vouchington-tooling 0.0.14 → 0.0.16

package/scripts/gha/check-cache-size.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "${#}" -ne 3 ]; then
+  echo "usage: check-cache-size.sh <path> <max-bytes> <label>" >&2
+  exit 2
+fi
+
+if [ -z "${GITHUB_OUTPUT:-}" ]; then
+  echo 'GITHUB_OUTPUT must be set' >&2
+  exit 2
+fi
+
+CACHE_PATH="$1"
+CACHE_SAVE_MAX_BYTES="$2"
+CACHE_LABEL="$3"
+
+if ! [[ "$CACHE_SAVE_MAX_BYTES" =~ ^[1-9][0-9]*$ ]]; then
+  echo "::error::max-bytes must be a positive integer, got: '$CACHE_SAVE_MAX_BYTES'"
+  exit 1
+fi
+
+if [ ! -e "$CACHE_PATH" ]; then
+  bytes=0
+  echo "bytes=$bytes" >> "$GITHUB_OUTPUT"
+  echo "save=false" >> "$GITHUB_OUTPUT"
+  echo "::notice::Skipping ${CACHE_LABEL} cache save because ${CACHE_PATH} does not exist."
+  exit 0
+fi
+
+bytes=$(du -sk "$CACHE_PATH" | awk '{printf "%.0f", $1 * 1024}')
+echo "bytes=$bytes" >> "$GITHUB_OUTPUT"
+if [ "$bytes" -gt "$CACHE_SAVE_MAX_BYTES" ]; then
+  echo "save=false" >> "$GITHUB_OUTPUT"
+  echo "::notice::Skipping ${CACHE_LABEL} cache save because ${CACHE_PATH} is ${bytes} bytes (> ${CACHE_SAVE_MAX_BYTES})."
+else
+  echo "save=true" >> "$GITHUB_OUTPUT"
+fi

package/scripts/gha/clean-workspace.sh

@@ -0,0 +1,227 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+EXTRA_KEEP="${EXTRA_KEEP:-}"
+EVENT_NAME="${EVENT_NAME:-${GITHUB_EVENT_NAME:-}}"
+HEAD_REPO="${HEAD_REPO:-}"
+BASE_REPO="${BASE_REPO:-${GITHUB_REPOSITORY:-}}"
+PRESERVE_NODE_MODULES="${PRESERVE_NODE_MODULES:-true}"
+PR_AUTHOR="${PR_AUTHOR:-}"
+DEEPEN="${DEEPEN:-false}"
+BASE_REF="${BASE_REF:-main}"
+GENERATED_REPAIR_PATHS="${GENERATED_REPAIR_PATHS:-}"
+
+read_pull_request_field() {
+  local field="$1"
+  [ -n "${GITHUB_EVENT_PATH:-}" ] && [ -f "${GITHUB_EVENT_PATH}" ] || return 0
+  node --input-type=module -e '
+    import { readFileSync } from "node:fs"
+    const event = JSON.parse(readFileSync(process.argv[1], "utf8"))
+    const value =
+      process.argv[2] === "head"
+        ? event.pull_request?.head?.repo?.full_name
+        : event.pull_request?.user?.login
+    process.stdout.write(value == null ? "" : String(value))
+  ' "${GITHUB_EVENT_PATH}" "${field}" 2>/dev/null || true
+}
+
+if [ -z "${HEAD_REPO}" ]; then
+  HEAD_REPO="$(read_pull_request_field head)"
+fi
+if [ -z "${PR_AUTHOR}" ]; then
+  PR_AUTHOR="$(read_pull_request_field author)"
+fi
+
+restore_user_directory_write_bits() {
+  local path
+  for path in "$@"; do
+    if [ -e "${path}" ]; then
+      if find -P "${path}" -xdev -type d -exec chmod u+rwx {} +; then
+        continue
+      fi
+      if command -v sudo >/dev/null 2>&1 && sudo -n true 2>/dev/null; then
+        sudo -n find -P "${path}" -xdev -type d -exec chown -h "$(id -u):$(id -g)" {} + ||
+          echo "::warning::Could not reclaim directory ownership under ${path}; retrying chmod without ownership repair."
