takos-runtime-service 1.0.0

package/src/__tests__/runtime/action-result-helpers.test.ts

@@ -0,0 +1,129 @@
+import { describe, expect, it } from 'vitest';
+import { appendOutput, buildCombinedResult } from '../../runtime/actions/action-result-converter.js';
+
+// ---------------------------------------------------------------------------
+// appendOutput
+// ---------------------------------------------------------------------------
+
+describe('appendOutput', () => {
+  it('appends stdout and stderr', () => {
+    const stdoutParts: string[] = [];
+    const stderrParts: string[] = [];
+
+    appendOutput(
+      { exitCode: 0, stdout: 'out1', stderr: 'err1', outputs: {}, conclusion: 'success' },
+      stdoutParts,
+      stderrParts,
+    );
+
+    expect(stdoutParts).toEqual(['out1']);
+    expect(stderrParts).toEqual(['err1']);
+  });
+
+  it('skips empty stdout', () => {
+    const stdoutParts: string[] = [];
+    const stderrParts: string[] = [];
+
+    appendOutput(
+      { exitCode: 0, stdout: '', stderr: 'err', outputs: {}, conclusion: 'success' },
+      stdoutParts,
+      stderrParts,
+    );
+
+    expect(stdoutParts).toEqual([]);
+    expect(stderrParts).toEqual(['err']);
+  });
+
+  it('skips empty stderr', () => {
+    const stdoutParts: string[] = [];
+    const stderrParts: string[] = [];
+
+    appendOutput(
+      { exitCode: 0, stdout: 'out', stderr: '', outputs: {}, conclusion: 'success' },
+      stdoutParts,
+      stderrParts,
+    );
+
+    expect(stdoutParts).toEqual(['out']);
+    expect(stderrParts).toEqual([]);
+  });
+
+  it('accumulates multiple results', () => {
+    const stdoutParts: string[] = [];
+    const stderrParts: string[] = [];
+
+    appendOutput(
+      { exitCode: 0, stdout: 'out1', stderr: 'err1', outputs: {}, conclusion: 'success' },
+      stdoutParts,
+      stderrParts,
+    );
+    appendOutput(
+      { exitCode: 0, stdout: 'out2', stderr: 'err2', outputs: {}, conclusion: 'success' },
+      stdoutParts,
+      stderrParts,
+    );
+
+    expect(stdoutParts).toEqual(['out1', 'out2']);
+    expect(stderrParts).toEqual(['err1', 'err2']);
+  });
+
+  it('handles undefined stdout/stderr', () => {
+    const stdoutParts: string[] = [];
+    const stderrParts: string[] = [];
+
+    appendOutput(
+      { exitCode: 0, stdout: undefined as any, stderr: undefined as any, outputs: {}, conclusion: 'success' },
+      stdoutParts,
+      stderrParts,
+    );
+
+    expect(stdoutParts).toEqual([]);
+    expect(stderrParts).toEqual([]);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// buildCombinedResult
+// ---------------------------------------------------------------------------
+
+describe('buildCombinedResult', () => {
+  it('builds success result', () => {
+    const result = buildCombinedResult(
+      ['out1', 'out2'],
+      ['err1'],
+      { key: 'value' },
+      'success',
+    );
+
+    expect(result).toEqual({
+      exitCode: 0,
+      stdout: 'out1\nout2',
+      stderr: 'err1',
+      outputs: { key: 'value' },
+      conclusion: 'success',
+    });
+  });
+
+  it('builds failure result with exit code 1', () => {
+    const result = buildCombinedResult([], [], {}, 'failure');
+    expect(result.exitCode).toBe(1);
+    expect(result.conclusion).toBe('failure');
+  });
+
+  it('trims trailing whitespace from joined output', () => {
+    const result = buildCombinedResult(['line1  ', 'line2  '], [], {}, 'success');
+    expect(result.stdout).toBe('line1  \nline2');
+  });
+
+  it('handles empty arrays', () => {
+    const result = buildCombinedResult([], [], {}, 'success');
+    expect(result.stdout).toBe('');
+    expect(result.stderr).toBe('');
+  });
+
+  it('preserves outputs object', () => {
+    const outputs = { a: '1', b: '2' };
+    const result = buildCombinedResult([], [], outputs, 'success');
