skuba 7.3.1 → 7.4.0-horrible-hacks-20240206023615

package/template/express-rest-api/gantry.apply.yml

@@ -17,6 +17,10 @@ env:
   {{$key}}: {{$value}}
   {{end}}
 
+{{if .Values.cloudwatchDashboardDisabled}}
+cloudwatchDashboardDisabled: {{values "cloudwatchDashboardDisabled"}}
+{{end}}
+
 {{if .Values.datadogSecretId}}
 datadogSecretId: '{{values "datadogSecretId"}}'
 {{end}}
@@ -118,3 +122,4 @@ tags:
   {{end}}
 
 cpuArchitecture: <%- platformName %>
+readOnlyRootFilesystem: true

package/template/express-rest-api/gantry.build.yml

@@ -6,8 +6,7 @@ image: '{{values "image"}}'
 
 buildArgs:
   # https://github.com/seek-oss/docker-ecr-cache-buildkite-plugin#building-on-the-resulting-image
-  BASE_IMAGE: '{{.Env.BUILDKITE_PLUGIN_DOCKER_ECR_CACHE_EXPORT_IMAGE}}'
-  BASE_TAG: '{{.Env.BUILDKITE_PLUGIN_DOCKER_ECR_CACHE_EXPORT_TAG}}'
+  BASE_IMAGE: '{{.Env.BUILDKITE_PLUGIN_DOCKER_ECR_CACHE_EXPORT_IMAGE}}:{{.Env.BUILDKITE_PLUGIN_DOCKER_ECR_CACHE_EXPORT_TAG}}'
 
 # SEEK-Jobs/gantry#1661
 failOnScanFindings: false

package/template/express-rest-api/package.json

@@ -6,7 +6,7 @@
     "format": "skuba format",
     "lint": "skuba lint",
     "start": "skuba start --port <%- port %>",
-    "start:debug": "yarn start --inspect-brk",
+    "start:debug": "pnpm run --silent start --inspect-brk",
     "test": "skuba test",
     "test:ci": "skuba test --coverage",
     "test:watch": "skuba test --watch"
@@ -19,7 +19,7 @@
   "devDependencies": {
     "@types/express": "^4.17.13",
     "@types/node": "^20.9.0",
-    "@types/supertest": "^2.0.11",
+    "@types/supertest": "^6.0.0",
     "pino-pretty": "^10.0.0",
     "skuba": "*",
     "supertest": "^6.1.6"

package/template/express-rest-api/skuba.template.js

@@ -45,5 +45,6 @@ module.exports = {
       validate: (value) => /^[a-z]{2}-[a-z]+-\d+$/.test(value),
     },
   ],
+  packageManager: 'pnpm',
   type: 'application',
 };

package/template/greeter/.buildkite/pipeline.yml

@@ -4,15 +4,13 @@ agents:
 configs:
   plugins:
     - &aws-sm
-      seek-oss/aws-sm#v2.3.1:
+      seek-oss/aws-sm#v2.3.2:
         env:
           NPM_READ_TOKEN: arn:aws:secretsmanager:ap-southeast-2:987872074697:secret:npm/npm-read-token
 
     - &docker-ecr-cache
-      seek-oss/docker-ecr-cache#v2.1.0:
-        cache-on:
-          - package.json
-          - yarn.lock
+      seek-oss/docker-ecr-cache#v2.1.1:
+        cache-on: pnpm-lock.yaml
         secrets: id=npm,src=tmp/.npmrc
 
     - &private-npm
@@ -23,10 +21,12 @@ configs:
 steps:
   - label: 🧪 Test & Lint
     commands:
-      - echo '+++ yarn test:ci'
-      - yarn test:ci
-      - echo '--- yarn lint'
-      - yarn lint
+      - echo '--- pnpm install --offline'
+      - pnpm install --offline
+      - echo '+++ pnpm run test:ci'
+      - pnpm run test:ci
+      - echo '--- pnpm run lint'
+      - pnpm run lint
     env:
       GET_GITHUB_TOKEN: please
     plugins:
@@ -35,4 +35,7 @@ steps:
       - *docker-ecr-cache
       - docker-compose#v4.16.0:
           run: app
+          environment:
+            - GITHUB_API_TOKEN
+          propagate-environment: true
     timeout_in_minutes: 10

package/template/greeter/Dockerfile

@@ -2,10 +2,11 @@
 
 FROM --platform=${BUILDPLATFORM:-<%- platformName %>} node:20-alpine AS dev-deps
 
-WORKDIR /workdir
+RUN corepack enable pnpm
+RUN pnpm config set store-dir /root/.pnpm-store
 