+        find -P "${path}" -xdev -type d -exec chmod u+rwx {} + ||
+          echo "::warning::Could not restore user directory write bits under ${path} after reclaiming ownership; cleanup may fail if stale directories remain locked down."
+      else
+        echo "::warning::Could not restore user directory write bits under ${path}; cleanup may fail if stale directories remain locked down."
+      fi
+    fi
+  done
+}
+restore_workspace_write_bits() {
+  if command -v sudo >/dev/null 2>&1 && sudo -n true 2>/dev/null; then
+    sudo -n find -P . -xdev -path ./.git -prune -o -type d -exec chown -h "$(id -u):$(id -g)" {} +
+  fi
+  find -P . -xdev -path ./.git -prune -o -type d -exec chmod u+rwx {} +
+}
+
+workspace_sentinel_key() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    sha256sum | awk '{print $1}'
+    return
+  fi
+  shasum -a 256 | awk '{print $1}'
+}
+
+if ! git reset --hard HEAD; then
+  echo "::warning::git reset --hard failed; reclaiming workspace write bits and retrying once."
+  restore_workspace_write_bits ||
+    echo "::warning::Could not restore workspace write bits completely; retrying git reset with the repaired subset."
+  git reset --hard HEAD
+fi
+excludes=()
+# Trust-gate: a fork pull request is the only untrusted case.
+# `HEAD_REPO` is non-empty only on `pull_request` events; a
+# mismatch with `BASE_REPO` means the PR came from a fork. Every
+# other event (push, schedule, workflow_dispatch,
+# pull_request_target, same-repo pull_request, future events like
+# merge_group) is trusted and preserves `node_modules` only when
+# PRESERVE_NODE_MODULES is true, plus
+# `extra-keep` so self-hosted installs can relink from the local
+# pnpm store without downloading packages again. Fork PRs get a full clean so
+# an untrusted contributor cannot leave modified package binaries
+# that a later trusted run executes via `pnpm exec` with elevated
+# permissions.
+# Note: in reusable workflows triggered via `workflow_call`,
+# `github.event_name` evaluates against the *caller's* event — so
+# the trust-gate applies uniformly to direct and reusable workflows.
+is_fork_pr=false
+if [ "${EVENT_NAME}" = "pull_request" ] && {
+  [ -z "${HEAD_REPO}" ] || [ "${HEAD_REPO}" != "${BASE_REPO}" ]
+}; then
+  is_fork_pr=true
+fi
+is_dependabot_pr=false
+if [ "${EVENT_NAME}" = "pull_request" ] && [ "${PR_AUTHOR:-}" = "dependabot[bot]" ]; then
+  is_dependabot_pr=true
+fi
+# Contamination sentinel: fork PRs share the persistent runner's
+# workspace with subsequent trusted jobs. A fork PR's code runs
+# after the initial full clean and can replace binaries in
+# node_modules. The sentinel (written outside the workspace so
+# git clean cannot remove it) tells the next run to force-clean
+# regardless of its trust level, then removes itself. Keyed on the
+# workspace path so multiple repos on the same runner don't
+# interfere.
+_ws_key="$(printf '%s' "${GITHUB_WORKSPACE:-$(pwd)}" | workspace_sentinel_key)"
+SENTINEL="${RUNNER_TOOL_CACHE:-${HOME}}/.cw-fork-pr-${_ws_key}"
+if [ -f "${SENTINEL}" ]; then
+  rm -f "${SENTINEL}"
+  is_fork_pr=true
+fi
+if [ "${is_fork_pr}" = "false" ] && [ "${is_dependabot_pr}" = "false" ]; then
+  if [ "${PRESERVE_NODE_MODULES:-true}" = "true" ]; then
+    excludes+=(-e node_modules)
+  fi
+  excludes+=(-e .cache)
+  if [ -n "${EXTRA_KEEP}" ]; then
+    # Disable globbing so patterns like `dist/*` are passed literally
+    # to `git clean -e` rather than being expanded by the shell
+    # against the current working tree.