+    expect(result.outputs).toEqual({ a: '1', b: '2' });
+  });
+});

package/src/__tests__/runtime/actions/executor.test.ts

@@ -0,0 +1,131 @@
+import * as fs from 'fs/promises';
+import * as os from 'os';
+import path from 'path';
+import { describe, expect, it, vi } from 'vitest';
+
+vi.mock('../../../runtime/actions/sandbox.js', () => ({
+  validateCommand: vi.fn(() => null),
+}));
+
+vi.mock('../../../runtime/actions/builtin/index.js', () => ({
+  checkout: vi.fn(),
+  setupNode: vi.fn(),
+  cache: vi.fn(),
+  uploadArtifact: vi.fn(),
+  downloadArtifact: vi.fn(),
+}));
+
+vi.mock('../../../shared/config.js', () => ({
+  REPOS_BASE_DIR: '/tmp/takos-runtime-test-repos',
+  WORKDIR_BASE_DIR: '/tmp',
+  MAX_LOG_LINES: 100_000,
+  ALLOWED_COMMANDS_SET: new Set(['node', 'npm', 'git', 'bash', 'sh', 'echo', 'ls', 'cat']),
+  COMMAND_BLOCKLIST_PATTERNS: [],
+  MAX_CONCURRENT_EXEC_PER_WORKSPACE: 5,
+  GIT_ENDPOINT_URL: 'https://git.takos.dev',
+  TAKOS_API_URL: 'https://test.takos.jp',
+  HEARTBEAT_INTERVAL_MS: 30_000,
+  R2_BUCKET: 'test-bucket',
+  SANDBOX_LIMITS: {
+    maxExecutionTime: 30_000,
+    maxOutputSize: 1024 * 1024,
+  },
+}));
+
+import { StepExecutor } from '../../../runtime/actions/executor.js';
+
+async function createTempDir(prefix: string): Promise<string> {
+  return fs.mkdtemp(path.join(os.tmpdir(), prefix));
+}
+
+async function writeCompositeAction(actionDir: string, workingDirectory: string): Promise<void> {
+  const actionContent = `name: test-action
+runs:
+  using: composite
+  steps:
+    - run: echo hello
+      working-directory: ${workingDirectory}
+`;
+  await fs.mkdir(actionDir, { recursive: true });
+  await fs.writeFile(path.join(actionDir, 'action.yml'), actionContent, 'utf-8');
+}
+
+async function writeNodeAction(actionDir: string, main: string): Promise<void> {
+  const actionContent = `name: test-node-action
+runs:
+  using: node20
+  main: ${main}
+`;
+  await fs.mkdir(actionDir, { recursive: true });
+  await fs.writeFile(path.join(actionDir, 'action.yml'), actionContent, 'utf-8');
+}
+
+describe('StepExecutor composite working-directory boundary checks', () => {
+  it('fails when working-directory symlink resolves outside workspace/action boundary', async () => {
+    const workspaceDir = await createTempDir('takos-executor-ws-');
+    const outsideDir = await createTempDir('takos-executor-outside-');
+    const actionDir = path.join(workspaceDir, 'action');
+    const escapeLink = path.join(workspaceDir, 'escape-link');
+
+    try {
+      await fs.symlink(outsideDir, escapeLink);
+      await writeCompositeAction(actionDir, 'escape-link');
+
+      const executor = new StepExecutor(workspaceDir, { PATH: process.env.PATH || '' });
+      const result = await executor.executeAction('./action', {});
+
+      expect(result.conclusion).toBe('failure');
+      expect(result.stderr).toContain('Invalid working directory');
+    } finally {
+      await fs.rm(workspaceDir, { recursive: true, force: true });
+      await fs.rm(outsideDir, { recursive: true, force: true });
+    }
+  });
+
+  it('allows symlinked working-directory when the resolved path stays inside workspace', async () => {
+    const workspaceDir = await createTempDir('takos-executor-safe-ws-');
+    const actionDir = path.join(workspaceDir, 'action');
+    const safeTargetDir = path.join(workspaceDir, 'safe-target');
+    const safeLink = path.join(workspaceDir, 'safe-link');
+
+    try {
+      await fs.mkdir(safeTargetDir, { recursive: true });
+      await fs.symlink(safeTargetDir, safeLink);
+      await writeCompositeAction(actionDir, 'safe-link');
+
+      const executor = new StepExecutor(workspaceDir, { PATH: process.env.PATH || '' });
+      const result = await executor.executeAction('./action', {});
+
+      expect(result.conclusion).toBe('success');