-COPY package.json yarn.lock ./
+WORKDIR /workdir
 
-RUN \
-  --mount=type=secret,id=npm,dst=/root/.npmrc \
-  yarn install --frozen-lockfile --ignore-optional --non-interactive
+RUN --mount=type=bind,source=pnpm-lock.yaml,target=pnpm-lock.yaml \
+    --mount=type=secret,id=npm,dst=/root/.npmrc,required=true \
+    pnpm fetch

package/template/greeter/README.md

@@ -7,7 +7,7 @@ Next steps:
 1. [ ] Finish templating if this was skipped earlier:
 
    ```shell
-   yarn skuba configure
+   pnpm exec skuba configure
    ```
 
 2. [ ] Create a new repository in the appropriate GitHub organisation.
@@ -36,27 +36,27 @@ It's a barebones Node.js application that comprises:
 ### Test
 
 ```shell
-yarn test
+pnpm run test
 ```
 
 ### Lint
 
 ```shell
 # Fix issues
-yarn format
+pnpm run format
 
 # Check for issues
-yarn lint
+pnpm run lint
 ```
 
 ### Start
 
 ```shell
 # Start a live-reloading process
-yarn start
+pnpm run start
 
 # Start with Node.js Inspector enabled
-yarn start:debug
+pnpm run start:debug
 ```
 
 This runs a live-reloading Node.js process pointing to the [src/app.ts](src/app.ts) entrypoint.

package/template/greeter/docker-compose.yml

@@ -2,16 +2,6 @@ version: '3.7'
 
 services:
   app:
-    environment:
-      # Enable Buildkite + GitHub integrations.
-      - BUILDKITE
-      - BUILDKITE_AGENT_ACCESS_TOKEN
-      - BUILDKITE_BRANCH
-      - BUILDKITE_BUILD_NUMBER
-      - BUILDKITE_JOB_ID
-      - BUILDKITE_PIPELINE_DEFAULT_BRANCH
-      - BUILDKITE_STEP_ID
-      - GITHUB_API_TOKEN
     image: ${BUILDKITE_PLUGIN_DOCKER_IMAGE:-''}
     init: true
     volumes:

package/template/greeter/package.json

@@ -6,7 +6,7 @@
     "format": "skuba format",
     "lint": "skuba lint",
     "start": "skuba start",
-    "start:debug": "yarn start --inspect-brk",
+    "start:debug": "pnpm run --silent start --inspect-brk",
     "test": "skuba test",
     "test:ci": "skuba test --coverage",
     "test:watch": "skuba test --watch"

package/template/greeter/skuba.template.js

@@ -12,5 +12,6 @@ module.exports = {
       validate: (value) => /^.+:.+$/.test(value),
     },
   ],
+  packageManager: 'pnpm',
   type: 'application',
 };

package/template/koa-rest-api/.buildkite/pipeline.yml

@@ -4,15 +4,13 @@ agents:
 configs:
   plugins:
     - &aws-sm
-      seek-oss/aws-sm#v2.3.1:
+      seek-oss/aws-sm#v2.3.2:
         env:
           NPM_READ_TOKEN: arn:aws:secretsmanager:ap-southeast-2:987872074697:secret:npm/npm-read-token
 
     - &docker-ecr-cache
-      seek-oss/docker-ecr-cache#v2.1.0: &docker-ecr-cache-defaults
-        cache-on:
-          - package.json
-          - yarn.lock
+      seek-oss/docker-ecr-cache#v2.1.1: &docker-ecr-cache-defaults
+        cache-on: pnpm-lock.yaml
         dockerfile: Dockerfile.dev-deps
         secrets: id=npm,src=tmp/.npmrc
 
@@ -37,16 +35,18 @@ steps:
     plugins:
       - *aws-sm
       - *private-npm
-      - seek-oss/docker-ecr-cache#v2.1.0:
+      - seek-oss/docker-ecr-cache#v2.1.1:
           <<: *docker-ecr-cache-defaults
           skip-pull-from-cache: true
 