+    set -f
+    for pattern in ${EXTRA_KEEP}; do
+      excludes+=(-e "${pattern}")
+    done
+    set +f
+  fi
+fi
+generated_repair_paths=()
+if [ -n "${RUNNER_TEMP:-}" ]; then
+  generated_repair_paths+=("${RUNNER_TEMP}/wrangler-logs")
+fi
+if [ -n "${GENERATED_REPAIR_PATHS}" ]; then
+  set -f
+  for pattern in ${GENERATED_REPAIR_PATHS}; do
+    generated_repair_paths+=("${pattern}")
+  done
+  set +f
+fi
+while IFS= read -r path; do
+  generated_repair_paths+=("${path}")
+done < <(find -P . -xdev -path ./.git -prune -o -type d -name node_modules -print -prune)
+if [ "${#generated_repair_paths[@]}" -gt 0 ]; then
+  restore_user_directory_write_bits "${generated_repair_paths[@]}"
+fi
+# Bash 3.2 on macOS treats an empty array expansion as unbound under
+# `set -u`; use the safe expansion form so fork-PR runs can
+# full-clean with no excludes.
+if ! git clean -ffdx "${excludes[@]+"${excludes[@]}"}"; then
+  echo "::warning::git clean failed after targeted repair; reclaiming workspace write bits and retrying once."
+  restore_workspace_write_bits ||
+    echo "::warning::Could not restore workspace write bits completely; retrying git clean with the repaired subset."
+  git clean -ffdx "${excludes[@]+"${excludes[@]}"}"
+fi
+# Runs that preserve node_modules retain them for install speed.
+# Drop TypeScript incremental build info inside those preserved trees
+# so stale virtual-store paths do not survive dependency graph changes.
+while IFS= read -r cache_dir; do
+  rm -rf "${cache_dir}/tsbuildinfo"* "${cache_dir}"/*.tsbuildinfo
+done < <(find -P . -xdev -path ./.git -prune -o -type d -path '*/node_modules/.cache' -print 2>/dev/null || true)
+# Write the sentinel after the fork PR's full clean. The next run on
+# this persistent runner will see it, force-clean, and remove it. Use
+# the raw event test (not the sentinel-overridden is_fork_pr) so a
+# trusted job that consumed the sentinel does not re-write it.
+if [ "${EVENT_NAME}" = "pull_request" ] && {
+  [ -z "${HEAD_REPO}" ] || [ "${HEAD_REPO}" != "${BASE_REPO}" ]
+}; then
+  touch "${SENTINEL}" || echo "::warning::Could not write contamination sentinel to ${SENTINEL}; the next trusted run on this persistent runner may not force-clean node_modules."
+fi
+if [ "${DEEPEN}" = "true" ]; then
+  # Self-hosted runners occasionally see transient libcurl Recv
+  # failures or stuck git-remote-https children against github.com.
+  # Bound each fetch attempt so the retry loop gets control back
+  # before the composite action's step timeout kills the whole step.
+  fetch_git_config=(-c http.lowSpeedLimit=1000 -c http.lowSpeedTime=30)
+  if [ -n "${GITHUB_TOKEN:-}" ]; then
+    fetch_git_config+=(
+      -c 'credential.helper=!f() { printf "username=x-access-token\npassword=%s\n" "${GITHUB_TOKEN}"; }; f'
+    )
+  fi
+  git_fetch_once() {
+    local timeout_seconds=25
+    if command -v timeout >/dev/null 2>&1; then
+      timeout --kill-after=5s "${timeout_seconds}s" git "${fetch_git_config[@]}" fetch "$@"
+      return $?
