laneyard 0.1.0 → 0.2.0

package/dist/src/server/routes/runs.js

@@ -1,5 +1,6 @@
 import { createReadStream } from "node:fs";
-import { executeRun } from "../../runner/orchestrate.js";
+/** Statuses a run can still be cancelled from. */
+const CANCELLABLE = ["queued", "preparing", "running"];
 export async function registerRunRoutes(app, ctx) {
     app.post("/api/projects/:slug/runs", async (req, reply) => {
         const { slug } = req.params;
@@ -9,17 +10,6 @@ export async function registerRunRoutes(app, ctx) {
             return reply.code(404).send({ error: "Unknown project" });
         if (!body.lane)
             return reply.code(400).send({ error: "Missing lane" });
-        // Only one run at a time per project: they share the same git workspace.
-        // Two concurrent runs would silently trip over each other — one would
-        // change the commit out from under the other, carry off its artifacts
-        // and delete its report. The real queue comes at the next milestone;
-        // this refusal, for its part, already prevents false results.
-        const last = ctx.runs.listByProject(slug, 1)[0];
-        if (last && ["queued", "preparing", "running"].includes(last.status)) {
-            return reply.code(409).send({
-                error: `Run #${last.id} is still in progress on this project. Wait for it to finish.`,
-            });
-        }
         // We check that the lane genuinely exists before creating a run doomed to fail.
         try {
             await ctx.ensureWorkspace(slug);
@@ -38,45 +28,37 @@ export async function registerRunRoutes(app, ctx) {
             platform: body.platform ?? null,
             params: body.params ?? {},
         });
-        // Launched without waiting: the HTTP response mustn't take as long as a build.
-        void executeRun({
-            runId: id,
-            runs: ctx.runs,
-            logs: ctx.logs,
-            workspacePath: ctx.workspacePath(slug),
-            artifactsDir: ctx.artifactsDir(id),
-            gitUrl: entry.git_url,
-            gitAuth: entry.git_auth,
-            branch: entry.default_branch,
-            // Resolved after the clone, once the repository's laneyard.yml is finally readable.
-            resolveSettings: async () => {
-                const r = await ctx.config.resolve(slug, ctx.workspacePath(slug));
-                return r.settings;
-            },
-            env: process.env,
-            onChunk: (chunk, offset) => app.broadcastRunChunk?.(id, chunk, offset),
-        })
-            .then((r) => ctx.sockets?.finish(id, r.status))
-            .catch((cause) => {
-            // Last safety net. `executeRun` commits to never throwing, but a
-            // rejected promise with no handler brings down the whole Node
-            // process — and with it, the other runs in progress. The cost of
-            // forgetting this would be disproportionate.
-            ctx.runs.finish(id, {
-                status: "failed",
-                exitCode: null,
-                errorSummary: `Unexpected failure: ${cause.message}`,
-            });
-            ctx.sockets?.finish(id, "failed");
-        });
-        return reply.code(201).send({ id });
+        // Read before the queue is woken, so the answer describes the line the
+        // caller just joined rather than one the worker has already moved on from.
+        const queuePosition = ctx.runs.queuePosition(id);
+        // The route creates a row and rings the bell; the worker does the rest.
+        app.queue.wake();
+        return reply.code(201).send({ id, queuePosition });
     });
     app.get("/api/runs/:id", async (req, reply) => {
         const id = Number(req.params.id);
         const run = ctx.runs.get(id);
         if (!run)
             return reply.code(404).send({ error: "Unknown run" });
-        return { ...run, steps: ctx.runs.steps(id), artifacts: ctx.runs.artifacts(id) };
+        return {
+            ...run,
+            queuePosition: ctx.runs.queuePosition(id),
+            steps: ctx.runs.steps(id),
+            artifacts: ctx.runs.artifacts(id),
+        };
+    });
+    app.post("/api/runs/:id/cancel", async (req, reply) => {
+        const id = Number(req.params.id);
+        const run = ctx.runs.get(id);
+        if (!run)
+            return reply.code(404).send({ error: "Unknown run" });
+        if (!CANCELLABLE.includes(run.status)) {
+            return reply.code(409).send({ error: `Run #${id} has already finished` });
+        }
+        // A queued run is finished on the spot; a running one is signalled and ends
+        // a few moments later. Either way the caller has nothing left to wait for.
+        app.queue.cancel(id);
+        return reply.code(204).send();
     });
     app.get("/api/runs/:id/log", async (req, reply) => {
         const id = Number(req.params.id);