   - label: 🧪 Test & Lint
     commands:
-      - echo '+++ yarn test:ci'
-      - yarn test:ci
-      - echo '--- yarn lint'
-      - yarn lint
+      - echo '--- pnpm install --offline'
+      - pnpm install --offline
+      - echo '+++ pnpm run test:ci'
+      - pnpm run test:ci
+      - echo '--- pnpm run lint'
+      - pnpm run lint
     depends_on: warm-prod
     env:
       GET_GITHUB_TOKEN: please
@@ -56,6 +56,9 @@ steps:
       - *docker-ecr-cache
       - docker-compose#v4.16.0:
           run: app
+          environment:
+            - GITHUB_API_TOKEN
+          propagate-environment: true
     timeout_in_minutes: 10
 
   - label: 📦 Build & Package

package/template/koa-rest-api/.gantry/dev.yml

@@ -7,5 +7,8 @@ isProduction: false
 maxInstanceCount: 1
 minInstanceCount: 1
 
+# Disable dashboard for cost savings
+cloudwatchDashboardDisabled: true
+
 openTelemetry:
   enabled: false

package/template/koa-rest-api/.nvmrc

@@ -1 +1 @@
-18
+20

package/template/koa-rest-api/Dockerfile

@@ -1,29 +1,23 @@
 ARG BASE_IMAGE
-ARG BASE_TAG
 
 ###
 
-FROM ${BASE_IMAGE}:${BASE_TAG} AS deps
-
-RUN yarn install --ignore-optional --ignore-scripts --non-interactive --offline --production
-
-###
-
-FROM ${BASE_IMAGE}:${BASE_TAG} AS build
+FROM ${BASE_IMAGE} AS build
 
 COPY . .
 
-RUN yarn build
+RUN pnpm install --offline
+RUN pnpm run build
+RUN pnpm install --offline --prod
 
 ###
 
-FROM --platform=${BUILDPLATFORM:-<%- platformName %>} gcr.io/distroless/nodejs20-debian11 AS runtime
+FROM --platform=${BUILDPLATFORM:-<%- platformName %>} gcr.io/distroless/nodejs20-debian12 AS runtime
 
 WORKDIR /workdir
 
 COPY --from=build /workdir/lib lib
-
-COPY --from=deps /workdir/node_modules node_modules
+COPY --from=build /workdir/node_modules node_modules
 
 ENV NODE_ENV=production
 

package/template/koa-rest-api/Dockerfile.dev-deps

@@ -2,10 +2,11 @@
 
 FROM --platform=${BUILDPLATFORM:-<%- platformName %>} node:20-alpine AS dev-deps
 
-WORKDIR /workdir
+RUN corepack enable pnpm
+RUN pnpm config set store-dir /root/.pnpm-store
 
-COPY package.json yarn.lock ./
+WORKDIR /workdir
 
-RUN \
-  --mount=type=secret,id=npm,dst=/root/.npmrc \
-  yarn install --frozen-lockfile --ignore-optional --non-interactive
+RUN --mount=type=bind,source=pnpm-lock.yaml,target=pnpm-lock.yaml \
+    --mount=type=secret,id=npm,dst=/root/.npmrc,required=true \
+    pnpm fetch

package/template/koa-rest-api/README.md

@@ -7,7 +7,7 @@ Next steps:
 1. [ ] Finish templating if this was skipped earlier:
 
    ```shell
-   yarn skuba configure
+   pnpm exec skuba configure
    ```
 
 2. [ ] Create a new repository in the appropriate GitHub organisation.
@@ -48,27 +48,27 @@ This defaults to an HTTP request to the `GET /smoke` endpoint.
 ### Test
 
 ```shell
-yarn test
+pnpm run test
 ```
 
 ### Lint
 
 ```shell
 # Fix issues
-yarn format
+pnpm run format
 
 # Check for issues
-yarn lint
+pnpm run lint
 ```
 
 ### Start
 
 ```shell
 # Start a local HTTP server
-yarn start
+pnpm run start
 
 # Start with Node.js Inspector enabled
-yarn start:debug
+pnpm run start:debug
 ```
 