+    fi
+    if command -v perl >/dev/null 2>&1; then
+      perl -e 'my $t = shift @ARGV; my $pid = fork(); if (!defined $pid) { exit 125; } if ($pid == 0) { setpgrp(0, 0); exec @ARGV; exit 127; } local $SIG{ALRM} = sub { kill(15, -$pid); for (1..50) { last if waitpid($pid, 1) == $pid; select undef, undef, undef, 0.1; } kill(9, -$pid); exit 124; }; alarm $t; waitpid($pid, 0); my $status = $?; exit($status & 127 ? 128 + ($status & 127) : $status >> 8);' "${timeout_seconds}" git "${fetch_git_config[@]}" fetch "$@"
+      return $?
+    fi
+    git "${fetch_git_config[@]}" fetch "$@"
+  }
+  git_fetch_with_retry() {
+    local attempt
+    for attempt in 1 2 3; do
+      local status
+      if git_fetch_once "$@"; then
+        return 0
+      else
+        status=$?
+      fi
+      if [ "${status}" -eq 124 ] || [ "${status}" -eq 137 ]; then
+        echo "::warning::git fetch $* timed out on attempt ${attempt}"
+      fi
+      if [ "${attempt}" -lt 3 ]; then
+        local delay=5
+        [ "${attempt}" -eq 2 ] && delay=15
+        echo "::warning::git fetch $* failed on attempt ${attempt}; retrying in ${delay}s"
+        sleep "${delay}"
+      fi
+    done
+    echo "::warning::git fetch $* failed after 3 attempts"
+    return 1
+  }
+  if [ "$(git rev-parse --is-shallow-repository)" = "true" ]; then
+    if ! git_fetch_with_retry --unshallow --no-tags origin; then
+      echo "::warning::git fetch --unshallow exhausted retries; falling back to a regular fetch"
+      git_fetch_with_retry --no-tags --prune origin
+      if [ "$(git rev-parse --is-shallow-repository)" = "true" ]; then
+        echo "::error::Repository is still shallow after fallback fetch. Downstream git diff operations may produce incomplete results."
+        exit 1
+      fi
+    fi
+  fi
+  git_fetch_with_retry --no-tags origin "+refs/heads/${BASE_REF}:refs/remotes/origin/${BASE_REF}"
+fi

package/scripts/gha/install-github-release.sh

@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+usage() {
+  echo "usage: install-github-release.sh --repo owner/name --version VERSION --asset TEMPLATE --bin NAME [--tag-prefix PREFIX] [--strip-components N]" >&2
+}
+
+REPO="${REPO:-}"
+VERSION="${VERSION:-}"
+ASSET_TEMPLATE="${ASSET_TEMPLATE:-}"
+BIN_NAME="${BIN_NAME:-}"
+TAG_PREFIX="${TAG_PREFIX:-}"
+STRIP_COMPONENTS="${STRIP_COMPONENTS:-1}"
+
+if [ -n "${RELEASE_OWNER:-}" ] && [ -n "${RELEASE_REPO:-}" ]; then
+  REPO="${RELEASE_OWNER}/${RELEASE_REPO}"
+fi
+
+while [ "${#}" -gt 0 ]; do
+  case "$1" in
+    --repo)
+      [ "${#}" -ge 2 ] || { usage; exit 2; }
+      REPO="$2"
+      shift 2
+      ;;
+    --version)
+      [ "${#}" -ge 2 ] || { usage; exit 2; }
+      VERSION="$2"
+      shift 2
+      ;;
+    --asset)
+      [ "${#}" -ge 2 ] || { usage; exit 2; }
+      ASSET_TEMPLATE="$2"
+      shift 2
+      ;;
+    --bin)
+      [ "${#}" -ge 2 ] || { usage; exit 2; }
+      BIN_NAME="$2"
+      shift 2