package/dist/src/server/routes/secrets.js

@@ -0,0 +1,51 @@
+import { MIN_LENGTH as MIN_REDACTABLE } from "../../logs/redact.js";
+/** POSIX environment variable names. Anything else would never reach fastlane. */
+const VALID_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export async function registerSecretRoutes(app, ctx) {
+    const listRoute = (slug) => slug === null ? ctx.vault.listGlobal() : ctx.vault.list(slug);
+    app.get("/api/secrets", async () => listRoute(null));
+    app.get("/api/projects/:slug/secrets", async (req, reply) => {
+        const { slug } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        return listRoute(slug);
+    });
+    const put = async (slug, key, body, reply) => {
+        const { value, masked } = (body ?? {});
+        if (!VALID_KEY.test(key)) {
+            return reply.code(400).send({
+                error: `"${key}" is not a valid environment variable name: letters, digits and underscore, not starting with a digit.`,
+            });
+        }
+        if (typeof value !== "string" || value === "") {
+            return reply.code(400).send({ error: "A value is required" });
+        }
+        // Accepting the tick box and quietly not honouring it would leave someone
+        // believing they are protected. Refusing is the honest answer.
+        if (masked !== false && value.length < MIN_REDACTABLE) {
+            return reply.code(400).send({
+                error: `A value kept out of the logs must be at least ${MIN_REDACTABLE} characters. ` +
+                    "Shorter than that, removing it would shred the log without hiding anything. " +
+                    "Store it unmasked if you accept it appearing in the output.",
+            });
+        }
+        await ctx.vault.set(slug, key, value, masked !== false);
+        return reply.code(204).send();
+    };
+    app.put("/api/secrets/:key", async (req, reply) => put(null, req.params.key, req.body, reply));
+    app.put("/api/projects/:slug/secrets/:key", async (req, reply) => {
+        const { slug, key } = req.params;
+        if (!ctx.config.project(slug))
+            return reply.code(404).send({ error: "Unknown project" });
+        return put(slug, key, req.body, reply);
+    });
+    app.delete("/api/secrets/:key", async (req, reply) => {
+        const removed = ctx.vault.remove(null, req.params.key);
+        return removed ? reply.code(204).send() : reply.code(404).send({ error: "Unknown secret" });
+    });
+    app.delete("/api/projects/:slug/secrets/:key", async (req, reply) => {
+        const { slug, key } = req.params;
+        const removed = ctx.vault.remove(slug, key);
+        return removed ? reply.code(204).send() : reply.code(404).send({ error: "Unknown secret" });
+    });
+}

package/dist/src/sidecar/lanes.js

@@ -27,14 +27,14 @@ export class LaneReader {
     }
     async read(slug, workspacePath, fastlaneDir) {
         const hash = await hashFastlaneDir(workspacePath, fastlaneDir);
-        const cached = this.cache.get(slug, hash);
+        const cached = this.cache.get(slug, "lanes", hash);
         if (cached)
             return cached;
         const res = await this.invoke("lanes", workspacePath, fastlaneDir);
         if (!res.ok)
             throw new Error(res.error);
         const lanes = res["lanes"];
-        this.cache.put(slug, hash, lanes);
+        this.cache.put(slug, "lanes", hash, lanes);
         return lanes;
     }
 }

package/dist/src/sidecar/uses.js

@@ -0,0 +1,40 @@
+import { createHash } from "node:crypto";
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+/**
+ * Hash of the whole fastlane folder, not just the Fastfile:
+ * an Appfile, a Pluginfile, or an imported file change the lanes just as much.
+ */
+async function hashFastlaneDir(root, fastlaneDir) {
+    const dir = join(root, fastlaneDir);
+    const hash = createHash("sha256");
+    const entries = (await readdir(dir, { withFileTypes: true, recursive: true }))
+        .filter((e) => e.isFile())
+        .map((e) => join(e.parentPath, e.name))
+        .sort();
+    for (const file of entries) {
+        hash.update(file);
+        hash.update(await readFile(file));
+    }
+    return hash.digest("hex");
+}
+export class UsesReader {
+    cache;
+    invoke;
+    constructor(cache, invoke) {
+        this.cache = cache;
+        this.invoke = invoke;
+    }
+    async read(slug, workspacePath, fastlaneDir) {
+        const hash = await hashFastlaneDir(workspacePath, fastlaneDir);
+        const cached = this.cache.get(slug, "uses", hash);
+        if (cached)
+            return cached;
+        const res = await this.invoke("uses", workspacePath, fastlaneDir);
+        if (!res.ok)
+            throw new Error(res.error);
+        const lanes = res["lanes"];
+        this.cache.put(slug, "uses", hash, lanes);
+        return lanes;
+    }
+}