 ### Deploy

package/template/koa-rest-api/docker-compose.yml

@@ -2,16 +2,6 @@ version: '3.7'
 
 services:
   app:
-    environment:
-      # Enable Buildkite + GitHub integrations.
-      - BUILDKITE
-      - BUILDKITE_AGENT_ACCESS_TOKEN
-      - BUILDKITE_BRANCH
-      - BUILDKITE_BUILD_NUMBER
-      - BUILDKITE_JOB_ID
-      - BUILDKITE_PIPELINE_DEFAULT_BRANCH
-      - BUILDKITE_STEP_ID
-      - GITHUB_API_TOKEN
     image: ${BUILDKITE_PLUGIN_DOCKER_IMAGE:-''}
     init: true
     volumes:

package/template/koa-rest-api/gantry.apply.yml

@@ -18,6 +18,10 @@ env:
   {{$key}}: {{$value}}
   {{end}}
 
+{{if .Values.cloudwatchDashboardDisabled}}
+cloudwatchDashboardDisabled: {{values "cloudwatchDashboardDisabled"}}
+{{end}}
+
 {{if .Values.datadogSecretId}}
 datadogSecretId: '{{values "datadogSecretId"}}'
 {{end}}
@@ -125,3 +129,4 @@ tags:
   {{end}}
 
 cpuArchitecture: <%- platformName %>
+readOnlyRootFilesystem: true

package/template/koa-rest-api/gantry.build.yml

@@ -6,8 +6,7 @@ image: '{{values "image"}}'
 
 buildArgs:
   # https://github.com/seek-oss/docker-ecr-cache-buildkite-plugin#building-on-the-resulting-image
-  BASE_IMAGE: '{{.Env.BUILDKITE_PLUGIN_DOCKER_ECR_CACHE_EXPORT_IMAGE}}'
-  BASE_TAG: '{{.Env.BUILDKITE_PLUGIN_DOCKER_ECR_CACHE_EXPORT_TAG}}'
+  BASE_IMAGE: '{{.Env.BUILDKITE_PLUGIN_DOCKER_ECR_CACHE_EXPORT_IMAGE}}:{{.Env.BUILDKITE_PLUGIN_DOCKER_ECR_CACHE_EXPORT_TAG}}'
 
 # SEEK-Jobs/gantry#1661
 failOnScanFindings: false

package/template/koa-rest-api/package.json

@@ -6,7 +6,7 @@
     "format": "skuba format",
     "lint": "skuba lint",
     "start": "skuba start --port <%- port %>",
-    "start:debug": "yarn start --inspect-brk",
+    "start:debug": "pnpm run --silent start --inspect-brk",
     "test": "skuba test",
     "test:ci": "skuba test --coverage",
     "test:watch": "skuba test --watch"
@@ -14,10 +14,12 @@
   "dependencies": {
     "@koa/router": "^12.0.0",
     "@opentelemetry/api": "^1.1.0",
-    "@opentelemetry/exporter-trace-otlp-grpc": "^0.45.0",
-    "@opentelemetry/instrumentation-aws-sdk": "^0.36.0",
-    "@opentelemetry/instrumentation-http": "^0.45.0",
-    "@opentelemetry/sdk-node": "^0.45.0",
+    "@opentelemetry/core": "^1.18.1",
+    "@opentelemetry/exporter-trace-otlp-grpc": "^0.48.0",
+    "@opentelemetry/instrumentation-aws-sdk": "^0.38.0",
+    "@opentelemetry/instrumentation-http": "^0.48.0",
+    "@opentelemetry/propagator-b3": "^1.18.1",
+    "@opentelemetry/sdk-node": "^0.48.0",
     "@seek/logger": "^6.0.0",
     "aws-sdk": "^2.1039.0",
     "hot-shots": "^10.0.0",
@@ -35,7 +37,7 @@
     "@types/koa-bodyparser": "^5.0.2",
     "@types/koa__router": "^12.0.0",
     "@types/node": "^20.9.0",
-    "@types/supertest": "^2.0.11",
+    "@types/supertest": "^6.0.0",
     "chance": "^1.1.8",
     "pino-pretty": "^10.0.0",
     "skuba": "*",

package/template/koa-rest-api/skuba.template.js

@@ -45,5 +45,6 @@ module.exports = {
       validate: (value) => /^[a-z]{2}-[a-z]+-\d+$/.test(value),
     },
   ],
+  packageManager: 'pnpm',
   type: 'application',
 };

package/template/koa-rest-api/src/framework/validation.test.ts

@@ -43,13 +43,15 @@ describe('validate', () => {
       .expect(422)
       .expect(({ body }) =>
         expect(body).toMatchInlineSnapshot(`
-          {
-            "invalidFields": {
-              "/id": "Expected string, received null",
-            },
-            "message": "Input validation failed",
-          }
-        `),
+{
+  "invalidFields": {
+    "~union0/id": "Expected string, received null",
+    "~union1/id": "Expected number, received null",
+    "~union1/summary": "Required",
+  },
+  "message": "Input validation failed",
+}
+`),
       );
   });
 