+      ;;
+    --tag-prefix)
+      [ "${#}" -ge 2 ] || { usage; exit 2; }
+      TAG_PREFIX="$2"
+      shift 2
+      ;;
+    --strip-components)
+      [ "${#}" -ge 2 ] || { usage; exit 2; }
+      STRIP_COMPONENTS="$2"
+      shift 2
+      ;;
+    -h | --help)
+      usage
+      exit 2
+      ;;
+    *)
+      usage
+      exit 2
+      ;;
+  esac
+done
+
+if [ -z "$REPO" ] || [ -z "$VERSION" ] || [ -z "$ASSET_TEMPLATE" ] || [ -z "$BIN_NAME" ]; then
+  usage
+  exit 2
+fi
+
+if [[ ! "$REPO" =~ ^[^/]+/[^/]+$ ]]; then
+  echo "install-github-release.sh: --repo must be owner/name" >&2
+  exit 2
+fi
+
+if ! [[ "$STRIP_COMPONENTS" =~ ^[0-9]+$ ]]; then
+  echo "install-github-release.sh: --strip-components must be a non-negative integer" >&2
+  exit 2
+fi
+
+BIN_DIR="${RUNNER_TEMP:-${HOME}/.local}/bin"
+mkdir -p "$BIN_DIR"
+if [ -n "${GITHUB_PATH:-}" ]; then
+  echo "$BIN_DIR" >> "$GITHUB_PATH"
+fi
+
+already_installed() {
+  local output
+  output="$("$BIN_DIR/$BIN_NAME" --version 2>/dev/null || true)"
+  printf '%s\n' "$output" | awk -v v="$VERSION" '
+    {
+      n = split($0, parts, /[^0-9A-Za-z.-]+/)
+      for (i = 1; i <= n; i++) if (parts[i] == v) found = 1
+    }
+    END { exit found ? 0 : 1 }
+  '
+}
+
+if [ -f "$BIN_DIR/$BIN_NAME" ] && already_installed; then
+  echo "$BIN_NAME $VERSION already installed"
+  exit 0
+fi
+
+if [ -n "${PLATFORM:-}" ]; then
+  RELEASE_PLATFORM="$PLATFORM"
+else
+  case "$(uname)-$(uname -m)" in
+    Darwin-arm64) RELEASE_PLATFORM=aarch64-apple-darwin ;;
+    Darwin-x86_64) RELEASE_PLATFORM=x86_64-apple-darwin ;;
+    Linux-x86_64) RELEASE_PLATFORM=x86_64-unknown-linux-gnu ;;
+    Linux-aarch64) RELEASE_PLATFORM=aarch64-unknown-linux-gnu ;;
+    *)
+      echo "Unsupported platform: $(uname)-$(uname -m)" >&2
+      exit 1
+      ;;
+  esac
+fi
+
+asset_name="$ASSET_TEMPLATE"
+asset_name="${asset_name//\{version\}/${VERSION}}"
+asset_name="${asset_name//\{platform\}/${RELEASE_PLATFORM}}"
+base_url="https://github.com/${REPO}/releases/download/${TAG_PREFIX}${VERSION}"
+archive="${RUNNER_TEMP:-/tmp}/${BIN_NAME}-${VERSION}-${RELEASE_PLATFORM}.tar.gz"
+extract_dir="${RUNNER_TEMP:-/tmp}/${BIN_NAME}-${VERSION}-${RELEASE_PLATFORM}"
+
+rm -rf "$extract_dir"
+mkdir -p "$extract_dir"
+curl -fsSL -o "$archive" "${base_url}/${asset_name}"
+curl -fsSL -o "${archive}.sha256" "${base_url}/${asset_name}.sha256"
+expected=$(awk '{print $1}' "${archive}.sha256")
+if command -v sha256sum >/dev/null 2>&1; then
+  echo "${expected}  ${archive}" | sha256sum -c -
+else
+  echo "${expected}  ${archive}" | shasum -a 256 -c -
+fi
+rm "${archive}.sha256"
+tar -xzf "$archive" -C "$extract_dir" --strip-components="$STRIP_COMPONENTS"
+mv "$extract_dir/$BIN_NAME" "$BIN_DIR/$BIN_NAME"
+chmod +x "$BIN_DIR/$BIN_NAME"
+rm -rf "$archive" "$extract_dir"

package/scripts/gha/load-runner-env.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ -z "${GITHUB_ENV:-}" ]; then