+      expect(result.exitCode).toBe(0);
+    } finally {
+      await fs.rm(workspaceDir, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('StepExecutor node action script boundary checks', () => {
+  it('fails when the main script symlink resolves outside action directory', async () => {
+    const workspaceDir = await createTempDir('takos-executor-node-ws-');
+    const outsideDir = await createTempDir('takos-executor-node-outside-');
+    const actionDir = path.join(workspaceDir, 'action');
+    const outsideScript = path.join(outsideDir, 'main.js');
+    const scriptLink = path.join(actionDir, 'main.js');
+
+    try {
+      await fs.mkdir(actionDir, { recursive: true });
+      await fs.writeFile(outsideScript, 'console.log("outside");\n', 'utf-8');
+      await fs.symlink(outsideScript, scriptLink);
+      await writeNodeAction(actionDir, 'main.js');
+
+      const executor = new StepExecutor(workspaceDir, { PATH: process.env.PATH || '' });
+      const result = await executor.executeAction('./action', {});
+
+      expect(result.conclusion).toBe('failure');
+      expect(result.stderr).toContain('Node action main script escapes action directory');
+    } finally {
+      await fs.rm(workspaceDir, { recursive: true, force: true });
+      await fs.rm(outsideDir, { recursive: true, force: true });
+    }
+  });
+});

package/src/__tests__/runtime/composite-expression.test.ts

@@ -0,0 +1,294 @@
+import { describe, expect, it } from 'vitest';
+import {
+  resolveExpressionValue,
+  interpolateString,
+  evaluateCondition,
+  normalizeInputValue,
+  resolveEnv,
+  resolveWith,
+  resolveCompositeOutputs,
+  type InterpolationContext,
+} from '../../runtime/actions/composite-expression.js';
+
+function makeContext(overrides: Partial<InterpolationContext> = {}): InterpolationContext {
+  return {
+    inputs: { name: 'world', debug: 'true' },
+    env: {
+      CI: 'true',
+      GITHUB_WORKSPACE: '/home/runner/work',
+      GITHUB_REF: 'refs/heads/main',
+      GITHUB_SHA: 'abc123',
+    },
+    steps: {
+      build: { status: 'success', output: 'built' },
+    },
+    jobStatus: 'success',
+    ...overrides,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// resolveExpressionValue
+// ---------------------------------------------------------------------------
+
+describe('resolveExpressionValue', () => {
+  it('resolves "true" literal', () => {
+    expect(resolveExpressionValue('true', makeContext())).toBe('true');
+  });
+
+  it('resolves "false" literal', () => {
+    expect(resolveExpressionValue('false', makeContext())).toBe('false');
+  });
+
+  it('resolves inputs', () => {
+    expect(resolveExpressionValue('inputs.name', makeContext())).toBe('world');
+  });
+
+  it('returns empty string for missing input', () => {
+    expect(resolveExpressionValue('inputs.missing', makeContext())).toBe('');
+  });
+
+  it('resolves env values', () => {
+    expect(resolveExpressionValue('env.CI', makeContext())).toBe('true');
+  });
+
+  it('returns empty string for missing env', () => {
+    expect(resolveExpressionValue('env.MISSING', makeContext())).toBe('');
+  });
+
+  it('resolves step outputs', () => {
+    expect(resolveExpressionValue('steps.build.outputs.output', makeContext())).toBe('built');
+  });
+
+  it('returns empty string for missing step', () => {
+    expect(resolveExpressionValue('steps.missing.outputs.x', makeContext())).toBe('');
+  });
+
+  it('resolves github.workspace', () => {
+    expect(resolveExpressionValue('github.workspace', makeContext())).toBe('/home/runner/work');
+  });
+
+  it('resolves github.ref', () => {
+    expect(resolveExpressionValue('github.ref', makeContext())).toBe('refs/heads/main');
+  });
+
+  it('resolves github.sha', () => {
+    expect(resolveExpressionValue('github.sha', makeContext())).toBe('abc123');
