path");
+const redact_1 = require("../utils/redact");
+function getSecretName(secret) {
+    return secret.target.type === 'env' ? secret.target.name : secret.target.path;
+}
+exports.getSecretName = getSecretName;
+// The name as it reads on every checkout, for cache identity: a file target
+// lives under the task's cwd, which is a different absolute path per machine.
+function getPortableSecretName(projectRoot, secret) {
+    return secret.target.type === 'env' ? secret.target.name : (0, portable_path_1.portablePath)(projectRoot, secret.target.path);
+}
+exports.getPortableSecretName = getPortableSecretName;
+function parseWorkSecrets(cwd, projectRoot, secrets, envs, environment) {
+    return (secrets ?? []).map((secret) => {
+        const ref = secret.from.substring(secret.from.indexOf(':') + 1);
+        const source = secret.from.startsWith('env:')
+            ? { type: 'env', name: ref }
+            : { type: 'file', path: (0, normalize_path_1.normalizePath)(cwd, (0, os_1.homedir)(), (0, template_value_1.templateValue)(ref, envs)) };
+        const target = secret.env
+            ? { type: 'env', name: secret.env }
+            : { type: 'file', path: (0, normalize_path_1.normalizePath)(cwd, cwd, (0, template_value_1.templateValue)(secret.path ?? '', envs)) };
+        const workSecret = {
+            source,
+            target,
+            cache: secret.cache ?? false,
+            digest: () => getSecretDigest(projectRoot, cwd, workSecret, readSecretValueSync(workSecret, environment)),
+        };
+        return workSecret;
+    });
+}
+exports.parseWorkSecrets = parseWorkSecrets;
+function readSecretValueSync(secret, environment) {
+    if (secret.source.type === 'env') {
+        const value = environment.processEnvs[secret.source.name];
+        if (value === undefined || value === null) {
+            throw new Error(`secret ${getSecretName(secret)}: environment variable ${secret.source.name} is not set`);
+        }
+        (0, redact_1.registerSecretValue)(value);
+        return value;
+    }
+    if (!(0, fs_1.existsSync)(secret.source.path)) {
+        throw new Error(`secret ${getSecretName(secret)}: file ${secret.source.path} does not exist`);
+    }
+    const value = (0, fs_1.readFileSync)(secret.source.path, 'utf8');
+    (0, redact_1.registerSecretValue)(value);
+    return value;
+}
+// The value, read when the task or service starts (or when a cache-affecting
+// secret is hashed); a missing source fails naming the secret.
+async function resolveSecretValue(secret, environment) {
+    if (secret.source.type === 'env') {
+        const value = environment.processEnvs[secret.source.name];
+        if (value === undefined || value === null) {
+            throw new Error(`secret ${getSecretName(secret)}: environment variable ${secret.source.name} is not set`);
+        }
+        (0, redact_1.registerSecretValue)(value);
+        return value;
+    }
+    if (!(await environment.file.exists(secret.source.path))) {
+        throw new Error(`secret ${getSecretName(secret)}: file ${secret.source.path} does not exist`);
+    }
+    const value = await environment.file.read(secret.source.path);
+    (0, redact_1.registerSecretValue)(value);
+    return value;
+}
+exports.resolveSecretValue = resolveSecretValue;
+// Salted with the project-relative location and the secret's name, so the
+// digest is identical on every checkout (remote cache ids match) but can't be
+// matched against digests of the same value elsewhere.
+function getSecretDigest(projectRoot, cwd, secret, value) {
+    const salt = `hammerkit-secret\0${(0, portable_path_1.portablePath)(projectRoot, cwd)}\0${getPortableSecretName(projectRoot, secret)}`;
+    return `sha256:${(0, crypto_1.createHash)('sha256').update(`${salt}\0${value}`).digest('hex')}`;
+}
+exports.getSecretDigest = getSecretDigest;
+//# sourceMappingURL=work-secret.js.map

package/dist/program.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getProgram = exports.createCli = void 0;
 const commander_1 = require("commander");
+const parse_set_arguments_1 = require("./parse-set-arguments");
 const path_1 = require("path");
 const ci_1 = require("./utils/ci");
 const parse_label_arguments_1 = require("./parser/parse-label-arguments");
@@ -56,7 +57,9 @@ function parseWorkLabelScope(options) {
 }
 async function getProgram(environment, argv) {
     const program = new commander_1.Command();
-    const args = [...argv];
+    const parsed = (0, parse_set_arguments_1.parseSetArguments)(argv);
+    const args = parsed.args;
+    environment.processEnvs = { ...environment.processEnvs, ...parsed.values };
     const fileIndex = args.indexOf('--file');
     const fileName = fileIndex >= 0 ? (0, path_1.join)(environment.cwd, args[fileIndex + 1]) : await (0, default_build_file_1.getBuildFilename)(environment.cwd, environment);
     if (fileIndex >= 0) {
@@ -421,6 +424,9 @@ async function getProgram(environment, argv) {
             .addOption(new commander_1.Option('-c, --concurrency <number>', 'parallel worker count').argParser(parseInt).default(4))
             .addOption(new commander_1.Option('-w, --watch', 'watch tasks').default(false))
             .addOption(new commander_1.Option('-d, --daemon', 'run services in background').default(false))
+            .addOption(new commander_1.Option('--wait <mode>', 'with --daemon, return once services are ready or once they started')
+            .default('ready')
+            .choices(['ready', 'start']))
             .addOption(new commander_1.Option('--env <name>', 'environment'))
             .addOption(new commander_1.Option('-l, --log <mode>', 'log mode')
             .default(ci_1.isCI ? 'live' : 'interactive')
@@ -440,6 +446,7 @@ async function getProgram(environment, argv) {
                     workers: options.concurrency,
                     logMode: options.log,
                     daemon: options.daemon,
+                    wait: options.wait,
                     cacheReadOnly: (0, read_only_1.isCacheReadOnly)(options.cacheReadOnly, environment.processEnvs),
                     timeout: options.timeout ?? null,
                 });
@@ -593,6 +600,7 @@ tasks:
     program.version((0, version_1.getVersion)());
     program.option('--verbose', 'log debugging information', false);
     program.option('--file', 'set build file', '.hammerkit.yaml');
+    program.option('--set <NAME=value>', 'value for $NAME / ${NAME} references, ahead of the shell and .env (repeatable)');
     program.configureOutput({
         writeOut: (str) => environment.console.info(str),
         writeErr: (str) => {

