npm - laneyard - Versions diffs - 0.2.0 → 0.4.0 - Mend

laneyard 0.2.0 → 0.4.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (53) hide show

package/README.md +295 -20
package/dist/src/cli/detect.js +69 -16
package/dist/src/cli/prompt.js +61 -0
package/dist/src/cli/secret-import.js +162 -0
package/dist/src/cli/secret.js +162 -1
package/dist/src/cli/setup.js +319 -0
package/dist/src/cli/style.js +31 -0
package/dist/src/cli/user.js +127 -0
package/dist/src/config/accounts.js +163 -0
package/dist/src/config/load.js +61 -1
package/dist/src/config/schema.js +26 -1
package/dist/src/config/store.js +10 -0
package/dist/src/config/yaml.js +14 -0
package/dist/src/credentials/kinds.js +120 -0
package/dist/src/db/credentials.js +75 -0
package/dist/src/db/schema.sql +39 -0
package/dist/src/db/secrets.js +28 -0
package/dist/src/db/sessions.js +61 -0
package/dist/src/git/workspace.js +32 -6
package/dist/src/heuristics/android-root.js +49 -0
package/dist/src/heuristics/android-signing.js +98 -0
package/dist/src/heuristics/appfile.js +60 -0
package/dist/src/heuristics/blocking-actions.js +22 -0
package/dist/src/heuristics/env-example.js +36 -0
package/dist/src/heuristics/platforms.js +136 -0
package/dist/src/heuristics/readiness.js +697 -25
package/dist/src/main.js +58 -8
package/dist/src/runner/gradle-properties.js +187 -0
package/dist/src/runner/materialise.js +92 -0
package/dist/src/runner/orchestrate.js +91 -2
package/dist/src/secrets/vault.js +106 -5
package/dist/src/server/app.js +94 -15
package/dist/src/server/auth.js +127 -19
package/dist/src/server/permissions.js +75 -0
package/dist/src/server/required-secrets.js +30 -0
package/dist/src/server/routes/account.js +57 -0
package/dist/src/server/routes/credentials.js +108 -0
package/dist/src/server/routes/projects.js +42 -0
package/dist/src/server/routes/readiness.js +175 -6
package/dist/src/server/routes/secrets.js +101 -0
package/dist/src/server/routes/users.js +64 -0
package/dist/src/sidecar/bridge.js +37 -1
package/dist/src/sidecar/fastlane-dir.js +23 -0
package/dist/src/sidecar/lanes.js +6 -0
package/dist/src/sidecar/uses.js +21 -5
package/dist/web/assets/{Editor-D5Q4uj4n.js → Editor-DynuBC2l.js} +1 -1
package/dist/web/assets/index-CpwrNE-K.css +1 -0
package/dist/web/assets/index-lyZs-Y7J.js +62 -0
package/dist/web/index.html +2 -2
package/package.json +1 -1
package/ruby/introspect.rb +122 -9
package/dist/web/assets/index-D9_EL8LA.js +0 -62
package/dist/web/assets/index-ZUqTX6d1.css +0 -1

package/dist/web/index.html CHANGED Viewed

@@ -4,8 +4,8 @@
     <meta charset="utf-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <title>laneyard</title>
-    <script type="module" crossorigin src="/assets/index-D9_EL8LA.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-ZUqTX6d1.css">
+    <script type="module" crossorigin src="/assets/index-lyZs-Y7J.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-CpwrNE-K.css">
   </head>
   <body>
     <div id="root"></div>

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "laneyard",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "type": "module",
   "bin": {
     "laneyard": "dist/src/main.js"