+  });
+
+  it('returns undefined for unknown github context key', () => {
+    expect(resolveExpressionValue('github.unknown', makeContext())).toBeUndefined();
+  });
+
+  it('returns undefined for unknown expression prefix', () => {
+    expect(resolveExpressionValue('unknown.value', makeContext())).toBeUndefined();
+  });
+});
+
+// ---------------------------------------------------------------------------
+// interpolateString
+// ---------------------------------------------------------------------------
+
+describe('interpolateString', () => {
+  it('interpolates input references', () => {
+    expect(interpolateString('Hello ${{ inputs.name }}!', makeContext())).toBe('Hello world!');
+  });
+
+  it('interpolates env references', () => {
+    expect(interpolateString('CI=${{ env.CI }}', makeContext())).toBe('CI=true');
+  });
+
+  it('replaces unknown expressions with empty string', () => {
+    expect(interpolateString('${{ unknown.ref }}', makeContext())).toBe('');
+  });
+
+  it('handles multiple expressions', () => {
+    expect(
+      interpolateString('${{ inputs.name }} on ${{ github.ref }}', makeContext()),
+    ).toBe('world on refs/heads/main');
+  });
+
+  it('returns original string with no expressions', () => {
+    expect(interpolateString('no expressions here', makeContext())).toBe('no expressions here');
+  });
+
+  it('handles whitespace in expressions', () => {
+    expect(interpolateString('${{  inputs.name  }}', makeContext())).toBe('world');
+  });
+
+  it('handles step output references', () => {
+    expect(
+      interpolateString('result=${{ steps.build.outputs.output }}', makeContext()),
+    ).toBe('result=built');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// evaluateCondition
+// ---------------------------------------------------------------------------
+
+describe('evaluateCondition', () => {
+  it('returns true for empty condition', () => {
+    expect(evaluateCondition('', makeContext())).toBe(true);
+  });
+
+  it('evaluates always() as true', () => {
+    expect(evaluateCondition('always()', makeContext())).toBe(true);
+  });
+
+  it('evaluates cancelled() as false', () => {
+    expect(evaluateCondition('cancelled()', makeContext())).toBe(false);
+  });
+
+  it('evaluates success() as true when jobStatus is success', () => {
+    expect(evaluateCondition('success()', makeContext({ jobStatus: 'success' }))).toBe(true);
+  });
+
+  it('evaluates success() as false when jobStatus is failure', () => {
+    expect(evaluateCondition('success()', makeContext({ jobStatus: 'failure' }))).toBe(false);
+  });
+
+  it('evaluates failure() as true when jobStatus is failure', () => {
+    expect(evaluateCondition('failure()', makeContext({ jobStatus: 'failure' }))).toBe(true);
+  });
+
+  it('evaluates failure() as false when jobStatus is success', () => {
+    expect(evaluateCondition('failure()', makeContext({ jobStatus: 'success' }))).toBe(false);
+  });
+
+  it('evaluates negation', () => {
+    expect(evaluateCondition('!failure()', makeContext({ jobStatus: 'success' }))).toBe(true);
+    expect(evaluateCondition('!failure()', makeContext({ jobStatus: 'failure' }))).toBe(false);
+  });
+
+  it('evaluates equality comparison', () => {
+    expect(evaluateCondition("inputs.debug == 'true'", makeContext())).toBe(true);
+    expect(evaluateCondition("inputs.debug == 'false'", makeContext())).toBe(false);
+  });
+
+  it('evaluates inequality comparison', () => {
+    expect(evaluateCondition("inputs.debug != 'false'", makeContext())).toBe(true);
+    expect(evaluateCondition("inputs.debug != 'true'", makeContext())).toBe(false);
+  });
+
+  it('strips ${{ }} wrapper from condition', () => {
+    expect(evaluateCondition('${{ always() }}', makeContext())).toBe(true);
+  });
+