package/dist/schema/build-file-base-task-schema.js

@@ -9,6 +9,7 @@ const cache_schema_1 = require("./cache-schema");
 const build_file_task_command_schema_1 = require("./build-file-task-command-schema");
 const build_file_volume_schema_1 = require("./build-file-volume-schema");
 const duration_schema_1 = require("./duration-schema");
+const build_file_secret_schema_1 = require("./build-file-secret-schema");
 exports.buildFileBaseTaskSchema = (0, zod_1.object)({
     deps: (0, zod_1.array)((0, zod_1.string)()).optional(),
     needs: (0, zod_1.array)(build_file_need_schema_1.buildFileNeedSchema).optional(),
@@ -27,5 +28,6 @@ exports.buildFileBaseTaskSchema = (0, zod_1.object)({
     // Maximum execution time, e.g. `30s`, `10m`, `1h30m`. The task fails when it
     // runs longer. Does not affect the cache key (ADR-0002).
     timeout: duration_schema_1.durationSchema.optional(),
+    secrets: (0, zod_1.array)(build_file_secret_schema_1.buildFileSecretSchema).optional(),
 });
 //# sourceMappingURL=build-file-base-task-schema.js.map

package/dist/schema/build-file-container-service-schema.js

@@ -6,6 +6,7 @@ const envs_schema_1 = require("./envs-schema");
 const build_file_need_schema_1 = require("./build-file-need-schema");
 const labels_schema_1 = require("./labels-schema");
 const build_file_service_container_healthcheck_1 = require("./build-file-service-container-healthcheck");
+const build_file_secret_schema_1 = require("./build-file-secret-schema");
 exports.buildFileContainerServiceSchema = (0, zod_1.object)({
     image: (0, zod_1.string)(),
     description: (0, zod_1.string)().optional(),
@@ -30,6 +31,10 @@ exports.buildFileContainerServiceSchema = (0, zod_1.object)({
     labels: labels_schema_1.labelsSchema.optional(),
     continuous: (0, zod_1.boolean)().optional(),
     healthcheck: build_file_service_container_healthcheck_1.buildFileServiceContainerHealthcheck.optional(),
+    // a task (name or prefix:name, as in deps) that runs once the healthcheck
+    // passed; the service counts as ready for dependents only after it succeeded
+    init: (0, zod_1.string)().describe('task run once the service is healthy, before dependents start').optional(),
+    secrets: (0, zod_1.array)(build_file_secret_schema_1.buildFileSecretSchema).optional(),
 })
     .strict()
     .describe('container service');

package/dist/schema/build-file-secret-schema.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildFileSecretSchema = void 0;
+const zod_1 = require("zod");
+// A credential handed to a task or service without putting it in the build
+// file, the cache or the logs: `from: env:NAME` or `from: file:path`, injected
+// as an env variable (`env`) or a read-only file (`path`). `cache: true` makes
+// a salted digest of the value part of the task's cache key (ADR 0002).
+exports.buildFileSecretSchema = (0, zod_1.object)({
+    from: (0, zod_1.string)().regex(/^(env|file):.+$/, 'from must be env:NAME or file:path'),
+    env: (0, zod_1.string)()
+        .regex(/^[A-Za-z_][A-Za-z0-9_]*$/)
+        .optional(),
+    path: (0, zod_1.string)().optional(),
+    cache: (0, zod_1.boolean)().optional(),
+})
+    .strict()
+    .refine((secret) => (secret.env === undefined) !== (secret.path === undefined), {
+    message: 'a secret needs exactly one of env or path',
+})
+    .describe('secret from env:NAME or file:path, injected as env or a read-only file');
+//# sourceMappingURL=build-file-secret-schema.js.map

package/dist/schema/build-file-volume-schema.js

@@ -5,10 +5,12 @@ const zod_1 = require("zod");
 exports.buildFileVolumeSchema = (0, zod_1.union)([
     (0, zod_1.string)(),
     (0, zod_1.object)({
-        export: (0, zod_1.boolean)().optional(),
+        // `always`: copied to the host even when the task fails (test reports)
+        export: (0, zod_1.union)([(0, zod_1.boolean)(), (0, zod_1.literal)('always')]).optional(),
         resetOnChange: (0, zod_1.boolean)().optional(),
         path: (0, zod_1.string)(),
         name: (0, zod_1.string)().optional(),
+        readOnly: (0, zod_1.boolean)().optional(),
     }),
 ]);
 //# sourceMappingURL=build-file-volume-schema.js.map