package/ruby/introspect.rb CHANGED Viewed

@@ -100,31 +100,144 @@ def literal_args(call)
   end
 end
+# Every keyword this call was given, whether or not its value could be read.
+#
+# `args` deliberately holds literals only — a checklist that guessed at
+# `ENV["X"]` would be believed. But dropping the whole entry loses something the
+# literal value was never needed for: that the argument *was passed at all*.
+#
+# The two are not the same question, and treating them as one produced a
+# visible inconsistency. A lane calling `app_store_connect_api_key(...)` was
+# recognised by the action's name and reported as "could not tell", while the
+# very same lane calling `upload_to_play_store(json_key: ENV.fetch("..."))` left
+# no trace of `json_key` and was reported as having no credential at all — a
+# warning and a shrug, for one situation.
+def arg_names(call)
+  hash = (call.arguments&.arguments || []).find { |a| a.is_a?(Prism::KeywordHashNode) }
+  return [] unless hash
+  hash.elements.filter_map do |el|
+    el.key.unescaped if el.is_a?(Prism::AssocNode) && el.key.is_a?(Prism::SymbolNode)
+  end
+end
+# How far a chain of helper methods is followed, and how the same method being
+# called twice is kept from being walked twice. Eight is far past anything a
+# real Fastfile does; the limit is there so that a pathological file costs a
+# bounded walk rather than the checklist.
+MAX_CALL_DEPTH = 8
+# Every method this Fastfile defines, indexed by the name a call would use.
+#
+# `def deploy_ios` under "deploy_ios", and `def self.ship` inside `module
+# Helpers` under "Helpers.ship". Both exist because both are how a real Fastfile
+# is factored, and a Fastfile that factors its lanes is a well-written one — not
+# an edge case. Reading only the lane bodies meant a project whose every action
+# sat one method call away looked like a project that called no actions at all,
+# and the Play Store check answered "no lane uploads to the Play Store" for a
+# project that uploads to the Play Store on every run. A confident tick is worse
+# than a warning: it is the one nobody checks.
+def collect_defs(node, scope = nil, out = {})
+  node.compact_child_nodes.each do |child|
+    case child
+    when Prism::ModuleNode, Prism::ClassNode
+      # Its own scope, and nothing outside it needs to be walked again.
+      collect_defs(child, child.constant_path.slice, out)
+      next
+    when Prism::DefNode
+      key = child.receiver.nil? ? child.name.to_s : (scope ? "#{scope}.#{child.name}" : nil)
+      out[key] = child.body if key
+    end
+    collect_defs(child, scope, out)
+  end
+  out
+end
+# The name a call would be indexed under, or nil when it cannot be one: a
+# receiver that is itself computed (`thing.ship`) is not something a file can
+# resolve, and guessing would be worse than the silence.
+def resolvable_name(call)
+  return call.name.to_s if call.receiver.nil?
+  call.receiver.is_a?(Prism::ConstantReadNode) ? "#{call.receiver.slice}.#{call.name}" : nil
+end
 # Every call inside a lane's block, however deeply nested: a call inside an `if`
 # is still a call the lane may make, and the checklist cares about what could
 # happen, not only about what always happens.
-def calls_within(node, out = [])
+#
+# A call to a method this Fastfile defines is followed into that method, so the
+# actions it makes are the lane's actions too — which is what they are. `seen`
+# is the cycle guard: two helpers that call each other must cost one walk, not
+# a stack overflow inside a checklist that promised never to throw.
+# The name of the environment variable this call reads, or nil.
+#
+# `ENV.fetch("X")`, `ENV["X"]` and `ENV.fetch("X") { … }` are the forms that
+# occur. A computed name — `ENV[some_var]` — is not a question this can answer,
+# and is left out rather than guessed at.
+def env_read(call)
+  return nil unless call.receiver.is_a?(Prism::ConstantReadNode)
+  return nil unless call.receiver.slice == "ENV"
+  return nil unless %w[fetch []].include?(call.name.to_s)
+  first = call.arguments&.arguments&.first
+  first.is_a?(Prism::StringNode) ? first.unescaped : nil
+end
+def calls_within(node, defs, seen = [], out = [], env = [])
+  return out if node.nil?
   node.compact_child_nodes.each do |child|
-    if child.is_a?(Prism::CallNode) && child.receiver.nil?
-      out << { name: child.name.to_s, args: literal_args(child) }
+    if child.is_a?(Prism::CallNode)
+      # Only receiverless calls are reported: `UI.message` and `File.join` are
+      # Ruby, not fastlane, and a checklist reading them would be reading noise.
+      if child.receiver.nil?
+        out << { name: child.name.to_s, args: literal_args(child), given: arg_names(child) }
+      end
+      # The exception to the receiverless rule above, because it is not noise: a
+      # variable the lane reads is a variable the run needs, and a run that meets
+      # an absent one either stops or builds the wrong thing. It is the only
+      # thing a Fastfile says about what the project requires from outside it.
+      name = env_read(child)
+      env << name if name
+      key = resolvable_name(child)
+      if key && defs.key?(key) && !seen.include?(key) && seen.length < MAX_CALL_DEPTH
+        calls_within(defs[key], defs, seen + [key], out, env)
+      end
     end
-    calls_within(child, out)
+    calls_within(child, defs, seen, out, env)
   end
   out
 end
+# Does this Fastfile pull in lanes from somewhere else?
+#
+# `import` and `import_from_git` bring in another file's lanes, and no amount of
+# reading this one will say what they call. Reported rather than resolved: the
+# checklist turns it into "could not tell" instead of a tick, which is the whole
+# difference between a checklist that is quiet and one that is wrong.
+def imports_elsewhere?(source)
+  source.lines.any? { |line| line.match?(/^\s*import(_from_git)?[\s(]/) }
+end
 def collect_uses(fastfile_path)
-  result = Prism.parse(File.read(fastfile_path))
+  source = File.read(fastfile_path)
+  result = Prism.parse(source)
   raise "Fastfile could not be parsed" unless result.success?
+  defs = collect_defs(result.value)
   lanes = []
   walk = lambda do |node|
     node.compact_child_nodes.each do |child|
       if child.is_a?(Prism::CallNode) && %w[lane private_lane].include?(child.name.to_s)
         name = child.arguments&.arguments&.first
+        env = []
+        actions = child.block ? calls_within(child.block, defs, [], [], env) : []
         lanes << {
           lane: name.is_a?(Prism::SymbolNode) ? name.unescaped : "?",
-          actions: child.block ? calls_within(child.block) : []
+          actions: actions,
+          env: env.uniq.sort
         }
       else
         # Not a lane: keep descending, so a `platform :ios do` block is seen through.
@@ -133,7 +246,7 @@ def collect_uses(fastfile_path)
     end
   end
   walk.call(result.value)
-  lanes
+  { lanes: lanes, imports: imports_elsewhere?(source) }
 end
 case command
@@ -155,13 +268,13 @@ when "lanes"
   respond({ ok: true, lanes: lanes })
 when "uses"
   begin
-    lanes = collect_uses(fastfile_path)
+    used = collect_uses(fastfile_path)
   rescue Exception => e # rubocop:disable Lint/RescueException
     # Same shape as "lanes" above, and the same reason: parsing can raise
     # anything, and `respond`'s `exit 0` must not be caught by this rescue.
     fail_with("Could not parse the Fastfile: #{e.message}")
   end
-  respond({ ok: true, lanes: lanes })
+  respond({ ok: true, lanes: used[:lanes], imports: used[:imports] })
 else
   fail_with("Unknown command: #{command.inspect}")
 end