+  it('evaluates truthy expression value', () => {
+    expect(evaluateCondition('inputs.name', makeContext())).toBe(true);
+  });
+
+  it('evaluates falsy expression value', () => {
+    expect(evaluateCondition('inputs.missing', makeContext())).toBe(false);
+  });
+
+  it('handles comparison with double quotes', () => {
+    expect(evaluateCondition('inputs.name == "world"', makeContext())).toBe(true);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// normalizeInputValue
+// ---------------------------------------------------------------------------
+
+describe('normalizeInputValue', () => {
+  it('converts null to empty string', () => {
+    expect(normalizeInputValue(null)).toBe('');
+  });
+
+  it('converts undefined to empty string', () => {
+    expect(normalizeInputValue(undefined)).toBe('');
+  });
+
+  it('converts true to "true"', () => {
+    expect(normalizeInputValue(true)).toBe('true');
+  });
+
+  it('converts false to "false"', () => {
+    expect(normalizeInputValue(false)).toBe('false');
+  });
+
+  it('converts number to string', () => {
+    expect(normalizeInputValue(42)).toBe('42');
+  });
+
+  it('passes string through', () => {
+    expect(normalizeInputValue('hello')).toBe('hello');
+  });
+});
+
+// ---------------------------------------------------------------------------
+// resolveEnv
+// ---------------------------------------------------------------------------
+
+describe('resolveEnv', () => {
+  it('returns empty object for undefined env', () => {
+    expect(resolveEnv(undefined, makeContext())).toEqual({});
+  });
+
+  it('interpolates string values', () => {
+    const result = resolveEnv({ MY_VAR: '${{ inputs.name }}' }, makeContext());
+    expect(result).toEqual({ MY_VAR: 'world' });
+  });
+
+  it('passes non-expression strings through', () => {
+    const result = resolveEnv({ STATIC: 'value' }, makeContext());
+    expect(result).toEqual({ STATIC: 'value' });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// resolveWith
+// ---------------------------------------------------------------------------
+
+describe('resolveWith', () => {
+  it('returns empty object for undefined input', () => {
+    expect(resolveWith(undefined, makeContext())).toEqual({});
+  });
+
+  it('interpolates string values', () => {
+    const result = resolveWith({ name: '${{ inputs.name }}' }, makeContext());
+    expect(result).toEqual({ name: 'world' });
+  });
+
+  it('passes non-string values through', () => {
+    const result = resolveWith({ count: 42 as any }, makeContext());
+    expect(result).toEqual({ count: 42 });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// resolveCompositeOutputs
+// ---------------------------------------------------------------------------
+
+describe('resolveCompositeOutputs', () => {
+  it('returns empty object for undefined outputs', () => {
+    expect(resolveCompositeOutputs(undefined, makeContext())).toEqual({});
+  });
+
+  it('interpolates output values', () => {
+    const outputs = {
+      result: { value: '${{ steps.build.outputs.output }}' },
+    };
+    const result = resolveCompositeOutputs(outputs, makeContext());
+    expect(result).toEqual({ result: 'built' });
+  });
+
+  it('skips outputs without value', () => {
+    const outputs = {
+      noValue: { description: 'No value set' },
+    };
+    const result = resolveCompositeOutputs(outputs, makeContext());
+    expect(result).toEqual({});
+  });
+
+  it('handles multiple outputs', () => {
+    const outputs = {
+      a: { value: '${{ inputs.name }}' },
+      b: { value: 'static' },
+    };
+    const result = resolveCompositeOutputs(outputs, makeContext());
+    expect(result).toEqual({ a: 'world', b: 'static' });
+  });
+});

package/src/__tests__/runtime/file-parsers.test.ts

@@ -0,0 +1,129 @@
+import { describe, expect, it } from 'vitest';