+  echo 'GITHUB_ENV must be set' >&2
+  exit 2
+fi
+
+WORKER_VAR_NAMES="${WORKER_VAR_NAMES:-}"
+env_file="${RUNNER_ENV_FILE:-${HOME}/.github-actions.env}"
+
+_write_workers_var() {
+  local name="$1"
+  local value="${2:-}"
+  if [ -n "$value" ]; then
+    value=$(printf '%s' "$value" | tr -d '\n\r')
+    value=$(printf '%s' "$value" | sed -E 's/^[[:space:]]+//; s/[[:space:]]+$//')
+    if printf '%s' "$value" | grep -qE '^[1-9][0-9]*%?$'; then
+      printf '%s=%s\n' "$name" "$value" >> "$GITHUB_ENV"
+    else
+      echo "::warning::$name='$value' is not a valid worker count (positive integer or percentage) — ignoring"
+    fi
+  fi
+}
+
+_is_worker_var() {
+  local candidate="$1"
+  local name
+  [ -z "$WORKER_VAR_NAMES" ] && return 1
+  for name in $WORKER_VAR_NAMES; do
+    if [ "$name" = "$candidate" ]; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+if [ -n "$WORKER_VAR_NAMES" ]; then
+  for name in $WORKER_VAR_NAMES; do
+    input_name="INPUT_${name}"
+    _write_workers_var "$name" "${!input_name:-}"
+  done
+fi
+
+if [ ! -f "$env_file" ]; then
+  exit 0
+fi
+
+echo "::debug::Loading runner environment from ${env_file}"
+while IFS='=' read -r key value; do
+  case "$key" in
+    NODE_OPTIONS)
+      echo "::warning::Refusing to load NODE_OPTIONS from ${env_file} — GitHub Actions blocks NODE_OPTIONS writes through GITHUB_ENV; set it in workflow env instead"
+      ;;
+    AWS_*)
+      echo "::warning::Refusing to load $key from ${env_file} — AWS credentials must come from aws-actions/configure-aws-credentials (OIDC)"
+      ;;
+    BASH_ENV | ENV | PATH | LD_* | DYLD_* | GIT_*)
+      echo "::warning::Refusing to load $key from ${env_file} — $key can hijack shell startup, the dynamic loader, PATH, or git in privileged steps; set it explicitly in workflow env if genuinely required"
+      ;;
+    *)
+      if _is_worker_var "$key"; then
+        _write_workers_var "$key" "$value"
+      else
+        printf '%s=%s\n' "$key" "$value" >> "$GITHUB_ENV"
+      fi
+      ;;
+  esac
+done < <(
+  grep -vE '^[[:space:]]*(#|$)' "$env_file" \
+    | sed -E 's/^[[:space:]]*export[[:space:]]+//' \
+    | tr -d '\r' \
+    | grep -E '^[A-Za-z_][A-Za-z0-9_]*=' \
+    || true
+)

package/scripts/gha/make-shard-matrix.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [ "${#}" -ne 1 ]; then
+  echo "usage: make-shard-matrix.sh <total>" >&2
+  exit 2
+fi
+
+if [ -z "${GITHUB_OUTPUT:-}" ]; then
+  echo 'GITHUB_OUTPUT must be set' >&2
+  exit 2
+fi
+
+TOTAL="$1"
+if ! [[ "$TOTAL" =~ ^[1-9][0-9]*$ ]]; then
+  echo "::error::shard total must be a positive integer, got: '$TOTAL'"
+  exit 1
+fi
+i=1
+matrix_ids=""
+while [ "$i" -le "$TOTAL" ]; do
+  if [ -n "$matrix_ids" ]; then
+    matrix_ids="${matrix_ids},${i}"
+  else
+    matrix_ids="$i"
+  fi
+  i=$((i + 1))
+done
+echo "total=$TOTAL" >> "$GITHUB_OUTPUT"
+echo "matrix=[${matrix_ids}]" >> "$GITHUB_OUTPUT"