@@ -60,13 +62,44 @@ describe('validate', () => {
       .expect(422)
       .expect(({ body }) =>
         expect(body).toMatchInlineSnapshot(`
-          {
-            "invalidFields": {
-              "/description": "Required",
-              "/id": "Required",
-            },
-            "message": "Input validation failed",
-          }
-        `),
+{
+  "invalidFields": {
+    "~union0/description~union0": "Required",
+    "~union0/description~union1": "Required",
+    "~union0/id": "Required",
+    "~union1/id": "Required",
+    "~union1/summary": "Required",
+  },
+  "message": "Input validation failed",
+}
+`),
       ));
+
+  it('blocks invalid nested union prop', () => {
+    const idDescription = {
+      ...mockIdDescription(),
+      description: {
+        fontSize: chance.integer(),
+      },
+    };
+
+    return agent
+      .post('/')
+      .send({ ...idDescription, id: null })
+      .expect(422)
+      .expect(({ body }) =>
+        expect(body).toMatchInlineSnapshot(`
+{
+  "invalidFields": {
+    "~union0/description~union0": "Expected string, received object",
+    "~union0/description~union1/content": "Required",
+    "~union0/id": "Expected string, received null",
+    "~union1/id": "Expected number, received null",
+    "~union1/summary": "Required",
+  },
+  "message": "Input validation failed",
+}
+`),
+      );
+  });
 });

package/template/koa-rest-api/src/framework/validation.ts

@@ -1,8 +1,10 @@
 import { ErrorMiddleware } from 'seek-koala';
-import type { z } from 'zod';
+import { ZodIssueCode, type z } from 'zod';
 
 import type { Context } from 'src/types/koa';
 
+type InvalidFields = Record<string, string>;
+
 /**
  * Converts a `ZodError` into an `invalidFields` object
  *
@@ -28,13 +30,33 @@ import type { Context } from 'src/types/koa';
  * ```json
  * { "/advertiserId": "advertiserId is required in the URL" }
  * ```
+ *
+ * For union errors, the path will be appended with `~union${unionIdx}` to indicate which union type failed.
+ * @see [union error example](./validation.test.ts)
  */
-const parseInvalidFieldsFromError = ({
-  errors,
-}: z.ZodError): Record<string, string> =>
-  Object.fromEntries(
-    errors.map((err) => [`/${err.path.join('/')}`, err.message]),
-  );
+const parseInvalidFieldsFromError = (err: z.ZodError): InvalidFields =>
+  Object.fromEntries(parseTuples(err, {}));
+
+const parseTuples = (
+  { errors }: z.ZodError,
+  unions: Record<number, number[]>,
+): Array<readonly [string, string]> =>
+  errors.flatMap((issue) => {
+    if (issue.code === ZodIssueCode.invalid_union) {
+      return issue.unionErrors.flatMap((err, idx) =>
+        parseTuples(err, {
+          ...unions,
+          [issue.path.length]: [...(unions[issue.path.length] ?? []), idx],
+        }),
+      );
+    }
+
+    const path = ['', ...issue.path]
+      .map((prop, idx) => [prop, ...(unions[idx] ?? [])].join('~union'))
+      .join('/');
+
+    return [[path, issue.message]] as const;
+  });
 
 export const validate = <
   Output,
@@ -51,11 +73,12 @@ export const validate = <
 }): Output => {
   const parseResult = schema.safeParse(input);
   if (parseResult.success === false) {
+    const invalidFields = parseInvalidFieldsFromError(parseResult.error);
     return ctx.throw(
       422,
       new ErrorMiddleware.JsonResponse('Input validation failed', {
         message: 'Input validation failed',
-        invalidFields: parseInvalidFieldsFromError(parseResult.error),
+        invalidFields,
       }),
     );
   }

package/template/koa-rest-api/src/testing/types.ts

@@ -5,10 +5,22 @@ import type { JobInput } from 'src/types/jobs';
 
 export type IdDescription = z.infer<typeof IdDescriptionSchema>;
 
-export const IdDescriptionSchema = z.object({
-  id: z.string(),
-  description: z.string(),
-});
+export const IdDescriptionSchema = z.union([
+  z.object({
+    id: z.string(),
+    description: z.union([
+      z.string(),
+      z.object({
+        fontSize: z.number(),
+        content: z.string(),
+      }),
+    ]),
+  }),
+  z.object({
+    id: z.number(),
+    summary: z.string(),
+  }),
+]);
 
 export const chance = new Chance();