+import { parseKeyValueFile, parsePathFile } from '../../runtime/actions/file-parsers.js';
+
+// ---------------------------------------------------------------------------
+// parseKeyValueFile
+// ---------------------------------------------------------------------------
+
+describe('parseKeyValueFile', () => {
+  it('parses simple key=value pairs', () => {
+    expect(parseKeyValueFile('KEY=value')).toEqual({ KEY: 'value' });
+  });
+
+  it('parses multiple key=value pairs', () => {
+    const content = 'KEY1=value1\nKEY2=value2\nKEY3=value3';
+    expect(parseKeyValueFile(content)).toEqual({
+      KEY1: 'value1',
+      KEY2: 'value2',
+      KEY3: 'value3',
+    });
+  });
+
+  it('handles empty value', () => {
+    expect(parseKeyValueFile('KEY=')).toEqual({ KEY: '' });
+  });
+
+  it('handles value containing equals sign', () => {
+    expect(parseKeyValueFile('KEY=a=b=c')).toEqual({ KEY: 'a=b=c' });
+  });
+
+  it('handles heredoc format', () => {
+    const content = 'OUTPUT<<EOF\nline1\nline2\nEOF';
+    expect(parseKeyValueFile(content)).toEqual({ OUTPUT: 'line1\nline2' });
+  });
+
+  it('handles heredoc with custom delimiter', () => {
+    const content = 'DATA<<DELIM\ncontent here\nDELIM';
+    expect(parseKeyValueFile(content)).toEqual({ DATA: 'content here' });
+  });
+
+  it('handles empty heredoc', () => {
+    const content = 'EMPTY<<EOF\nEOF';
+    expect(parseKeyValueFile(content)).toEqual({ EMPTY: '' });
+  });
+
+  it('handles CRLF line endings', () => {
+    const content = 'KEY1=value1\r\nKEY2=value2';
+    expect(parseKeyValueFile(content)).toEqual({
+      KEY1: 'value1',
+      KEY2: 'value2',
+    });
+  });
+
+  it('skips empty lines', () => {
+    const content = 'KEY1=value1\n\n\nKEY2=value2';
+    expect(parseKeyValueFile(content)).toEqual({
+      KEY1: 'value1',
+      KEY2: 'value2',
+    });
+  });
+
+  it('skips lines without equals sign', () => {
+    const content = 'noequals\nKEY=value';
+    expect(parseKeyValueFile(content)).toEqual({ KEY: 'value' });
+  });
+
+  it('handles mixed heredoc and regular entries', () => {
+    const content = 'SIMPLE=val\nHERE<<EOF\nmulti\nline\nEOF\nAFTER=done';
+    expect(parseKeyValueFile(content)).toEqual({
+      SIMPLE: 'val',
+      HERE: 'multi\nline',
+      AFTER: 'done',
+    });
+  });
+
+  it('handles empty input', () => {
+    expect(parseKeyValueFile('')).toEqual({});
+  });
+
+  it('last value wins for duplicate keys', () => {
+    const content = 'KEY=first\nKEY=second';
+    expect(parseKeyValueFile(content)).toEqual({ KEY: 'second' });
+  });
+});
+
+// ---------------------------------------------------------------------------
+// parsePathFile
+// ---------------------------------------------------------------------------
+
+describe('parsePathFile', () => {
+  it('parses path entries', () => {
+    expect(parsePathFile('/usr/bin\n/home/user/.local/bin')).toEqual([
+      '/usr/bin',
+      '/home/user/.local/bin',
+    ]);
+  });
+
+  it('trims whitespace', () => {
+    expect(parsePathFile('  /usr/bin  \n  /home/bin  ')).toEqual([
+      '/usr/bin',
+      '/home/bin',
+    ]);
+  });
+
+  it('filters empty lines', () => {
+    expect(parsePathFile('/usr/bin\n\n\n/home/bin\n')).toEqual([
+      '/usr/bin',
+      '/home/bin',
+    ]);
+  });
+
+  it('handles CRLF line endings', () => {
+    expect(parsePathFile('/usr/bin\r\n/home/bin')).toEqual([
+      '/usr/bin',
+      '/home/bin',
+    ]);
+  });
+
+  it('returns empty array for empty input', () => {
+    expect(parsePathFile('')).toEqual([]);
+  });
+
+  it('returns empty array for whitespace-only input', () => {
+    expect(parsePathFile('   \n   \n   ')).toEqual([]);
+  });
+
+  it('handles single path entry', () => {
+    expect(parsePathFile('/single/path')).toEqual(['/single/path']);
+  });
+});